Patent SG-11201804196W-A (SG)
Title: Extracting malicious instructions on a virtual machine in a network environment
Inventor: SCHILLING JEFFERY
IPC: G06F9/455
Filed: 2016-11-16
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property -' Organization ID International Bureau ir:Plid (43) International Publication Date ..... ..sr ,„,„01 1 June 2017 (01.06.2017) WIPO I PCT Hit (10) WO International 2017/091399 1111111111111111111111111111111111111111111111111111111111111t111111111111111 Publication Al Number (51) International Patent Classification: (81) Designated GO6F 9 / 4 55 (2006.01) kind of national AO, AT, (21) International Application Number: BZ, CA, CH, PCT/US2016/062173 DO, DZ, EC, (22) International Filing Date: HN, HR, HU, 16 November 2016 (16.11.2016) KW, KZ, MG, MK, (25) Filing Language: English OM, PA, PE, (26) Publication Language: English SC, SD, SE, TN, TR, TT, (30) Priority Data: ZW. 62/258,730 23 November 2015 (23.11.2015) US 15/169,203 31 May 2016 (31.05.2016) US (84) Designated 15/169,230 31 May 2016 (31.05.2016) US kind of regional 15/169,248 31 May 2016 (31.05.2016) US GM, KE, 15/169,282 31 May 2016 (31.05.2016) US TZ, UG, ZM, 15/169,304 31 May 2016 (31.05.2016) US TJ, TM), 15/169,320 31 May 2016 (31.05.2016) US DK, EE, ES, LV, MC, (71) Applicant: ARMOR DEFENSE INC. [US/US]; 2360 SM, TR), Campbell Creek Boulevard, Suite 525, Richardson, TX GW, KM, States (unless otherwise indicated, for every protection available): AE, AG, AL, AM, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, ID, IL, IN, IR, IS, JP, KE, KG, KN, KP, KR, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, States (unless otherwise indicated, for every protection available): ARIPO (BW, GH, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, European (AL, AT, BE, BG, CH, CY, CZ, DE, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, ML, MR, NE, SN, TD, TG). 75082 (US). Published: (72) Inventors: SCHILLING, Jeffery, Ray; 1000 St. Mark Drive, Murphy, TX 75094 (US). CUNNINGHAM, Chase, with international 21(3)) search report (Art Copper; 1280 Seymour Drive, Frisco, TX 75033 (US). — before the expiration of the time limit for amending the SHAH, Tawfiq, Mohan; 1521 Bonham Parkway, Argyle, claims and to be republished in the event of receipt of TX 76226 (US). KOTIKELA, Srujan, Das; 7720 Mccal- amendments (Rule 48.2(h)) lum Boulevard, Apartment 2057, Dallas, TX 75252 (US). Agent: BHAVSAR, Samir, A.; Baker Botts, LLP, 2001 (74) Ross Avenue Suite 600, Dallas, TX 75201 (US). (54) Title: EXTRACTING MALICIOUS INSTRUCTIONS ON A VIRTUAL MACHINE IN A NETWORK ENVIRONMENT i \ 114 / 100 108 104 Known l Threat Aggregator t Virtual Vault Machines Trusted Measurement Guest Virtual Machines Machines 106-- r- 12 — 122 L 132 Analysis Tool Profiling Tool Applications 112 134 ^ l t-- Virtual ISZl ir nieticP Device Interface Engine Interface Vault User Space 128 User Space 138 User Space 118 12 Man Console . - I Kernel Space 130 Kernel Space 140 Kernel Spice 120 Tit *** flo, Il ? 1 3L ---K-K H YP eMs°1 1 1 6 — I S 4 8 aZ i e tic l=g 1 24 Hypervisor \ --'\" Device Driver Control Points .4t Engine Vhlua ization Manager Cr\ 50 ___,-- - , Hypervisor Cr\ 02 • - 152 Controller Connections—..„ %, 116 1 en FIG. 1-1 CT\ o (57) : A system including a guest virtual machine with one or more virtual machine measurement points configured to col - ---. lest virtual machine operating characteristics metadata and a hypervisor control point configured to receive virtual machine operat - IN m • g characteristics metadata from the virtual machine measurement points. The hypervisor control point is further configured to send c:::, the virtual machine operating characteristics metadata to a hypervisor associated with the guest virtual machine. The system further ei includes the hypervisor configured to receive the virtual machine operating characteristics metadata and to forward the virtual ma - 0 chine operating characteristics metadata to a hypervisor device driver in a virtual vault machine. The system further includes the vir- tual vault machine configured to determine a classification for the guest virtual machine based on the virtual machine operating char- acteristics metadata and to send the determined classification to a vault management console.