Patent ID: 8079030
Filing Date: 2011-12-13
Classification: H04L

Abstract:
1. A method of detecting stealth network communications in a computer having a hypervisor supervising a virtual machine, the virtual machine having a virtualized network interface, the method comprising: establishing a secure communications channel between a guest security module executing within the virtual machine and a security module executing within the hypervisor; communicating, by the security module executing within the hypervisor using the secure communications channel, with the guest security module executing within the virtual machine to identify real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module; maintaining, by the security module executing within the hypervisor, a list of the identified real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module; identifying, by the security module executing within the hypervisor, real-time network communications involving the computer; identifying, by the security module executing within the hypervisor, a stealth network communication on the virtualized network interface of the virtual machine undetected by the guest security module by correlating the identified real-time network communications involving the computer with the list of identified real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module; and altering the stealth network communication.