Abstract: In one set of embodiments, an enhanced next generation anti-virus (NGAV) system is provided. In certain embodiments, this system includes a hypervisor-level agent that backs up VM data only when an instance of a guest application running in the VM has been flagged by the NGAV system as being potentially malicious (rather than on a constant, proactive basis). Further, the hypervisor-level agent performs this backup only with respect to data modified by that specific guest application instance (rather than backing up all data modified by the VM) and writes the backed-up data to a secure storage location which is inaccessible to the guest. The combination of these features addresses many of the problems and inefficiencies of existing NGAV systems.

Abstract: This disclosure relates generally to configuring a legacy application or service with a reconfigurable cryptographic provider capable of leveraging many different cryptographic algorithms, protocols or functions. The application or service can be configured with the reconfigurable cryptographic provider by redirecting cryptographic API calls intended for a linked static shared cryptographic library or provider to a cryptographic adapter configured to emulate responses provided by the linked static shared cryptographic library. A cryptographic adapter is also described and is configured to generate abstracted versions of the cryptographic API calls and pass them on to the reconfigurable cryptographic provider, which selects and implements an appropriate cipher solution based on the abstracted cryptographic API calls.

Abstract: Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Abstract: Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Abstract: Rapid launch of secure executables in a virtualized environment includes using a persisted security cache in a virtualized component (VC), such as a virtual machine. The VC generates a cache integrity value (IV), such as a hash value, for the security cache and sends it to a remote validator, which returns an indication of security cache validity or invalidity. Upon receiving a request to execute applications, the VC analyzes whether the applications have been determined to be safe to execute and have not been altered. The VC retrieves application IVs from the security cache, rather than hashing each of the applications, thereby saving compute time, and sends the application IVs to a remote validator, which returns an indication of application validity or invalidity.

Abstract: Some embodiments of the invention provide a method for deploying machines for users in a software-defined datacenter (SDDC). The method in some embodiments is performed by a host computer that executes one or more machines. The method formulates a prediction regarding a particular user that is likely to log into a particular machine (e.g., virtual machine (VM), Pod, container, etc.) executing on a host computer of the SDDC in a future time period. Before the user logs into the particular machine, the method pre-fetches from a server a set of rules for a set of network elements that will process data messages associated with the machine after the particular user starts using the particular machine. The method uses the pre-fetched set of rules to configure the set of network elements to process data messages from the particular machine when the particular user logs into the machine during the time period.

Abstract: A method for automatically reregistering a clone virtual machine with a cloud security monitoring service is provided. The method generally includes detecting a connection between a cloud agent running in a virtual machine on a host and a hypervisor module on the host. In response to detecting the connection, the cloud agent queries the hypervisor module for one or more first identifiers of the virtual machine. The method generally includes checking a database, by the cloud agent, for one or more second identifiers stored in the database matching the one or more first identifiers received from the hypervisor module and, based on finding no second identifiers stored in the database matching the one or more first identifiers, sending a request to the cloud security monitoring service to register the virtual machine with the cloud security monitoring service.

Abstract: Example methods and systems for a computer system to perform context-aware service query filtering are described. One example may involve a computer system intercepting a service query from a virtualized computing instance to pause forwarding of the service query towards a destination; and obtaining context information associated with an application running on the virtualized computing instance. In response to determination that the service query is a potential security threat based on the context information, service query filtering may be performed to inspect the service query for malicious activity. Otherwise, in response to determination that the service query is not a potential security threat based on the context information, the service query filtering may be skipped and the service query forwarded towards the destination.

Abstract: A next generation antivirus (NGAV) security solution in a virtualized computing environment includes a security sensor at a virtual machine that runs on a host and a security engine remote from the host. The integrity of the NGAV security solution is increased, by providing a verification as to whether a verdict issued by the security engine has been successfully enforced by the security sensor to prevent execution of malicious code at the virtual machine.

Abstract: Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Abstract: Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Abstract: Example methods are provided to build a smart file reputation cache at a cloud, and to provide the smart file reputation cache to an antivirus (AV) endpoint such as a virtualized computing instance in a virtualized computing environment. Training techniques can be used to build the smart file reputation cache at the cloud, based on information learned from existing AV endpoints and a management server. The smart file reputation can then be provided to newly installed AV endpoints for local access, instead of the AV endpoints sending file reputation requests to the cloud.

Abstract: The disclosure provides an approach for hypervisor-assisted security analysis. Embodiments include receiving, at a hypervisor on a host computer, events from one or more virtual computing instances (VCIs). Embodiments include analyzing, by the hypervisor, the events according to one or more rules to identify a subset of the events for additional analysis. Embodiments include compressing, by the hypervisor, the subset of the events by performing deduplication to produce a compressed subset of the events. Embodiments include transmitting, by the hypervisor, the compressed subset of the events over a network to a separate analysis component, wherein the separate analysis component performs the additional analysis.

Abstract: Example methods and systems for attribute-based firewall rule enforcement are described. One example method may comprise a computer system obtaining, from a management entity, one or more first firewall rules configured based on first attribute information. The computer system may detect a login event associated with a user operating a user device to log onto a virtualized computing instance. In response to determination that the user is associated with the first attribute information, the one or more first firewall rules may be applied. Otherwise, in response to determination that the user is associated with second attribute information that is different from the first attribute information, the computer system may obtain and apply one or more second firewall rules configured based on the second attribute information.

Abstract: Described herein are systems, methods, and software to manage packet reconstruction and error correction. In one implementation, a method for operating an error correction service includes receiving a packet and identifying one or more errors in the header or payload of the packet. The method further includes determining one or more corrections for the one or more errors based on predictive modeling for the packet and forwarding the packet with the one or more corrections.

Abstract: In some embodiments, a method receives a first address resolution mapping from a workload and verifies the first address resolution mapping. When the first address resolution mapping is verified, the method adds the first address resolution mapping to a list of address resolution mappings. The list of address resolution mappings includes verified address resolution mappings. The list of address resolution mappings is sent to the workload to allow the workload to verify a second address resolution mapping using the list of verified address resolution mappings.

Abstract: A next generation antivirus (NGAV) security solution in a virtualized computing environment includes a security sensor at a virtual machine that runs on a host and a security engine remote from the host. The integrity of the NGAV security solution is increased, by providing a verification as to whether a verdict issued by the security engine has been successfully enforced by the security sensor to prevent execution of malicious code at the virtual machine.

Abstract: Described herein are systems, methods, and software to manage resources for networking operations on a host computing system. In one implementation, a hypervisor on a host computing system, may monitor computing resources used by a networking process provided by the hypervisor. The hypervisor further determines that the one or more computing resources used by the networking process satisfy at least one criterion and, in response to determining that the computing resources satisfy at least one criterion, notifies one or more virtual machines supported by the hypervisor to modify one or more execution parameters associated with at least one application in each of the one or more virtual machines.

Abstract: In some embodiments, a method receives a first address resolution mapping from a workload and verifies the first address resolution mapping. When the first address resolution mapping is verified, the method adds the first address resolution mapping to a list of address resolution mappings. The list of address resolution mappings includes verified address resolution mappings. The list of address resolution mappings is sent to the workload to allow the workload to verify a second address resolution mapping using the list of verified address resolution mappings.

Abstract: In some embodiments, a method receives one or more address resolution mappings and sends the one or more first address resolution mappings to a manager for verification of the one or more first address resolution mappings. The method receives one or more responses based on the verification of the one or more first address resolution mappings and allows or disallows use of the one or more address resolution mappings based on the one or more responses. A list of verified address resolution mappings is received from the manager based on the verification of the one or more first address resolution mappings. Then, the method receives a second address resolution mapping and verifies the second address resolution mapping using the list of verified address resolution mappings.