18499035. DETECTION OF MALICIOUS DIRECT MEMORY ACCESS DEVICE USED FOR DIRECT DEVICE ASSIGNMENT (Microsoft Technology Licensing, LLC)

DETECTION OF MALICIOUS DIRECT MEMORY ACCESS DEVICE USED FOR DIRECT DEVICE ASSIGNMENT

Organization Name

Microsoft Technology Licensing, LLC

Inventor(s)

Jin Lin of Seattle WA US

Cody Dean Hartwig of Seattle WA US

Jason Stewart Wohlgemuth of Seattle WA US

DETECTION OF MALICIOUS DIRECT MEMORY ACCESS DEVICE USED FOR DIRECT DEVICE ASSIGNMENT

This abstract first appeared for US patent application 18499035 titled 'DETECTION OF MALICIOUS DIRECT MEMORY ACCESS DEVICE USED FOR DIRECT DEVICE ASSIGNMENT

Original Abstract Submitted

Detection of malicious direct memory access (DMA) device used for direct device assignment. A virtualization computer system assigns a peripheral device to an operating context within a virtualization environment. The peripheral device is DMA capable. The virtualization computer system monitors a signal source that is affected by DMA operations initiated by the peripheral device while the peripheral device is assigned to the operating context. Based on monitoring the signal source, the virtualization computer system identifies a signal pattern characterizing the DMA operations that are initiated by the peripheral device. Using the signal pattern, the virtualization computer system determines that the DMA operations initiated by the peripheral device are abnormal and the virtualization computer system identifies the peripheral device as malicious.