Abstract:
The systems, methods and apparatuses described herein provide a computing system for executing an antivirus software program. In one aspect, a non-transitory computer-readable medium may comprise an antivirus software program to be executed in a first virtual machine by a computer processor that supports multiple virtual machines. The antivirus software program may obtain access to a memory of a second virtual machine on the computer processor that supports multiple virtual machines, and use the access to the memory of the second virtual machine to monitor the memory of the second virtual machine and take a corrective action. In a further aspect, the corrective action may be to remove any malware found on a computer operating system that is running on the second virtual machine.

Description:
RELATED APPLICATIONS 
       [0001]    This application claims priority to U.S. Provisional Application No. 61/808,931, filed Apr. 5, 2013, entitled “SYSTEMS, METHODS AND APPARATUSES FOR PROTECTION OF ANTIVIRUS SOFTWARE,” the content of which is incorporated herein by reference in its entirety. 
     
    
     BACKGROUND 
       [0002]    Antivirus software applications play an important role in protecting modern operating systems. Unfortunately, modern antivirus software applications need not only to detect viruses, but also need to protect themselves against viruses. In particular, zero-day attacks may occur during a vulnerability window that exists in the time between when a vulnerability is first exploited and when software developers start to develop and publish a counter to that threat. 
         [0003]    Embodiments according to the present disclosure may prevent an antivirus software application from being circumvented or stopped by viruses. In addition, these embodiments may reduce the attack window for an update process when a zero-day attack is found and announced. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0004]      FIG. 1  is a block diagram of an exemplary computer system according to the present disclosure. 
           [0005]      FIGS. 2A and 2B  illustrate a flow diagram of an exemplary process according to the present disclosure. 
       
    
    
     DETAILED DESCRIPTION 
       [0006]    Certain illustrative aspects of the systems, apparatuses, and methods according to the present invention are described herein in connection with the following description and the accompanying figures. These aspects are indicative, however, of but a few of the various ways in which the principles of the invention may be employed and the present invention is intended to include all such aspects and their equivalents. Other advantages and novel features of the invention may become apparent from the following detailed description when considered in conjunction with the figures. 
         [0007]    In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the invention. In other instances, well known structures, interfaces, and processes have not been shown in detail in order not to unnecessarily obscure the invention. However, it will be apparent to one of ordinary skill in the art that those specific details disclosed herein need not be used to practice the invention and do not represent a limitation on the scope of the invention, except as recited in the claims. It is intended that no part of this specification be construed to effect a disavowal of any part of the full scope of the invention. Although certain embodiments of the present disclosure are described, these embodiments likewise are not intended to limit the full scope of the invention. 
         [0008]      FIG. 1  shows an exemplary embodiment of the computer system  100  according to present disclosure. The computer system  100  may be, for example, a server or desktop computer, and also may be a smartphone, a tablet or PDA. The computer system  100  may comprise a computer processor configured to run a hypervisor  110  and a plurality of virtual machines (VMs) on the computer system  100 . The plurality of VMs may be initialized and monitored by the hypervisor  110 , and may include a VM-NS  130 , a VM-A  120  and a VM-N  140 . The VM-NS  130  may run an operating system OS  135 , which may be, for example, a traditional OS, such as WINDOWS, LINUX, UNIX, ANDROID, etc. The VM-A  120  may run an antivirus software application  125 , which may be referred to as antivirus  125  hereinafter. The antivirus  125  may run within a traditional OS or a special OS, or without any OS. The VM-N  140  may be configured to handle network communications for the computer system  100  and may be connected to a network interface card (NIC)  150  of the computer system  100 . In some embodiments, the VM-N  140  may be in control of the NIC  150 . 
         [0009]    The computer system  100  may further comprise a storage  160 . The storage  160  may be an internal or external redundant array of independent disks (RAID) array, hard disk drive (HDD), solid state drive (SSD), storage area network (SAN), flash memory, etc. In some embodiments, the storage  160  may physically reside outside of an enclosure of the computer system  100 . Moreover, as shown in  FIG. 1 , the storage  160  may be logically separated into logical volumes  160 A and  160 B, and an optional logical volume  160 C. Such separation may be achieved, for example, at RAID controller level, which may provide, for example, separate SCSI devices for the logical volumes  160 A,  160 B and  160 C. In another example, existing virtualization techniques (for example, those which are used in VMWARE® products, such as VMWARE® Workstation) may be used to provide logical volumes on top of one or more underlying file systems and/or partitions. In some embodiments, the volume  160 A may be used outside of the VM-NS  130  (i.e., not available as a storage for the VM-NS  130 ), and the volume  160 B may be used to form a virtual drive for the VM-NS  130  and OS  135 . 
         [0010]    The VM-NS  130  and VM-A  120  may be coupled to the VM-N  140  by the links  142  and  144  respectively. In some embodiments, the links  142  and  144  may be virtual network links and the VM-N  140  may run a virtual router for other VMs of the computer system  100  to communicate with external computer systems via the NIC  150 . That is, from the point of view of the antivirus  125  and OS  135 , the communication with the VM-N  140  may be a network communication. If a network link used by a VM is a virtual network connection, the VM using the virtual network may implement drivers for the virtual network card, for example, similar to the way how virtual network is implemented in a VMWARE® Workstation product. 
         [0011]    In some other embodiments, the VM-N  140  may contain the network stack, which may, in some embodiments, include a TCP/IP stack, to handle communications on behalf of other VMs of the computer system  100 . For example, the link  144  may be implemented as a shared memory block between the VM-A  120  and VM-N  140 . The hypervisor  110  may allocate one or more segments of the physical memory of the computer system  100  and grant both VM-A  120  and VM-N  140  access to these allocated memory segments. These memory segments may thus form a shared memory block (i.e., the link  144 ) between the VM-A  120  and VM-N  140 . Depending on the implementations, the access to the shared memory block may be concurrent or interleaved, and each of the VM-A  120  and VM-N  140  may write to and read from the memory block when it has been granted access to the memory block. This approach may allow the network stack (or some parts of it) to be removed from the VM-A  120  and thus, reduce the attack surface of the antivirus  125 . The link  142  between the VM-NS  130  and VM-N  140  may be implemented as a shared memory block shared by both the VM-NS  130  and VM-N  140  as well to allow the network stack (or some parts of it) be removed from the VM-NS  130 . In another embodiment, the link  144  may be implemented as a shared memory block as described above, and the link  142  may be implemented as a network link (with VM-N  150  acting as a virtual router for the link  142 ). 
         [0012]      FIGS. 2A and 2B  illustrate an exemplary process  200  according to the present disclosure. At block  201 , hypervisor  110  may be launched within a computer system  100  (for example, boot or reboot of computer system  100  may be performed, resulting in launch of hypervisor  110 ). At block  202 , a first virtual machine running an antivirus application may be created in the computer system  100 . For example, the hypervisor  110  may create the VM-A  120  with the antivirus  125  running within it (without any peripheral devices attached). Then at block  204 , a second virtual machine connected to a network interface card may be established. For example, the hypervisor  110  may create the VM-N  140  and attach it to the NIC  150  (such attaching may be done using usual virtual machine device handling techniques, which in some cases may involve using IOMMU or VT-d technology). Then at block  206 , an update for either the antivirus or software running on the second virtual machine may be looked for. For example, the antivirus  125  may look for an update on the Internet via the link  144 , VM-N  140 , and NIC  150 . It should be noted that the term update may refer to a number of updates collectively and thus may includes more than one piece of update. 
         [0013]    At block  208 , any update found may be downloaded. For example, if an update to either antivirus  125 , or software running within VM-N  140 , is found, the antivirus  125  may initiate downloading it, for example, to the volume  160 A. Then at block  210 , the downloaded update may be applied. In some embodiments, after the download is completed, the downloaded update may be validated before being applied. In some embodiments, applying the update may be implemented by requesting the hypervisor  110  to restart the appropriate VM with a completely new downloaded image. This may require that the downloaded update include a full image of the appropriate VM and allow all malware in the existing instance of the VM to be removed (as the image is completely new). In other embodiments, the downloaded update may be passed to the appropriate VM for the update to be applied. It should be noted that the blocks  206 - 210  may be optional in some embodiments. 
         [0014]    The process  200  may then proceed to an optional block  220 , at which the antivirus may check a current image of a third virtual machine that hosts an OS for potential malware. For example, the third virtual machine that hosts an OS may be the VM-NS  130  and antivirus  125  may check the current image of the VM-NS  130  for potential malware (on the OS  135  or any software applications running on the OS  135 ). As the VM-NS  130  is not running at this point, the check may be done in a manner simpler than that of a running system. Then at block  222 , if any malware is found, the antivirus may attempt to cure the image, for example, by trying to remove the malware. In some embodiments, the antivirus  125  may optionally ask for instructions from a user (for example, via keyboard/mouse/screen, etc.). At block  230 , the antivirus (e.g., antivirus  125 ) may look for an update for the OS (e.g., the OS  135 ), and download and validate the found update. 
         [0015]    At block  232 , the hypervisor  110  may launch the VM-NS  130  using the current image checked in block  220 , with attached peripheral devices which may include video card, keyboard, volume  160 B, other storage, etc. (not shown). The image may contain a current image of the OS and may include any modifications made in block  222  in an attempt to remove malware. In some embodiments, the VM-A  120  may obtain (e.g., request and be given) access to all the memory of the VM-NS  130  at this stage (in some embodiments access may be restricted to read-only access), and the VM-NS  130  may have access to volumes  160 B and  160 C but not access to the link  142 . Absence of access to the link  142  may ensure that if there is an existing network attack on the OS  135 , the attackers may not reach the OS  135  until the update is applied. 
         [0016]    At block  234 , the update may be applied to the OS  135 . For example, the OS  135  may find out about the update (for example, by detecting that the volume  160 C is present and/or contains an update, or receiving a notification from the hypervisor  110 , or by other ways), and apply it. At block  236 , if the update is successfully applied, the OS  135  may report about it to the hypervisor  110 . In some embodiments, the antivirus  125  may optionally check (for example, by obtaining and using access to the memory of the VM-NS  130 ) that the update is indeed successfully applied and report it to the hypervisor  110 . When the hypervisor  110  is satisfied (which may, depending on embodiment, require either a report from the OS  135 , or a report from the antivirus  125 , or both) that the update is indeed successfully applied, at block  238 , the hypervisor  110  may allow the VM-NS  130  to access the link  142  and enable the normal operation of the VM-NS  130 . 
         [0017]    At block  250 , the normal operation of the OS  135  may start. During this block, the antivirus  125  may continue to monitor the state of the VM-NS  130  and OS  135  (e.g., via access to the memory of the VM-NS  130 ), and to detect if malware is present within the OS  135 . If malware is detected, the antivirus  125  may react accordingly. For example, in some embodiments, the antivirus  125  may implement operations in blocks  252 ,  254 ,  256  and  258 . At block  252 , the antivirus  125  may request the hypervisor  110  to stop the VM-NS  130  and to temporarily re-attach a video card and a keyboard (not shown) to VM-A  120 . In some embodiments, the antivirus  125  may also store the current image of the VM-NS  130 , for example, in the volume  160 A. Then, at block  254 , the antivirus  125  may ask for instructions from a user via a screen and keyboard/mouse. At block  256 , the antivirus  125  may attempt to remove the found malware from the current image of the VM-NS  130 . At block  258 , the antivirus  125  may request the hypervisor  110  to resume the VM-NS  130  from (potentially cured) current image of VM-NS  130 . 
         [0018]    Alternatively, in some other embodiments, if malware is detected at block  250 , the antivirus  125  may attempt to remove the malware while the VM-NS  130  is running, or request to stop it and manipulate its memory directly, without storing the VM-NS  130  as a current image. In these alternative embodiments, the antivirus  125  may need write access to the memory of the VM-NS  130 . Such write access may be granted by the hypervisor  110  to the antivirus  125  at all the times, or may be granted only when explicitly requested by the antivirus  125 . 
         [0019]    During the block  250 , the antivirus  125  may additionally look for information about update(s) to the antivirus  125 , and/or software of the VM-N  140 , and/or OS  135 . This may be implemented, for example, via polling (for example, via link  144 , VM-N  140 , and network card  150 ), or via subscription to a “push” notification. If an update to the antivirus  125  or VM-N  140  is detected, the update may be downloaded and applied in a manner similar to that described with respect to blocks  208 - 210 . In some embodiments, the update lookup and application may be done without disrupting the operation of the VM-NS  130 . If a security-critical update to the OS  135  is detected, the antivirus  125  may request the hypervisor  110  to disable the link  142  while the update is downloaded and applied, to reduce the vulnerability window of the OS  135 . 
         [0020]    In some embodiments, the antivirus  125  during the block  250  may have access not only to the memory of the VM-NS  130 , but also to CPU registers of the VM-NS  130 . Such access may be implemented, for example, via a request to the hypervisor  110 . For example, the hypervisor  110  may temporarily pause the VM-NS  130 , read the state of the CPU registers of the VM-NS  130 , report the state of the CPU registers to the antivirus  125 , and then resume the VM-NS  130 . In some embodiments, the hypervisor  110  may additionally create a temporary snapshot of the VM-NS  130  at this point, thereby allowing the antivirus  125  to work with a consistent temporary image of the VM-NS  130 . Such a snapshot may be implemented, for example, based on a copy-on-write technique, so pages which are about to be written by the VM-NS  130 , may be copied to another location (for example, in RAM, or within the volume  160 A) accessible to the antivirus  125 . 
         [0021]    In some embodiments, there may be an additional antivirus agent (not shown), running within the OS  135 . The additional antivirus agent may be, for example, a program somewhat similar to a usual antivirus program. The antivirus agent may be used, for example, for real-time protection from attacks (for example, when data is about to be loaded, such as when inserting a CD, or browsing the web, or when a file already within the OS  135  is about to be opened or executed). In some embodiments, the antivirus  125  may monitor that the antivirus agent is running and/or is not modified during the block  250 . If the antivirus  125  detects that the antivirus agent is not running and/or is modified—which might indicate that an attack is in progress, the antivirus  125  may take any appropriate actions. For example, in addition to or instead of usual checks for updates and attempt to cure OS  135  as described above, in some cases the antivirus  125  may request the hypervisor  110  to pause the VM-NS  130 , to report the problem to a user, and if the user allows—to communicate with an antivirus response team (potentially including snapshot of VM-NS  130  in the communication), to wait for an update to the antivirus  125  to be provided, to download and apply the update to the antivirus  125 , and then to attempt to cure the OS  135 . 
         [0022]    It should be noted that in some cases, all or part of functionality of the antivirus  125  may be implemented as a part of the hypervisor  110 . 
         [0023]    Moreover, it should also be noted that in some embodiments, the system described on  FIG. 1  may be implemented on top of a system described in U.S. Provisional Patent Application Nos. 61/791,632 (the &#39;632 Application), filed on Mar. 15, 2013, and/or 61/808,774, filed on Apr. 5, 2013, both of which are entitled “Secure Zone on a Virtual Machine for Digital Communications,” the contents of both of which are incorporated by reference in their entirety herein. In this case, some or all of functionality of the antivirus  125  may be implemented within a supervisor as described therein. 
         [0024]    It should be understood that when an image and/or update is mentioned within the scope of present embodiment, any known or future-developed techniques to ensure the validity of the image and/or update may be applied before the image and/or update is used. The known techniques may include, but are not limited to, checksums, cryptographic hashes, signatures, public-key infrastructure (PKI), etc. 
         [0025]    The various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. The described functionality can be implemented in varying ways for each particular application—such as by using any combination of microprocessors, microcontrollers, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), and/or System on a Chip (SoC)—but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention. 
         [0026]    The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. 
         [0027]    The methods disclosed herein comprise one or more steps or actions for achieving the described method. The method steps and/or actions may be interchanged with one another without departing from the scope of the present invention. In other words, unless a specific order of steps or actions is required for proper operation of the embodiment, the order and/or use of specific steps and/or actions may be modified without departing from the scope of the present invention.