Techniques for securely performing reputation based analysis using virtualization

[0001] The present disclosure relates generally to securely performing reputation based analysis and, more particularly, to techniques for securely performing reputation based analysis using virtualization.

[0002] Methods of detecting malware, such as viruses, worms, and spyware, may utilize a file signature, a file origin, or other file attributes to determine if a file is harmful. Malware, however, may be designed to interfere with such determinations once a machine is infected. For example, malware may affect an infected machine's network stack, such as a network proxy, and may redirect network requests in a manner that is more difficult to detect. Thus, a network request on an infected machine may appear to be directed towards an innocuous network site and the malware may utilize an infected network proxy to redirect the request to a harmful network site.

[0003] Other actions may be taken by malware to mask, spoof, or otherwise hide the nature of a file on an infected computer, hide a request to download malware, or to hide other malware activities and/or malware attributes. As another example, malware may change network information such as Uniform Resource Locators (URLs) contained on an infected machine. That is, malware may alter browser cache files to list only safe or valid websites in the browser cache file. Malware may also affect file system drivers or network drivers to hide the presence or the identity of a file. Thus, a malware detection or prevention system may attempt to scan a system or a file being downloaded and may be provided with improper file attributes. For example, if a malware detection system attempts to determine the reputation of a file being downloaded using a fake URL provided by an infected machine, the malware detection system may incorrectly identify the file being downloaded as safe.

[0004] In view of the foregoing, it may be understood that there are significant problems and shortcomings associated with current reputation based analysis technologies.

[0005] Techniques for securely performing reputation based analysis using virtualization are disclosed. In one particular exemplary embodiment, the techniques may be realized as a computer implemented method for performing reputation based analysis comprising detecting a specified activity associated with a virtual client, determining a reputation associated with the specified activity, and performing an action associated with the determined reputation.

[0006] In accordance with other aspects of this particular exemplary embodiment, detecting a specified activity may comprise utilizing a component associated with a virtualization platform to monitor one or more activities of a virtual client of the virtualization platform.

[0007] In accordance with further aspects of this particular exemplary embodiment, the component associated with a virtualization platform to monitor one or more activities of a virtual client of the virtualization platform may comprise a network proxy of the virtualization platform.

[0008] In accordance with additional aspects of this particular exemplary embodiment, one or more portions of the reputation based analysis may be performed using a process running in a portion secure from access of the virtual client.

[0009] In accordance with additional aspects of this particular exemplary embodiment, the secure portion may comprise at least one of: a secure partition, a flash drive, and secure persistent storage.

[0010] In accordance with additional aspects of this particular exemplary embodiment, the specified activity may comprise at least one of: downloading a portable executable file, downloading a specified file type, performing an action on the virtual client, and accessing a specified network resource.

[0011] In accordance with additional aspects of this particular exemplary embodiment, determining a reputation associated with the specified activity may comprise generating a indicator uniquely associated with the specified activity, and comparing the indicator with stored reputation data.

[0012] In accordance with additional aspects of this particular exemplary embodiment, the stored reputation data may comprise a network accessible data store.

[0013] In accordance with additional aspects of this particular exemplary embodiment, the comparison may generate a reputation score.

[0014] In accordance with additional aspects of this particular exemplary embodiment, generating an indicator may comprise running a hash function on data associated with the specified activity.

[0015] In accordance with additional aspects of this particular exemplary embodiment, the data associated with the specified activity may comprise at least one of: a file, a Uniform Resource Locator (URL), and a network address.

[0016] In accordance with additional aspects of this particular exemplary embodiment, performing an action associated with the determined reputation may comprise at least one of: prompting a user, blocking a file, quarantining a file, denying network access, preventing a virtual client process activity, suspending a virtual client process, terminating a virtual client process, and allowing the specified activity.

[0017] In accordance with additional aspects of this particular exemplary embodiment, the techniques may be realized as at least one processor readable medium for storing a computer program of instructions configured to be readable by at least one processor for instructing the at least one processor to execute a computer process for performing the method.

[0018] In another particular exemplary embodiment, the techniques may be realized as an article of manufacture for performing reputation based analysis, the article of manufacture comprising at least one processor readable medium, and instructions carried on the at least one medium, wherein the instructions are configured to be readable from the at least one medium by at least one processor and thereby cause the at least one processor to operate so as to detect a specified activity associated with a virtual client, determine a reputation associated with the specified activity, and perform an action associated with the determined reputation.

[0019] In yet another particular exemplary embodiment, the techniques may be realized as a system providing reputation based analysis comprising one or more processors configured to detect a specified activity associated with a virtual client, determine a reputation associated with the specified activity, and perform an action associated with the determined reputation.

[0020] In accordance with other aspects of this particular exemplary embodiment, the one or more processors may be configured to detect a specified activity by utilizing a component associated with a virtualization platform to monitor one or more activities of a virtual client of the virtualization platform.

[0021] In accordance with further aspects of this particular exemplary embodiment, the one or more processors may be further configured to perform one or more portions of the reputation based analysis using a process running in a secure portion of the virtualization platform.

[0022] In accordance with additional aspects of this particular exemplary embodiment, the specified activity may comprise at least one of downloading a portable executable file, downloading a specified file type, performing a specified action on the virtual client, and accessing a specified network resource.

[0023] In accordance with additional aspects of this particular exemplary embodiment, the one or more processors may be configured to determine a reputation associated with the specified activity by generating a indicator uniquely associated with the specified activity and comparing the indicator with stored reputation data.

[0024] In accordance with additional aspects of this particular exemplary embodiment, the one or more processors may be configured to perform a specified action associated with the determined reputation by at least one of prompting a user, blocking a file, quarantining a file, denying network access, preventing a virtual client process activity, suspending a virtual client process, terminating a virtual client process, and allowing the specified activity.

[0025] The present disclosure will now be described in more detail with reference to exemplary embodiments thereof as shown in the accompanying drawings. While the present disclosure is described below with reference to exemplary embodiments, it should be understood that the present disclosure is not limited thereto. Those of ordinary skill in the art having access to the teachings herein will recognize additional implementations, modifications, and embodiments, as well as other fields of use, which are within the scope of the present disclosure as described herein, and with respect to which the present disclosure may be of significant utility.

[0030] Referring to FIG. 1, there is shown a system 100 for securely performing reputation based analysis using virtualization in accordance with an embodiment of the present disclosure. FIG. 1 is a simplified view of system 100, which may include additional elements that are not depicted. The system 100 comprises network element 112, network 102 and computer 104. Network element 112 may be communicatively coupled to network 102. Computer 104 may be communicatively coupled to network 102. Computer 104 may comprise virtualization platform 106, which in turn may comprise guest Operating System (OS) 108, and secure portion 110. Storage 114 may be communicatively coupled to network element 112.

[0031] Network 102 may be a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, a satellite network, or another network that permits communication between network element 112, computer 104, and other devices communicatively coupled to network 102.

[0032] Network element 112 may be an application server, a backup server, a network storage device, a media server, or other device communicatively coupled to network 102. Network element 112 may utilize storage 114 for the storage of reputation data, malware signatures, reputation logic, or other data. In other embodiments, network element 112 may represent a network appliance connected to a storage area network.

[0033] Storage 114 may be network accessible storage and may be local, remote, or a combination thereof to network element 112. Storage 114 may utilize a tape, disk, a storage area network (SAN), or other computer accessible storage. In one or more embodiments, storage 114 may be a database.

[0034] In one or more embodiments, network element 112 may be a server providing cloud based security. Storage 114 may store reputation data utilized by network element 112. Reputation data may include file attributes, file signatures, file patterns, network addresses, URLs, process names, or other unique file or network indicators.

[0035] Computer 104 may be a desktop computer, a laptop computer, a server, or other processing device capable of hosting a virtualization platform. Computer 104 may receive data from user input, a database, a file, a web service, and/or an application programming interface. Computer 104 may comprise one or more components, such as virtualization platform 106, which in turn may comprise guest OS 108 and secure portion 110.

[0036] Virtualization platform 106 may be a hypervisor, a virtual machine monitor, or another platform which may enable multiple operating systems to run on computer 104 at the same time. For example, virtualization platform 106 may utilize VMware™, Phoenix Hyperspace™ or other products. Virtualization platform 106 may enable one or more guest operating systems, such as guest OS 108, to run.

[0037] Guest OS 108 may be a guest operating system of virtualization platform 106. Guest OS 108 may be an operating system such as Microsoft Windows XP®, Microsoft Vista®, Linux, or other operating system. Guest OS 108 may be a full version of an operating system. However, virtualization platform 106 may provide one or virtualized resources and guest OS 108 may not access resources of computer 104 directly. For example, virtualization platform 106 may provide virtualized hardware to guest OS 108, such as virtualized disk storage, virtualized network interfaces, or other virtualized resources.

[0038] Secure portion 110 may be a portion of virtualization platform 106 separate from guest OS 108 and inaccessible to guest OS 108. Secure portion 110 may also be outside of virtualization platform 106 and may reside on computer 104 or may be communicatively coupled to computer 104. Secure portion 110 may be a secure partition, a flash drive, or other secure persistent storage. Secure portion 110 may comprise an operating system used to host virtualization platform 106. Secure portion 110 may comprise one or more components capable of monitoring one or more virtualized resources of guest OS 108.

[0039] In one or more embodiments, secure portion 110 may comprise an agent or another process for performing reputation based analysis for one or more virtual clients of virtualization platform 106. The agent may be capable of monitoring one or more activities of guest OS 108 by monitoring communications from guest OS 108 to virtualization platform 106. For example, an agent may monitor network requests of guest OS 108 from outside of guest OS 108 by monitoring network communications in the network stack outside of guest OS 108. This may prevent malware located in guest OS 108 from interfering with the monitoring. While malware on an infected virtual machine may alter URLs within the virtual machine, it may use the actual URL in network requests to the virtualized network interface. Thus, network traffic from guest OS 108 to the virtual machine monitor may contain the actual URL in order for the malware to access its intended network resource.

[0040] An agent on secure portion 110 may monitor this network traffic and may generate an indicator uniquely associated with one or more portions of the network traffic. For example, an agent on secure portion 110 may detect a URL requested by guest OS 108, which may be associated with the downloading of an executable file, such as an .exe file, a .dll file, object code, or other executable file types. The agent on secure portion 110 may generate an indicator uniquely associated with the URL and/or the requested file. The agent on secure portion 110 may generate the indicator by running a hash function, such as a Message-Digest Algorithm 5 (MD5) function or a Secure Hash Algorithm (SHA) function. A resulting hash value may be compared by the agent to reputation analysis data. An agent or other process running on secure portion 110 may utilize an Application Programming Interface (API), a database query, a web service, or other interface to obtain reputation analysis data.

[0041] Reputation analysis may be performed on computer 104, remote from computer 104, or on a plurality of computing platforms. For example, an agent or other process running on secure portion 110 may interface with network element 112, which may be a server providing cloud based security. Network element 112 may query storage 114 to determine a reputation score or other analytical benchmark of an indicator provided by the agent.

[0042] An agent running on secure portion 110, a component of virtualization platform 106, and/or a process running on computer 104 may perform reputation based analysis of other activities. For example, file system requests of guest OS 108 may be analyzed. The modification of files or file system attributes, the creation of files, and/or the deletion of files may be monitored securely from outside of guest OS 108. As another example, a process running on secure portion 110 may monitor a file system driver associated with virtualization platform 106 and may request or perform reputation analysis of one or more files or file system activities. Malware on guest OS 108 may not be capable of affecting processes outside of its managed virtual environment, and thus may not be capable of interfering with detection and/or prevention of harmful activity. An agent running on secure portion 110, a component of virtualization platform 106, and/or a process running on computer 104 may also perform reputation based analysis of other activities, such as the spawning of harmful processes.

[0043] Reputation analysis data may contain ratings or other indicators to determine what action should be performed in response to data associated with a hash value. For example, reputation analysis data may provide an indicator that provides a high score if data associated with a hash value is likely to be malware or otherwise detrimental to a user. In other embodiments, a low score or other indicator may be provided for detrimental data. Reputation analysis data may use a store of analysis ratings of files, URLs, Uniform Resource Indicators (URIs), network addresses, domain names, email addresses, network addresses, keywords, file names, or other analyzed data. Reputation analysis data may be associated with hash values, indexes, keys, or attributes, which may facilitate the lookup and usage of reputation analysis data. In one or more embodiments, reputation analysis data may be stored remotely, such as on storage 114. In some embodiments, reputation analysis data may be stored locally, such as on or associated with computer 104.

[0044] An agent running on secure portion 110, a component of virtualization platform 106, and/or a process running on computer 104 may take one or more actions in response to reputation analysis. For example, an agent running on secure portion 110 may prompt a user with the results of reputation analysis and a choice of actions, such as, allow a download, deny a download, request help, clean a download, and/or quarantine a download. Actions may depend on a reputation analysis result and a type of data and/or activity being analyzed. For example, a score may be assigned to a file or a URL as a result of a reputation analysis. One or more actions taken may depend on the score and a variety of actions may be assigned by score range. A first range may indicate a safe activity or file, a second range may indicate an activity or file for which a warning is to be provided, and a third range may indicate an activity or file which is to be denied or blocked.

[0045] Referring to FIG. 2, there is shown a reputation analysis security module 210 for securely performing reputation based analysis using virtualization in accordance with an embodiment of the present disclosure. As illustrated, reputation analysis security module 210 may comprise one or more components including virtualization module 212, network monitoring module 214, reputation querying module 216, client management module 218, and error handling module 220.

[0046] Virtualization module 212 may be implemented using one or more virtualization packages or hypervisors, such as VMware™, Phoenix Hyperspace™, or other products. Virtualization module 212 may enable one or more virtual machines or guest operating systems to run, and may provide resources such as virtualized hardware. In some embodiments, guest OS's may run natively and without modification. Guest OS's may not have access to other guest OS's, other processes running on a same computing platform, or resources not provided by virtualization module 212.

[0047] Network monitoring module 214 may enable monitoring of network activity of one or more guest OS's, virtual machines, or virtual environments hosted by virtualization module 212. Network monitoring module 214 may monitor a network driver to analyze network activity of a guest OS outside of the guest OS. This may ensure that network monitoring is not tampered with by malware. Network monitoring module 214 may also monitor other resources and/or processes of a guest OS by monitoring such resources or processes from outside of the guest OS. Network monitoring module 214 may request reputation analysis from reputation querying module 216. In some embodiments, network monitoring module 214 may request reputation analysis if the network activity meets one or more specified criteria, such as the download of a specified file type.

[0048] Reputation querying module 216 may generate indicia of a file type, network activity, or other activity for which reputation analysis is to be performed. For example, reputation querying module 216 may use a hash function to generate a hash value of a file, a network address, a URL, or other attribute associated with data or activity to be analyzed. Reputation querying module 216 may utilize the indicia to query a data store of reputation analysis data. The data store may be located locally to a computing platform being analyzed or remote from the computing platform being analyzed. The data store may contain information enabling reputation querying module 216 to score, rate, or otherwise gauge the analyzed data or activity according to one or more factors. For example, reputation analysis may rate safety, quality, risk, performance, or other attributes of a file or a network site being accessed by a guest OS.

[0049] Client management module 218 may enable one or more actions to be taken in response to a reputation analysis determination, such as a score or rating. Actions may include prompting a user of a guest OS, blocking an action, permitting an action, and/or denying an action.

[0050] Error handling module 220 may handle errors with reputation analysis, network monitoring, or client management. Error handling module 220 may log errors, such as errors occurring during reputation analysis (e.g., URL unknown or unrated). Error handling module 220 may produce one or more reports, such as reports of denied activity or denied data, permitted activity, other actions taken, network addresses accessed, files accessed, or other guest OS activity monitored.

[0051] Referring to FIG. 3, there is depicted a method 300 for securely performing reputation based analysis using virtualization, in accordance with an embodiment of the present disclosure.

[0052] At block 302, the method 300 for securely performing reputation based analysis using virtualization may begin.

[0053] At block 304, the method 300 may intercept network traffic of a virtual client. Network traffic may be intercepted outside of a virtual client and such interception and/or monitoring may be invisible to a virtual client and may not significantly affect performance of the virtual client.

[0054] At block 306, the method 300 may monitor network traffic for specified activity. Specified activity may include certain types of network activity, such as instant messaging, FTPing, and or remote file access. Specified activity may also include a network request to a specified URL or network address, or a local file system request.

[0055] At block 308, the method 300 may determine if specified activity has occurred. If specified activity has occurred, the method may continue at block 310. If no specified activity has occurred, the method may continue monitoring at block 306.

[0056] At block 310, the method 300 may query or otherwise interface with a data store or another computing platform to determine a reputation of an analyzed activity or portion of data. Indicia may be generated that is uniquely associated with the analyzed activity or portion of data, and the indicia may be utilized to identify a reputation. The indicia may be a hash value or other unique identifier associated with the analyzed activity or portion of data. In one or more embodiments, a URL or network address, uniquely associated with analyzed activity or a portion of data, may be utilized to query a reputation from a data store or another computing platform.

[0057] At block 312, the method 300 may receive reputation analysis, and may determine whether the reputation analysis meets one or more specified criteria. The reputation analysis may be a score or other rating. If the reputation analysis meets specified criteria, the method 300 may continue at block 314. If the reputation analysis does not meet specified criteria, the reputation analysis may end at block 316 (e.g., the file or activity may be ignored). The specified criteria may provide one or more ranges of criteria.

[0058] At block 314, the method 300 may perform one or more specified actions. The specified actions may be determined by the reputation analysis meeting the specified criteria. For example, a file that receives a reputation analysis rating within a specified range may be blocked or denied. Other actions may be performed.

[0059] At block 316, the method 300 may end.

[0060] At this point it should be noted that securely performing reputation based analysis using virtualization in accordance with the present disclosure as described above typically involves the processing of input data and the generation of output data to some extent. This input data processing and output data generation may be implemented in hardware or software. For example, specific electronic components may be employed in a reputation analysis device or similar or related circuitry for implementing the functions associated with secure reputation analysis in accordance with the present disclosure as described above. Alternatively, one or more processors operating in accordance with instructions may implement the functions associated with secure reputation analysis in accordance with the present disclosure as described above. If such is the case, is within the scope of the present disclosure that such instructions may be stored on one or more processor readable media (e.g., a magnetic disk or other storage medium), or transmitted to one or more processors via one or more signals embodied in one or more carrier waves.

[0061] The present disclosure is not to be limited in scope by the specific embodiments described herein. Indeed, other various embodiments of and modifications to the present disclosure, in addition to those described herein, will be apparent to those of ordinary skill in the art from the foregoing description and accompanying drawings. Thus, such other embodiments and modifications are intended to fall within the scope of the present disclosure. Further, although the present disclosure has been described herein in the context of a particular implementation in a particular environment for a particular purpose, those of ordinary skill in the art will recognize that its usefulness is not limited thereto and that the present disclosure may be beneficially implemented in any number of environments for any number of purposes. Accordingly, the claims set forth below should be construed in view of the full breadth and spirit of the present disclosure as described herein.