HK1216930A1 - 用於虛擬機中的惡意軟件檢測的過程評估 - Google Patents

用於虛擬機中的惡意軟件檢測的過程評估

Info

Publication number
HK1216930A1
HK1216930A1 HK16104719.4A HK16104719A HK1216930A1 HK 1216930 A1 HK1216930 A1 HK 1216930A1 HK 16104719 A HK16104719 A HK 16104719A HK 1216930 A1 HK1216930 A1 HK 1216930A1
Authority
HK
Hong Kong
Prior art keywords
virtual machines
malware detection
process evaluation
evaluation
malware
Prior art date
Application number
HK16104719.4A
Other languages
English (en)
Inventor
山多爾．盧卡奇
瓦西里．托薩 勞爾-
丹尼爾．博卡 保羅-
弗洛蘭．哈嘉瑪山 格奧爾基-
弗拉德．魯塔斯 安德烈-
Original Assignee
Bitdefender Ipr Man Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Bitdefender Ipr Man Ltd filed Critical Bitdefender Ipr Man Ltd
Publication of HK1216930A1 publication Critical patent/HK1216930A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Debugging And Monitoring (AREA)
  • Memory System Of A Hierarchy Structure (AREA)
HK16104719.4A 2013-07-05 2016-04-25 用於虛擬機中的惡意軟件檢測的過程評估 HK1216930A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US13/936,058 US9117080B2 (en) 2013-07-05 2013-07-05 Process evaluation for malware detection in virtual machines
PCT/RO2014/000019 WO2015152748A1 (en) 2013-07-05 2014-07-02 Process evaluation for malware detection in virtual machines

Publications (1)

Publication Number Publication Date
HK1216930A1 true HK1216930A1 (zh) 2016-12-09

Family

ID=52133728

Family Applications (1)

Application Number Title Priority Date Filing Date
HK16104719.4A HK1216930A1 (zh) 2013-07-05 2016-04-25 用於虛擬機中的惡意軟件檢測的過程評估

Country Status (13)

Country Link
US (1) US9117080B2 (zh)
EP (1) EP3017392B1 (zh)
JP (1) JP6378758B2 (zh)
KR (1) KR101946982B1 (zh)
CN (1) CN105393255B (zh)
AU (1) AU2014389572B2 (zh)
CA (1) CA2915888C (zh)
ES (1) ES2785350T3 (zh)
HK (1) HK1216930A1 (zh)
IL (1) IL243123B (zh)
RU (1) RU2634205C2 (zh)
SG (1) SG11201510313SA (zh)
WO (1) WO2015152748A1 (zh)

Families Citing this family (86)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10187452B2 (en) 2012-08-23 2019-01-22 TidalScale, Inc. Hierarchical dynamic scheduling
KR101880796B1 (ko) * 2013-02-10 2018-08-17 페이팔, 인코포레이티드 예측보안 제품을 제공하고 기존의 보안제품을 평가하는 방법과 장치
US9824225B1 (en) * 2013-09-20 2017-11-21 EMC IP Holding Company LLC Protecting virtual machines processing sensitive information
WO2015065330A1 (en) * 2013-10-29 2015-05-07 Hewlett-Packard Development Company, L.P. Virtual machine introspection
US9692789B2 (en) 2013-12-13 2017-06-27 Oracle International Corporation Techniques for cloud security monitoring and threat intelligence
US9514317B2 (en) * 2013-12-19 2016-12-06 Intel Corporation Policy-based trusted inspection of rights managed content
US9507935B2 (en) * 2014-01-16 2016-11-29 Fireeye, Inc. Exploit detection system with threat-aware microvisor
US20150229659A1 (en) * 2014-02-13 2015-08-13 Guardicore Ltd. Passive detection of malicious network-mapping software in computer networks
US9836318B2 (en) * 2014-02-21 2017-12-05 Infineon Technologies Ag Safety hypervisor function
US9241010B1 (en) * 2014-03-20 2016-01-19 Fireeye, Inc. System and method for network behavior detection
JP6370098B2 (ja) * 2014-05-16 2018-08-08 杉中 順子 情報処理装置、情報処理監視方法、プログラム、及び記録媒体
US10038703B2 (en) * 2014-07-18 2018-07-31 The Regents Of The University Of Michigan Rating network security posture and comparing network maliciousness
US9710648B2 (en) * 2014-08-11 2017-07-18 Sentinel Labs Israel Ltd. Method of malware detection and system thereof
US11507663B2 (en) 2014-08-11 2022-11-22 Sentinel Labs Israel Ltd. Method of remediating operations performed by a program and system thereof
US9552481B1 (en) * 2014-12-30 2017-01-24 Symantec Corporation Systems and methods for monitoring programs
US9189630B1 (en) 2015-01-21 2015-11-17 AO Kaspersky Lab Systems and methods for active operating system kernel protection
US10944764B2 (en) * 2015-02-13 2021-03-09 Fisher-Rosemount Systems, Inc. Security event detection through virtual machine introspection
US10127064B2 (en) * 2015-02-24 2018-11-13 Red Hat Israel, Ltd. Read-only VM function chaining for secure hypervisor access
US10417031B2 (en) * 2015-03-31 2019-09-17 Fireeye, Inc. Selective virtualization for security threat detection
US10567395B2 (en) * 2015-05-10 2020-02-18 Check Point Advanced Threat Prevention Ltd Detection of potentially malicious web content by emulating user behavior and user environment
US9703956B1 (en) * 2015-06-08 2017-07-11 Symantec Corporation Systems and methods for categorizing virtual-machine-aware applications for further analysis
US10691476B2 (en) * 2015-06-27 2020-06-23 Mcafee, Llc Protection of sensitive data
US11113086B1 (en) 2015-06-30 2021-09-07 Fireeye, Inc. Virtual system and method for securing external network connectivity
RU2618947C2 (ru) * 2015-06-30 2017-05-11 Закрытое акционерное общество "Лаборатория Касперского" Способ предотвращения работы программ, содержащих нежелательный для пользователя функционал
US10395029B1 (en) 2015-06-30 2019-08-27 Fireeye, Inc. Virtual system and method with threat protection
US10726127B1 (en) 2015-06-30 2020-07-28 Fireeye, Inc. System and method for protecting a software component running in a virtual machine through virtual interrupts by the virtualization layer
US10642753B1 (en) * 2015-06-30 2020-05-05 Fireeye, Inc. System and method for protecting a software component running in virtual machine using a virtualization layer
RU2589862C1 (ru) 2015-06-30 2016-07-10 Закрытое акционерное общество "Лаборатория Касперского" Способ обнаружения вредоносного кода в оперативной памяти
US10216927B1 (en) * 2015-06-30 2019-02-26 Fireeye, Inc. System and method for protecting memory pages associated with a process using a virtualization layer
US10033759B1 (en) 2015-09-28 2018-07-24 Fireeye, Inc. System and method of threat detection under hypervisor control
CN105389197B (zh) 2015-10-13 2019-02-26 北京百度网讯科技有限公司 用于基于容器的虚拟化系统的操作捕获方法和装置
JP6721329B2 (ja) * 2015-12-21 2020-07-15 三菱電機株式会社 パワー半導体装置およびその製造方法
US10089124B2 (en) 2015-12-31 2018-10-02 International Business Machines Corporation Security application for a guest operating system in a virtual computing environment
JP6711000B2 (ja) * 2016-02-12 2020-06-17 日本電気株式会社 情報処理装置、ウィルス検出方法及びプログラム
US10536478B2 (en) * 2016-02-26 2020-01-14 Oracle International Corporation Techniques for discovering and managing security of applications
US10127368B2 (en) 2016-03-01 2018-11-13 Filevine, Inc. Systems for identity validation and association
US20210026950A1 (en) * 2016-03-07 2021-01-28 Crowdstrike, Inc. Hypervisor-based redirection of system calls and interrupt-based task offloading
WO2017155523A1 (en) * 2016-03-09 2017-09-14 Hewlett Packard Enterprise Development Lp Server virtual address space
US10116630B2 (en) * 2016-04-04 2018-10-30 Bitdefender IPR Management Ltd. Systems and methods for decrypting network traffic in a virtualized environment
US11379385B2 (en) 2016-04-16 2022-07-05 Vmware, Inc. Techniques for protecting memory pages of a virtual computing instance
CN107360120B (zh) * 2016-05-10 2019-06-11 华为技术有限公司 虚拟网络功能的审计方法和装置
US10430223B2 (en) 2016-05-17 2019-10-01 Vmware, Inc. Selective monitoring of writes to protected memory pages through page table switching
US10592267B2 (en) 2016-05-17 2020-03-17 Vmware, Inc. Tree structure for storing monitored memory page data
FR3051934A1 (fr) * 2016-05-24 2017-12-01 Orange Procede d'identification d'au moins une fonction d'un noyau d'un systeme d'exploitation
US10579421B2 (en) * 2016-08-29 2020-03-03 TidalScale, Inc. Dynamic scheduling of virtual processors in a distributed system
CN106445639A (zh) * 2016-09-30 2017-02-22 北京奇虎科技有限公司 监测虚拟机的方法及装置
US10635479B2 (en) * 2016-12-19 2020-04-28 Bitdefender IPR Management Ltd. Event filtering for virtual machine security applications
CN108241801B (zh) * 2016-12-26 2021-03-30 华为技术有限公司 处理系统调用的方法和装置
US9734337B1 (en) 2017-01-24 2017-08-15 Malwarebytes Inc. Behavior-based ransomware detection
US10592664B2 (en) * 2017-02-02 2020-03-17 Cisco Technology, Inc. Container application security and protection
JP6841703B2 (ja) * 2017-03-29 2021-03-10 アドソル日進株式会社 コンピュータ装置
US11023135B2 (en) 2017-06-27 2021-06-01 TidalScale, Inc. Handling frequently accessed pages
US10802863B2 (en) 2017-07-07 2020-10-13 Electronics And Telecommunications Research Institute Apparatus and method for storing audit trail in response to virtual-machine process execution
KR101937935B1 (ko) * 2017-07-07 2019-04-11 한국전자통신연구원 가상머신 프로세스 실행에 따른 감사 증적 저장 장치 및 방법
US11294898B2 (en) 2017-07-31 2022-04-05 Pearson Education, Inc. System and method of automated assessment generation
US10467552B2 (en) * 2017-07-31 2019-11-05 Pearson Education, Inc. System and method for automatic content provisioning
WO2019032728A1 (en) 2017-08-08 2019-02-14 Sentinel Labs, Inc. METHODS, SYSTEMS AND DEVICES FOR DYNAMICALLY MODELING AND REGROUPING END POINTS FOR ONBOARD NETWORKING
KR20190021673A (ko) * 2017-08-23 2019-03-06 주식회사 수산아이앤티 랜섬웨어 방지 장치 및 방법
US10817347B2 (en) 2017-08-31 2020-10-27 TidalScale, Inc. Entanglement of pages and guest threads
US11687654B2 (en) * 2017-09-15 2023-06-27 Intel Corporation Providing isolation in virtualized systems using trust domains
US10546120B2 (en) * 2017-09-25 2020-01-28 AO Kaspersky Lab System and method of forming a log in a virtual machine for conducting an antivirus scan of a file
US10678922B2 (en) * 2017-11-23 2020-06-09 Nicira, Inc. Detecting arbitrary code execution using a hypervisor
US10713357B2 (en) * 2017-11-23 2020-07-14 Nicira, Inc. Detecting lateral movement using a hypervisor
CN107798236B (zh) * 2017-11-30 2021-05-04 阿里巴巴（中国）有限公司 一种对应用程序安装包实现安全安装的方法和装置
US11250123B2 (en) 2018-02-28 2022-02-15 Red Hat, Inc. Labeled security for control flow inside executable program code
CN108804225B (zh) * 2018-05-24 2021-01-01 新华三云计算技术有限公司 一种虚拟机负载调控方法和装置
WO2020104772A1 (en) * 2018-11-19 2020-05-28 Secure Micro Ltd Computer implemented method
US11295008B2 (en) * 2019-02-13 2022-04-05 Nec Corporation Graphics processing unit accelerated trusted execution environment
US11550903B1 (en) * 2019-04-26 2023-01-10 Joseph Alan Epstein System and method for trustworthiness, reputation, provenance, and measurement of software
EP3973427A4 (en) 2019-05-20 2023-06-21 Sentinel Labs Israel Ltd. SYSTEMS AND METHODS FOR EXECUTABLE CODE DETECTION, AUTOMATIC FEATURE EXTRACTION, AND POSITION-INDEPENDENT CODE DETECTION
US11277436B1 (en) * 2019-06-24 2022-03-15 Ca, Inc. Identifying and mitigating harm from malicious network connections by a container
US11782713B1 (en) * 2019-08-27 2023-10-10 Amazon Technologies, Inc. Security vulnerability mitigation using address space co-execution
US11630900B2 (en) * 2019-09-30 2023-04-18 Mcafee, Llc Detection of malicious scripted activity in fileless attacks
US10754506B1 (en) * 2019-10-07 2020-08-25 Cyberark Software Ltd. Monitoring and controlling risk compliance in network environments
US11836247B2 (en) * 2020-03-30 2023-12-05 Fortinet, Inc. Detecting malicious behavior in a network using security analytics by analyzing process interaction ratios
IL275098A (en) * 2020-06-03 2022-01-01 Kazuar Advanced Tech Ltd A multi-computing environment with the fewest loopholes
RU2763112C1 (ru) * 2020-08-24 2021-12-27 Акционерное общество "Лаборатория Касперского" Система и способ формирования списка виртуальных машин с указанием статуса защиты
WO2022081733A1 (en) * 2020-10-13 2022-04-21 BedRock Systems, Inc. A formally verified trusted computing base with active security and policy enforcement
US11579857B2 (en) 2020-12-16 2023-02-14 Sentinel Labs Israel Ltd. Systems, methods and devices for device fingerprinting and automatic deployment of software in a computing network using a peer-to-peer approach
US20230229761A1 (en) * 2021-04-20 2023-07-20 Assured Information Security, Inc. Prevention and remediation of malware based on selective presentation of files to processes
CN113221103B (zh) * 2021-05-08 2022-09-20 山东英信计算机技术有限公司 一种容器安全防护方法、系统及介质
US11899782B1 (en) * 2021-07-13 2024-02-13 SentinelOne, Inc. Preserving DLL hooks
WO2023069166A1 (en) * 2021-10-21 2023-04-27 Microsoft Technology Licensing, Llc Securely redirecting system service routines
KR102656980B1 (ko) * 2022-03-14 2024-04-15 세종대학교산학협력단 가상화 환경에서 인스턴스의 메모리를 연속적으로 기록하는 방법 및 장치
WO2023239009A1 (ko) * 2022-06-10 2023-12-14 엘지전자 주식회사 차량의 신호 처리 장치 및 이를 구비하는 차량용 통신 장치용 통신 장치
US11977496B1 (en) 2022-09-29 2024-05-07 Amazon Technologies, Inc. Security vulnerability mitigation using hardware-supported context-dependent address space hiding

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4412156B2 (ja) * 2004-11-30 2010-02-10 沖電気工業株式会社 処理装置
US8516583B2 (en) * 2005-03-31 2013-08-20 Microsoft Corporation Aggregating the knowledge base of computer systems to proactively protect a computer from malware
US7996836B1 (en) 2006-12-29 2011-08-09 Symantec Corporation Using a hypervisor to provide computer security
US8380987B2 (en) * 2007-01-25 2013-02-19 Microsoft Corporation Protection agents and privilege modes
US7797748B2 (en) * 2007-12-12 2010-09-14 Vmware, Inc. On-access anti-virus mechanism for virtual machine architecture
US8561182B2 (en) * 2009-01-29 2013-10-15 Microsoft Corporation Health-based access to network resources
US8387046B1 (en) 2009-03-26 2013-02-26 Symantec Corporation Security driver for hypervisors and operating systems of virtualized datacenters
WO2012135192A2 (en) * 2011-03-28 2012-10-04 Mcafee, Inc. System and method for virtual machine monitor based anti-malware security
US20120254993A1 (en) * 2011-03-28 2012-10-04 Mcafee, Inc. System and method for virtual machine monitor based anti-malware security
US8099596B1 (en) 2011-06-30 2012-01-17 Kaspersky Lab Zao System and method for malware protection using virtualization
US9069586B2 (en) * 2011-10-13 2015-06-30 Mcafee, Inc. System and method for kernel rootkit protection in a hypervisor environment

Also Published As

Publication number Publication date
JP6378758B2 (ja) 2018-08-22
CA2915888A1 (en) 2015-10-08
CN105393255A (zh) 2016-03-09
KR101946982B1 (ko) 2019-05-10
ES2785350T3 (es) 2020-10-06
US20150013008A1 (en) 2015-01-08
EP3017392A1 (en) 2016-05-11
AU2014389572A1 (en) 2016-01-21
RU2016103212A (ru) 2017-08-10
KR20160030385A (ko) 2016-03-17
JP2016526730A (ja) 2016-09-05
SG11201510313SA (en) 2016-01-28
IL243123B (en) 2019-11-28
WO2015152748A1 (en) 2015-10-08
CN105393255B (zh) 2019-07-12
AU2014389572B2 (en) 2019-03-07
CA2915888C (en) 2021-05-04
US9117080B2 (en) 2015-08-25
EP3017392B1 (en) 2020-01-22
RU2634205C2 (ru) 2017-10-24

Similar Documents

Publication Publication Date Title
HK1216930A1 (zh) 用於虛擬機中的惡意軟件檢測的過程評估
IL244861A0 (en) Composite scoring for malware detection
GB201621103D0 (en) Virtual sensor data generation for wheel stop detection
GB201602099D0 (en) Securityevent detection through virtual machine introspection
EP2987277A4 (en) Hypervisor and physical machine and respective methods therein for performance measurement
GB201404226D0 (en) Fault detection in induction machines
EP2879049A4 (en) METHOD, SYSTEM AND DEVICE FOR PRODUCING A VIRTUAL MACHINE
SG11201505652UA (en) Secure virtual machine migration
EP2949804A4 (en) CLOTHING TREATMENT APPARATUS
EP2815349A4 (en) TRUSTED SOURCES FOR MEASURING VIRTUAL MACHINES
EP2987282A4 (en) MIGRATION OF VIRTUAL MACHINE
PL3008236T3 (pl) Maszyna czyszcząca
IL234004A0 (en) Discovering common occurrence patterns in the domain name system
EP2866393A4 (en) METHOD AND APPARATUS FOR DETERMINING A DRIFT OF A VIRTUAL MACHINE
HK1211192A1 (zh) 用於飲料製備機的筐
GB201307980D0 (en) Method, apparatus and computer program for detecting collision
EP2982832A4 (en) ROTARY MACHINE
SG11201503974SA (en) Method, apparatus and system for virtual clothes modelling
GB2532902B (en) Methods for improving processing speed for object inspection
GB2510701B (en) Improved malware detection
GB2518902B (en) Early depth testing in graphics processing
SG11201510354QA (en) Washing machine
PL2796046T3 (pl) Maszyna do przetwarzania masy mięsnej
PL3028011T3 (pl) Urządzenie do wykrywania obrotu
TWM476263U (en) Optics detecting machine