Abstract:
A system for protecting networks from vulnerability exploits comprises a security engine operable to receive a packet destined for a user&#39;s network and forward the packet to at least one host virtual machine for processing. The security engine is further operable to forward the stored packet to the user&#39;s internal network based upon a result of the processed packet. A method of securing a network from vulnerability exploits is described. The method comprises receiving a packet destined for a user&#39;s internal network; forwarding the packet to at least one virtual machine based upon a virtual machine configuration table; processing the forwarded packet on the at least one virtual machine; and releasing the packet to the user&#39;s internal network based upon results of the processing.

Description:
BACKGROUND 
     Intrusion Prevention Systems (IPS) are used to protect computer networks against malicious incoming traffic. However, the effectiveness of an IPS is limited due to the fact that an IPS only blocks traffic for which it has a “signature.” A signature being a specific rule for content filtering to detect electronic threats. Accordingly, an IPS may not block an exploit for a vulnerability the vendor is not aware of, or for which there is no patch available. A zero-day exploit is one that takes advantage of a security vulnerability on the same day that the vulnerability becomes generally known, or before a signature has been developed and the exploit is in circulation (in the wild). 
     Zero-day protection is the ability to provide protection against zero-day exploits. Because zero-day attacks are generally unknown to the public, it is often difficult to defend against them. Zero-day attacks are often effective against “secure” networks and can remain undetected even after they are launched. 
     Techniques exist to limit the effectiveness of zero-day memory corruption-type vulnerabilities, such as buffer overflows. These protection mechanisms exist in contemporary operating systems such as SUN MICROSYSTEMS SOLARIS, LINUX, UNIX, and UNIX-like environments. Versions of MICROSOFT WINDOWS XP Service Pack 2 and later include limited protection against generic memory corruption-type vulnerabilities. Desktop and server protection software also exists to mitigate zero-day buffer overflow vulnerabilities. Typically, these technologies involve heuristic determination analysis, stopping the attacks before they cause any harm. However, this type of analysis is prone to a high incidence of false positive results. 
    
    
     
       DESCRIPTION OF THE DRAWINGS 
       The present invention is illustrated by way of example, and not by limitation, in the figures of the accompanying drawings in which elements having the same reference numeral designations represent like elements throughout and wherein: 
         FIG. 1  is a block diagram of a zero-day security system according to an embodiment of the present invention; 
         FIG. 2  is an exemplary four virtual machine embodiment of the zero-day security system illustrated in  FIG. 1 ; and 
         FIG. 3  is an exemplary message sequence diagram according to an embodiment of the zero-day system illustrated in  FIG. 1 . 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  depicts a block diagram of a zero-day (ZD) security system  100  operable to host a plurality of virtual machines (VMx)  104  comprising images of operating systems and applications executed by virtual hardware, e.g., emulated hardware and/or virtualized hardware and/or software. Under control of ZD Engine  102 , security system  100  buffers incoming traffic from an external network  112  intended for hosts on a company&#39;s internal network  116 . Receiving the traffic over a communication channel  120 , ZD Engine  102  forwards the incoming traffic to at least one virtual machine  104  over communication channel  122 . 
     Virtual machines  104  comprise applications and services similar to the applications and services hosted on the user&#39;s internal network, i.e., the intended hosts, and are operable to process the received packets, simulating the processing that the intended hosts would perform. Virtualization allows multiple virtual machines  104 , with heterogeneous operating systems to run in isolation, side-by-side on the same physical machine. Each virtual machine  104  has its own set of virtual hardware (e.g., random access memory (RAM), central processing unit (CPU), network interface card (NIC), etc.) upon which an operating system  103  and applications/services  106  are loaded and executed. In this manner, an incoming packet sees a consistent operating system  103  and a normalized set of hardware regardless of the actual physical hardware components, and allows the security system  100  to simulate the user&#39;s infrastructure. 
     In some embodiments, incoming data packets from an external network  112  are first received by a signature or heuristic-based intrusion prevention system (IPS)  114  prior to being received by the ZD security system  100 . The IPS  114  is configured to provide a first level of security against malicious traffic. Although IPS  114  is not required, the use of an IPS decreases latency in the overall security system by decreasing malicious traffic that may cause one or more virtual machines  104  to fail. To reduce latency in this or other embodiments, system  100  may comprise a duplicate image  105  each virtual machine  104  to which incoming traffic  120  is directed if the first image fails  104 . In some embodiments, the image may be of the entire virtual machine  104 , including the virtual OS  103 , application/service  106  and ZD Watcher  108 . In other embodiments, the back-up image  105  comprises the only the state, e.g., stack and volatile data portion, of the virtual machine  104 . 
     After allowing the virtual machines to process the packet for a predetermined period of time, ZD Watcher  108  determines the status of the port that received the packet and communicates the status to ZD Engine  102  over link  124 . Based upon a received status and instituted security polices, ZD Engine  102  determines whether or not to release the buffered packet to the user&#39;s internal network  116  over link  126  that in some embodiments may connect to one or more internal network servers, not shown. 
     ZD Utility  110  comprises a third component of ZD security system  100  that is in communication with ZD Engine  102  and each virtual machine  104 . By operation of a user interface, e.g., a keyboard and display terminal, ZD Utility  110  allows a user to configure at least one security policy, e.g., policy configuration  134 ; ZD Engine configurations; VM configurations; and monitor CPU utilization and status of virtual machine instances (VMx). The status monitoring aspect of ZD Utility  110  is operable to monitor the status of each virtual machine process, e.g., applications  106  and ZD Watcher  108 . In some embodiments, the ZD Utility  110  may, if a process fails to respond or is otherwise inoperable, replace the failed VM instance with a back-up, e.g., backup image  105 , while the halted instance is restarted. In other embodiments, a part of policy configuration  134  may allow a user to choose to have at least a portion of the failed instance saved for further analysis. 
     In some embodiments, ZD security system  100  comprises a server  132  that executes the processes comprises ZD security system  100  and which are in communication with IPS  114  and internal network  116 . In some particular embodiments, server  132  may include a HP PROLIANT DL360 rack server executing a LINUX-based Operating System (OS). 
     In some embodiments, such as when a virtual machine  104  is hosted on the same server as the ZD engine  102 , e.g., server  132 , links  122 ,  124 ,  128 , and  130  only comprise inter-process communication channels. In other embodiments, wherein one or more virtual machines  104 , and/or ZD Engine  102  are separate servers, these links may include one or more physical interconnection, such as an interprocessor cable. 
     ZD Engine  102  is not limited to protecting against zero-day exploits. Another aspect of ZD security system  100  includes being used as a tool to capture new exploits and analyze the behavior of the exploits. 
       FIG. 2  illustrates one embodiment of ZD security system  100  comprising four virtual machine instances, i.e., VMA, VMB, VMC, and VMD, connected to ZD Engine  102 . In some embodiments, two virtual machines execute MICROSOFT WINDOWS 2003 operating system with INTERNET INFORMATION SERVER, and the third and fourth virtual machine execute a LINUX Operating System with an APACHE web server installed. Furthermore, the number of redundant virtual machines is non-limiting and is a function of the capabilities of server  132  and the user&#39;s environment. In addition, the specific configuration of the virtual machine, e.g., operating system, applications, services, communication ports, etc., is configurable to fit a customer&#39;s infrastructure and to test those features and services supported. 
     At step  304 , packets destined for specified hosts on the internal network  116  are diverted over communications link  120  to ZD Engine  102 . ZD Engine  102 , e.g., a software program executing on server  132 , controls the operation of the ZD security system  100  and via buffer logic  204  stores and forwards each packet to one or more virtual machines (VMx) based upon VM configuration table  206 . ZD Engine  102  continuously checks the status, e.g., port status, of each VMx to which the ZD Engine  102  has sent the packet and makes a decision to block or forward the packet based upon the received status and the security policy configuration  134  invoked. 
     ZD Engine  102  is responsible for maintaining the VM configuration table  206 , which comprises a list of configured virtual machine instances  104 , the media access control (MAC) address of the virtual machine instance, and the ports and services on each virtual machine, VMA-VMD, operable to test incoming packets. As indicated in VM Configuration Table  206 , of the four virtual machines, only virtual machines VMA and VMB process traffic on port  23 . 
     By way of example,  FIGS. 2 and 3  illustrates one embodiment of a block diagram and method of implementing the zero-day security system of  FIG. 1 . At function  302  a security policy  134  may be downloaded to ZD Engine  102  upon which the ZD Engine  102  processes status information received from each VM  104 . 
     At function  304 , a packet destined for an application on port  23  is received by ZD Engine  102  over link  120 . At function  306 , buffer logic  204  stores and forwards, at function  308 , the packet to VMA and VMB over communication channels  122 , based upon VM configuration table  206 . 
     ZD Watcher program  108 , installed on each virtual machine, VMA-VMD, monitors is operable to track, at functions  310  and  312 , the packet sequence number and destination port number of each packet sent to the virtual machines, VMA-VMD. Prior to receiving the packet, port  23  should be in a “LISTEN” state. Upon receipt of the packet, the application  106  processes the packet at function  314 , and unless the packet has adversely affected the operation of the application  106 /virtual machine  104 , port  23  should still be in a “LISTEN” state. 
     In some embodiments ZD Watcher  108  checks port status approximately 50 microseconds after the initial tracking of the packet at function  310  to ensure that the port in receipt of the packet, e.g., port  23 , is still in a “LISTEN” state. If the application, e.g.,  106   a , is in a “LISTEN” state, ZD Watcher  108  sends, at function  322 , an “OK” message over communication channel  124  to ZD Engine  102  that includes the associated packet sequence number. 
     ZD Watcher  108  transmits VM status to the ZD Engine  102  over communication channel  124  through predetermined ports, e.g., ports 7750 and 7751, on ZD Engine  102  and ZD Watcher  108 , respectively. Furthermore, inter-process communication allows the ZD Watcher  108  to obtain VM application configuration information from the ZD Engine  102 . 
     In some embodiments, the ZD Engine  102  waits, at function  324 , for receipt of an “OK” message from the virtual machines, i.e., VMA and VMB, responsible for processing the original packet destined for port “ 23 ,” before buffer logic  204  transmits, at function  326 , the original packet to the internal network  116  over link  126 . In other embodiments, depending upon the user environment and the security policy stored in security policy configuration  134  of ZD Utility  110 , ZD Engine  102  may forward the packet prior to receiving a response from the virtual machines VMA and VMB processing the packet. 
     Based upon the above description, a malicious packet attempting to exploit a zero-day vulnerability on port  23  may be successful in crashing virtual machines VMA and VMB. However, their respective ZD Watcher  108  programs detect the crash and notify ZD Engine  102  of both the crash and the packet sequence number of the malicious packet that initiated the crash. Accordingly, the offending packet is blocked from the internal network. 
     The functions of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, PROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of non-transitory storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a computing device or user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a computing device or user terminal.