Anti-malware scan management in high-availability virtualization environments

[0001] 1. Field of the Invention

[0002] The present invention relates generally to computer security, and more particularly but not exclusively to methods and apparatus for anti-malware scanning in virtualization environments.

[0003] 2. Description of the Background Art

[0004] Virtual machines, in general, are well known in the art of computer science. Generally speaking, a virtual machine is a software implementation of a machine (i.e., a computer) that executes programs like a physical machine. Multiple virtual machines may run on a single computer hardware platform, which is also referred to as “host machine.” Although the virtual machines run in the same host machine, each virtual machine has its own operating system and functions as a computing environment separate from the other virtual machines. Still, the virtual machines share the same disk I/O (input/output) and processor resources of the same host machine.

[0005] Malware include computer viruses, worms, Trojans, rootkits, spyware and other forms of malicious codes. A virtual machine may include an anti-malware to guard against malware. Typical anti-malware comprises a scan engine and a pattern. The pattern comprises signatures of known malware and other information for identifying malware. In an example operation, the anti-malware may perform an anti-malware scan to compare data against the pattern using a pattern-matching algorithm. Because an anti-malware scan involves a lot of disk I/O and processor computation, anti-malware scanning often significantly impacts the performance of the target virtual machine. Simultaneous anti-malware scanning on several virtual machines running on the same host machine may cause system thrashing.

[0006] Embodiments of the present invention pertain to anti-malware scanning on virtual machines, and are especially advantageous in high-availability virtualization environments where virtual machines are dynamically migrated from one host machine to another.

[0007] In one embodiment, a computer system for high-availability virtualization environment includes an originating host machine hosting several virtual machines. Anti-malware scanning on a virtual machine may be initiated in the originating host machine. Prior to completion of the anti-malware scanning, the virtual machine may be migrated to another, destination host machine. The anti-malware scanning on the virtual machine may be resumed in the destination host machine based on a scan state of the virtual machine. The anti-malware scanning on the virtual machine may be suspended and scheduled for execution in the destination host machine. A scan cache of the virtual machine may be preserved depending on information from the scan state. For example, the scan cache may be preserved and employed in the destination host machine when the originating and destination host machines use the same scan engine and pattern version.

[0008] These and other features of the present invention will be readily apparent to persons of ordinary skill in the art upon reading the entirety of this disclosure, which includes the accompanying drawings and claims.

[0014] The use of the same reference label in different drawings indicates the same or like components.

[0015] In the present disclosure, numerous specific details are provided, such as examples of apparatus, components, and methods, to provide a thorough understanding of embodiments of the invention. Persons of ordinary skill in the art will recognize, however, that the invention can be practiced without one or more of the specific details. In other instances, well-known details are not shown or described to avoid obscuring aspects of the invention.

[0016] Embodiments of the present invention are described in the context of anti-malware scanning for illustration purposes only. In light of the present disclosure, those of ordinary skill in the art will appreciate that embodiments of the present invention may be generally employed in computer security and content filtering applications using a security virtual machine. For example, embodiments of the present invention may also be employed in other applications where a security virtual machine performs file integrity scanning, logs inspection, vulnerabilities scanning, and data leakage prevention scanning on or for other, separate virtual machines running in the same host machine as the security virtual machine.

[0017] FIG. 1 shows a schematic diagram of a computer 100 in accordance with an embodiment of the present invention. The computer 100 may be employed as a server computer for hosting a plurality of virtual machines described below. The computer 100 may be in the form of a security appliance, for example. The computer 100 may have less or more components to meet the needs of a particular application. The computer 100 may include a processor 101, such as those from the Intel Corporation or Advanced Micro Devices, for example. The computer 100 may have one or more buses 103 coupling its various components. The computer 100 may include one or more user input devices 102 (e.g., keyboard, mouse), one or more data storage devices 106 (e.g., hard drive, optical disk, USB memory), a display monitor 104 (e.g., LCD, flat panel monitor, CRT), a computer network interface 105 (e.g., network adapter, modem), and a main memory 108 (e.g., RAM). The computer network interface 105 may be coupled to a computer network 109.

[0018] The computer 100 is a particular machine as programmed with software modules 110. The software modules 110 comprise computer-readable program code stored non-transitory in the main memory 108 for execution by the processor 101. The software modules 110 may comprise computer-readable program code for virtual machines. The software modules 110 may be loaded from the data storage device 106 to the main memory 108. The software modules 110 may also be made available in other computer-readable storage medium including optical disk, flash drive, and other memory device.

[0019] One way of managing anti-malware scans in a virtualization environment is to off-load scanning to a separate virtual machine, referred to as a “security virtual machine.” The security virtual machine may receive scanning requests from individual virtual machines running in the host machine, and schedule the scanning as resources allow. To avoid impacting the performance of the host machine, the security virtual machine may manage a fixed number of on-demand scans (e.g., one scanning task) running on the host machine at the same time. Each virtual machine may also have a thin agent for coordinating scanning with the security virtual machine. The thin agent may maintain a scan cache that indicates results of scanned files, avoiding repeated scanning of the same file.

[0020] The just-mentioned anti-malware scanning architecture is illustrated in FIG. 2, which schematically shows a computer in the form of a host machine 200 (labeled as “Host Machine A”) hosting a plurality of virtual machines VM-1 and VM-2. In the example of FIG. 2, a separate virtual machine in the form of a security virtual machine VM-A provides anti-malware scanning for virtual machines hosted by the host machine 200, including virtual machines VM-1 and VM-2. The security virtual machine VM-A may perform anti-malware scanning for each virtual machine on-demand, i.e., when requested by the virtual machine, per a managed schedule. That is, the security virtual machine VM-A scans files in a virtual machine when requested, but not necessarily right away. Similarly, a separate computer in the form of a host machine 250 (labeled as “Host Machine B”) may include a security virtual machine VM-B to provide on-demand anti-malware scanning to virtual machines hosted by the host machine 250, including virtual machine VM-3 and other virtual machines hosted by the host machine 250. Each of virtual machines VM-1, VM-2, and VM-3 may have a thin agent and a scan cache. Unlike an on-demand scan, which is a scheduled task, a real-time scan is performed by a security virtual machine in real-time (not scheduled) as requested by a virtual machine. The scan cache advantageously limits the number of real time scan events that need to be performed by the security, virtual machine.

[0021] In a high-availability virtualization environment, each virtual machine may be dynamically migrated between host machines to redistribute or optimize loading, or to schedule downtime for a host machine. If a virtual machine is undergoing anti-malware scanning while being migrated from one host machine to another, the anti-malware scan typically cannot be correctly continued in the other host machine. Although the security virtual machine in the other host machine may restart the anti-malware scan, the restarted anti-malware scan may cause performance degradation. It is also possible that the virtual machine may be dynamically migrated yet again to another host machine before the anti-malware scan completes. In that case, the anti-malware scan may take a very long time to complete or may not complete at all. To compound this problem, the request for anti-malware scan from the migrated virtual machine may disturb anti-malware scan scheduling in the destination host machine, and result in more scanning tasks running in the destination host machine, possibly causing system thrashing. Furthermore, security virtual machines may use different anti-malware scan engine and pattern versions, making cached status of migrated virtual machines unusable in other host machines even though their anti-malware are the same product from the same vendor. This last problem may be alleviated by always purging the scan cache as a workaround, but the anti-malware scan performance may still be severely degraded.

[0022] The above-mentioned problems with anti-malware scanning in high-availability virtualization environments is schematically illustrated in FIG. 3, which shows the components first discussed in FIG. 2. In the example of FIG. 3, the security virtual machine VM-A of the host machine 200 is in the middle of performing an on-demand scan on the virtual machine VM-2. In this example, the on-demand scan is scanning the files of the virtual machine VM-2 for malware.

[0023] In a high-availability environment, a virtual machine is expected to be dynamically migrated from one host machine to another. The computer system of FIG. 3 is a high-availability system in that the virtual machines hosted by the host machine 200 are expected to be dynamically migrated to the host machine 250, and vice versa, to balance load distribution, schedule host maintenance, or other reasons. In the example of FIG. 3, this is illustrated with the migration of the virtual machine VM-2 from the host machine 200 to the host machine 250. In this example, however, the on-demand scan of the virtual machine VM-2 by the security virtual machine VM-A has not completed when the virtual machine VM-2 has finished migration to the host machine 250. That is, the anti-malware scanning of files of the virtual machine VM-2 has yet to finish when the migration was dynamically performed. In the host machine 250, the newly migrated virtual machine VM-2 may request the security virtual machine VM-B to restart the anti-malware scanning initiated in the host machine 200, but this adds another anti-malware scan task in the host machine 250. Depending on how well the anti-malware scanning is managed in the host machine 250, the additional scan task may result in two or more on-demand scans simultaneously running in the host machine 250, possibly overloading the host machine 250.

[0024] FIG. 4 schematically illustrates management of anti-malware scanning in high-availability virtualization environments in accordance with an embodiment of the present invention. FIG. 4 is explained using components discussed in conjunction with FIGS. 2 and 3, but suitably configured to perform the anti-malware scan management technique described with reference to FIGS. 4 and 5.

[0025] In the example of FIG. 4, the virtual machine VM-2 is being dynamically migrated from the host machine 200 to the host machine 250. Like in FIG. 3, the migration of the virtual machine VM-2 occurs before an on-demand scan by the security virtual machine VM-A on the virtual machine VM-2 is completed. In the example of FIG. 4, however, the scan state of the anti-malware scan of the virtual machine VM-2 is saved in the host machine 200, and migrated with the virtual machine VM-2 to the host machine 250. The scan state may indicate the anti-malware scan engine and pattern version, and other information indicating the anti-malware used to scan the virtual machine VM-2 in the host machine 200. The scan state may also indicate the state of the anti-malware scan just before the virtual machine VM-2 is migrated, including how far along the scan, which files have been scanned, results of the scan, and other information about the anti-malware scan. The scan state of a virtual machine may be saved by way of a hypervisor of the host machine, for example.

[0026] As schematically illustrated in FIG. 4, the virtual machine VM-2 and its scan state are migrated to the host machine 250. The virtual machine VM-2 includes a scan cache (see FIG. 2), which goes with the virtual machine VM-2. In the host machine 250, the scan state of the virtual machine VM-2 is received and read by the security virtual machine VM-B. The security virtual machine VM-B compares the scan engine and pattern version used by the security virtual machine VM-A with those employed by the security virtual machine VM-B. The security virtual machine VM-B keeps the scan cache of the virtual machine VM-2 when the security virtual machines VM-B and VM-A use the same scan engine and pattern version. Otherwise, when the security virtual machines VM-B and VM-A use different scan engine or pattern versions, the security virtual machine VM-B purges the scan cache of the virtual machine VM-2. For example, the security virtual machine VM-B may send a signal to the thin client of the virtual machine VM-2 to purge its scan cache.

[0027] In the host machine 250, the security virtual machine VM-B restores the virtual machine VM-2 scan task that was originally started in the host machine 200. Thereafter, the security virtual machine VM-B suspends the virtual machine VM-2 scan task, and adds the virtual machine VM-2 scan task to the anti-malware scan queue for scheduling. The security virtual machine VM-B schedules the virtual machine VM-2 scan task. The security virtual machine VM-B then resumes the virtual machine VM-2 scan task as scheduled. The security virtual machine VM-B may also restart the scan task from scratch depending on the scan state, such as when the security virtual machines VM-A and VM-B use different scan engine or pattern versions.

[0028] FIG. 5 shows a flow diagram of a method of managing anti-malware scanning in high-availability virtualization environments, in accordance with an embodiment of the present invention. As can be appreciated, the host machine 200 performs the actions executed in the host machine 200, including the actions of the security virtual machine VM-A and all virtual machines hosted in the host machine 200. Similarly, the host machine 250 performs the actions executed in the host machine 250, including the actions of the security virtual machine VM-B and all virtual machines hosted in the host machine 250.

[0029] In the example of FIG. 5, the host machine 200 is in the process of migrating the virtual machine VM-2 to the host machine 250, and so in forms the host machine 250 (FIG. 5, “migrating VM-2”). When the migration is started, the security virtual machine VM-A running in the host machine 200 is in the middle of scanning the virtual machine VM-2 for malware (FIG. 5, “Scan VM-2”). The host machine 200 (or a management server, depending on the architecture) also informs the security virtual machine VM-A that the virtual machine VM-2 is being migrated (FIG. 5, second “migrating VM-2”). In response, the scan state of the ongoing scan of the virtual machine VM-2 is saved (FIG. 5, “save state”) at the host machine 200 (FIG. 5, “scan state”), e.g., using the hypervisor of the host machine 200. The security virtual machine VM-A then stops the anti-malware scan of the virtual machine VM-2. The virtual machine VM-2 is thereafter migrated to the host machine 250 (FIG. 5, “VM-2 migrated (with scan state)”).

[0030] In the host machine 250, the security virtual machine VM-B is currently scanning the virtual machine VM-3 (FIG. 5, “Scan VM-3”). When the virtual machine VM-2 and its scan state are migrated to the host machine 250, the security virtual machine VM-B checks the scan state to determine the scan engine and pattern version (FIG. 5, “check engine and pattern version”) of the security virtual machine VM-A, i.e., the scan engine and pattern version used to scan the virtual machine VM-2 in the previous host machine. To take advantage of the scan performed in the host machine 200, the security virtual machine VM-B will try to preserve the scan cache of the virtual machine VM-2 (FIG. 5, “purge cache only if necessary”). In one embodiment, the security virtual machine VM-B will preserve and use the scan cache of the virtual machine VM-2 when the security virtual machines VM-B and VM-A use the same scan engine and pattern version. Otherwise, when the virtual machines VM-B and VM-A have different scan engine or pattern versions, the security virtual machine VM-B will purge the scan cache of the virtual machine VM-2.

[0031] The security virtual machine VM-B restores in the host machine 250 the scan task of the virtual machine VM-2 that was started in the host machine 200 but interrupted by the migration (FIG. 5, “restore scan task”). The security virtual machine VM-B thereafter suspends the scan task (“FIG. 5, “suspend scan of VM-2”), and schedules the scan task for execution in accordance with the schedule. For example, the security virtual machine VM-B may complete anti-malware scanning of the virtual machine VM-3 before starting anti-malware scanning of the virtual machine VM-3 in the host machine 250.

[0032] When the scan task is up for execution, the security virtual machine VM-B restarts the scan task (FIG. 5, “Scan VM-2”) based on the scan state. For example, assuming the security virtual machines VM-B and VM-A have the same scan engine and pattern version, the security virtual machine VM-B restarts the scan task from where the security virtual machine VM-A left off according to the scan state. Otherwise, the security virtual machine VM-B starts the anti-malware scanning of the virtual machine VM-2 from scratch. Either way, the scanning of the virtual machine VM-2 in the host machine 250 is scheduled properly, avoiding conflict with existing scan tasks in the host machine 250 and preventing overloading of the host machine 250. In the case where security virtual machines VM-B and VM-A have the same scan engine and pattern version, the security virtual machine VM-B can take advantage of the previous scanning performed by the security virtual machine VM-A, improving anti-malware scan performance in the host machine 250.

[0033] While specific embodiments of the present invention have been provided, it is to be understood that these embodiments are for illustration purposes and not limiting. Many additional embodiments will be apparent to persons of ordinary skill in the art reading this disclosure.