Company Bitdefender announced the open-sourcing of its Hypervisor Introspection technology (HVI). It was developed in collaboration with the Xen project.
The project's history began in 2015, when a library for hypervisor 4.6 was introduced. . This allowed virtual machines to interact with software that detects malicious code.
Previously, specialized malware could remain undetected in the system for long periods, residing within the guest virtual machine. One of the challenges was gaining access to the virtual machine's memory. However, the library addressed these issues by enabling memory inspection from the hypervisor side.
Bitdefender and Xen developed a guest introspection technology that allows antivirus software to run externally. The Xen libbdvmi effectively solves this problem without the need for significant additional hardware resources.
After some time, Bitdefender, in collaboration with Citrix, released a commercial version of the technology, named Bitdefender Hypervisor Introspection.
Source: 3dnews
Currently, the technology developers have decided to open-source the libbdvmi code. Additionally, the company has released the code of another technology — the 'thin hypervisor' Napoca — for the Xen project. The combination of libbdvmi and Napoca enables introspection in systems that do not use full-scale hypervisors.
According to representatives of the Bitdefender team, open-sourcing the technology will allow it to develop further, evolving beyond strictly commercial projects from Bitdefender into something new. The technology will help companies and organizations respond to new threats that are becoming increasingly dangerous and complex.
The Xen Project is the result of collaboration among seven developer teams. With the opening of the HVI and Napoca code, there will be an eighth team responsible for implementing the technologies. The library code of libbdvmi can .
Source: habr.com
