TECHNICAL FIELD

This disclosure relates to capturing behavior-based virtual machine (VM) resources for forensics.

BACKGROUND

Many third-party software services capture snapshots of a state of memory in a computing system for the purpose for recovering or analyzing a malicious software attack. Because modern computing systems may utilize a substantial amount of memory, these snapshots often consume considerable processing and memory resources. Additionally, the static nature of the snapshots only captures the delta between snapshots, thereby causing contention between the desire to capture snapshots at a high frequency to ensure a small delta and the desirability to maintain performance by minimizing the number of snapshots captured and stored.

SUMMARY

One aspect of the disclosure provides a method for capturing virtual machine resources for forensics. The method includes receiving, at data processing hardware, an indication of compromise. The indication of compromise indicates an attack is imminent against a virtual machine. In response to receiving the indication of compromise and before the attack against the virtual machine begins, the method includes snapshotting, by the data processing hardware, a volatile-memory state of volatile-memory used by the virtual machine and a non-volatile memory state of non-volatile memory used by the virtual machine and increasing, by the data processing hardware, a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing. The heightened level of auditing generates data representative of all accesses to the volatile-memory used by the virtual machine and the non-volatile memory used by the virtual machine. After the attack against the virtual machine has begun, the method includes maintaining, by the data processing hardware, the heightened level of auditing for a threshold period of time, notifying, by the data processing hardware, a user of the virtual machine of the indication of compromise, and storing, by the data processing hardware, the data in memory external to the virtual machine.

Implementations of the disclosure may include one or more of the following optional features. In some implementations, snapshotting the non-volatile memory state includes suspending garbage collection of the non-volatile memory. Snapshotting the volatile memory state may include executing a live migration of the volatile memory. In some examples, the threshold period of time is configurable by the user of the virtual machine. Optionally, the indication of compromise is based upon existence of a suspicious process and the threshold period of time is based upon the existence of the suspicious process.

In some implementations, the threshold period of time corresponds to the life of the virtual machine. Optionally, the data further includes a list of all commands executed by the virtual machine during the heightened level of auditing. In some examples, the method further includes determining, by the data processing hardware, that the attack has concluded and in response to determining that the attack has concluded, snapshotting, by the data processing hardware, the volatile-memory state of the volatile-memory used by the virtual machine and the non-volatile memory state of the non-volatile memory used by the virtual machine.

Receiving the indication of compromise may include receiving the indication of compromise from an intrusion detection system executing on the data processing hardware. The intrusion detection system may execute in a first hierarchical protection domain and software resources within a user space of the virtual machine may execute in a second hierarchical protection domain. The first hierarchical protection domain has more privileges than the second hierarchical protection domain. In some examples, the first hierarchical protection domain corresponds to ring 0 of the virtual machine and the second hierarchical protection domain corresponds to ring 3 of the virtual machine. In some implementations, no snapshotting of the volatile-memory state of the volatile-memory and the non-volatile memory state of the non-volatile memory occurs while the attack against the virtual machine is in progress.

Another aspect of the disclosure provides a system for capturing virtual machine resources for forensics. The system includes data processing hardware and memory hardware in communication with the data processing hardware. The memory hardware stores instructions that when executed on the data processing hardware cause the data processing hardware to perform operations that include receiving an indication of compromise. The indication of compromise indicates an attack is imminent against a virtual machine. In response to receiving the indication of compromise and before the attack against the virtual machine begins, the operations include snapshotting a volatile-memory state of volatile-memory used by the virtual machine and a non-volatile memory state of non-volatile memory used by the virtual machine and increasing a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing. The heightened level of auditing generates data representative of all accesses to the volatile-memory used by the virtual machine and the non-volatile memory used by the virtual machine. After the attack against the virtual machine has begun, the operations include maintaining the heightened level of auditing for a threshold period of time, notifying a user of the virtual machine of the indication of compromise, and storing the data in memory external to the virtual machine.

This aspect may include one or more of the following optional features. In some implementations, snapshotting the non-volatile memory state includes suspending garbage collection of the non-volatile memory. Snapshotting the volatile memory state may include executing a live migration of the volatile memory. In some examples, the threshold period of time is configurable by the user of the virtual machine. Optionally, the indication of compromise is based upon existence of a suspicious process and the threshold period of time is based upon the existence of the suspicious process.

In some implementations, the threshold period of time corresponds to the life of the virtual machine. Optionally, the data further includes a list of all commands executed by the virtual machine during the heightened level of auditing. In some examples, the operations further include determining that the attack has concluded and in response to determining that the attack has concluded, snapshotting the volatile-memory state of the volatile-memory used by the virtual machine and the non-volatile memory state of the non-volatile memory used by the virtual machine.

Receiving the indication of compromise may include receiving the indication of compromise from an intrusion detection system executing on the data processing hardware. The intrusion detection system may execute in a first hierarchical protection domain and software resources within a user space of the virtual machine may execute in a second hierarchical protection domain. The first hierarchical protection domain has more privileges than the second hierarchical protection domain. In some examples, the first hierarchical protection domain corresponds to ring 0 of the virtual machine and the second hierarchical protection domain corresponds to ring 3 of the virtual machine. In some implementations, no snapshotting of the volatile-memory state of the volatile-memory and the non-volatile memory state of the non-volatile memory occurs while the attack against the virtual machine is in progress.

The details of one or more implementations of the disclosure are set forth in the accompanying drawings and the description below. Other aspects, features, and advantages will be apparent from the description and drawings, and from the claims.

