Virtual Shield: A Novel Approach to Defend Against Cyber-attacks

In this effort, we develop a virtualization-based end system protection framework, called Virtual Shield, which leverages virtualization to adaptively protect the end systems without deploying an agent in them. Virtual Shield integrates various techniques such as virtualization, rollback, failover, VM introspection, and VM migration under one umbrella for an agentless and adaptive defense architecture.We developed a preliminary Virtual Shield prototype in the phase I effort. The Virtual Shield prototype can quickly and repeatedly save the execution state of a VM and instantly switch the execution of the VM to a previously saved state. We conducted extensive experiments to demonstrate the feasibility of the Virtual Shield prototype. In the Phase II effort, we will continue our Phase I work by adding more new functions. Specifically, we will develop various defense techniques, namely rollback, failover, attack surface diversification and moving target defense. Moreover, we will add VM image sanity checking capability and live VM patching capability to the Virtual Shield architecture. Finally, the proposed techniques are integrated into a prototype implementation.