Daniel Konopacki

1. Background

I can’t pinpoint exactly when I started exploring virtual machines as my primary working environment. Last year, I migrated in that direction for a number of reasons, but one sits at the forefront: the increasing frequency and sophistication of ransomware incidents. I’ve never been hit, but one time already exceeds my tolerance.

This led me to a dual-layered structure: work within the VM, use the host to monitor the VM, and maintain a shadow filesystem the VM knows nothing about. If the VM is compromised, the host detects it, isolates it, and reconstitutes a fresh instance from known-good data.

This document outlines the architecture I’ve been designing and am currently building.

2. Design Philosophy

Attempting to prevent every attack is a fool’s errand. The more productive question is: when an attack succeeds, how do you contain the blast radius?

Enterprises invest heavily in this question. Individual practitioners and small organizations generally do not. The result is a security posture that treats the endpoint as a fortress — layered with agents, scanners, and policies that all run inside the very system an attacker is trying to compromise.

This architecture inverts that model. Every security control runs on the host hypervisor, in a trust domain the guest VM cannot reach, cannot detect, and cannot tamper with.

3. Core Concepts

3.1 Shadow Network

A shadow network is a hidden network segment with no WAN egress. It is only accessible from within the local environment and is physically separated from the VM’s network path via a dedicated NIC using PCIe passthrough (VFIO). The VM’s traffic never passes through the shadow network’s interface — the VM has its own physical NIC with internet access. The host does not appear as a network endpoint on the VM’s interface.

3.2 Data Vault

The data vault is a storage system that lives entirely on the shadow network. It has no internet access and is only accessible during specific, scheduled activation windows. It is not designed for real-time data access — it is deep storage. Gaining access to its contents requires physical removal of hardware. At that point, you’re calling the police about an actual robbery, not a cybercrime unit.

3.3 Overlay Filesystem

When a VM session starts, data from the vault is mapped into the VM as read-only. The VM has full read access to its working data, but cannot write to the source files. Instead, write operations are directed to a separate overlay layer — a copy-on-write buffer managed by the host’s kernel.

From the VM’s perspective, it appears to have a normal read-write filesystem. Underneath, the original data is kernel-enforced read-only. All modifications, creations, and deletions land in the disposable overlay.

The VM’s disk image never grows. Data lives on the host; the VM merely borrows a view of it.

3.4 Human-in-the-Loop Promotion

Changes made in the overlay do not automatically flow back to the vault. A deliberate promotion pipeline governs this:

1. Changed files enter a quarantine staging area
2. Automated security validation runs (malware scanning, file type verification, checksum comparison, content inspection)
3. A human reviews the diff and explicitly approves or rejects
4. Approved files are committed to the vault master with cryptographic signing
5. An encrypted offsite backup is triggered automatically

No automated system has the authority to write to the vault master without human review. This is slower than fully automated promotion, but it scales to the environments where it matters — where a single bad commit means exposed data or regulatory consequences.

4. Monitoring Architecture

All monitoring runs on the host, observing the VM from outside. An attacker inside the VM operates in an environment where every action is observed by a kernel they don’t control and can’t even detect.

4.1 Behavioral Monitoring (eBPF)

Kernel-level syscall observation using eBPF provides full visibility into VM process behavior — file access patterns, network connections, privilege escalation attempts, process injection.

Why this matters: Traditional endpoint security places its monitoring agents inside the system being protected. A sufficiently privileged attacker can detect those agents, study their behavior, and disable or evade them before triggering an alert. By moving observation to the host kernel, the monitoring exists in a completely separate trust domain. There is no agent to kill, no process to hide from, no service to disable. The attacker is performing on a stage they don’t know has an audience.

4.2 File-to-Network Correlation

The core detection signal is not “the VM made an outbound connection.” Normal activity — package updates, web browsing, streaming — generates constant outbound traffic. Trying to filter by destination is brittle and creates false positives.

The actual signal is: protected files were accessed and then transmitted externally. This correlation works regardless of destination, protocol, or whether the endpoint is on an allowlist. It catches exfiltration through any channel — including ones you haven’t thought to block — because it monitors behavior, not topology.

Why this matters: Most network security focuses on where data is going. But a VM streaming video and a VM exfiltrating contracts look identical at the destination level. The difference is whether protected data is in the outbound stream. By correlating file access with network transmission, you detect the behavior that matters without fighting against legitimate workflows. Browse, stream, download — all fine. The moment protected files are read and transmitted, that’s the alert.

4.3 Filesystem Integrity Watching

Continuous monitoring of the overlay’s writable layer detects mass file modifications (ransomware signatures), anomalous write volumes, and unexpected file type changes. If the overlay is corrupted, it is disposed of and recreated from the untouched master in seconds.

Why this matters: Ransomware works by encrypting files faster than you can respond. Traditional defenses try to detect and block the encryption process — a race you often lose. This approach doesn’t bother racing. It lets the encryption happen (to the disposable overlay) and simply throws the result away. You’re not defending the data; you’re ensuring the attacker never had access to the real data in the first place.

4.4 Egress Awareness

Rather than maintaining brittle destination allowlists, the architecture monitors DNS queries, tracks cumulative outbound traffic volumes against behavioral baselines, and logs all egress for forensic review.

Why this matters: Allowlist-based egress filtering turns every new legitimate destination into a policy change request, and it still misses attackers who tunnel through allowed channels. Baseline-aware monitoring catches statistically significant deviations — unusual traffic volumes, unexpected DNS queries, connections at odd hours — without requiring you to predict every legitimate use case in advance.

4.5 Tamper-Evident Audit Logging

Every security event — quarantine triggers, vault activations, file promotions, human approval decisions — is recorded as a cryptographically signed entry in a hash-chained ledger. Modifying any historical entry invalidates every subsequent entry.

Why this matters: Standard log files can be edited by anyone who compromises the system. A hash-chained, signed audit trail provides non-repudiable provenance: you can prove to a client, auditor, or court that the promotion pipeline operated correctly and files weren’t tampered with after the fact. This is also valuable forensically — if an incident occurs, you have an untampered record of exactly what happened, when, and who approved it.

5. Automated Quarantine Protocol

When monitoring detects an anomaly, the system executes an immediate, sequenced response:

1. Suspend the VM (freeze in memory — not a graceful shutdown)
2. Snapshot VM state for forensic analysis
3. Sever all network interfaces
4. Preserve overlay state as evidence
5. Force power-off (prevent malware from running cleanup routines)
6. Collect forensic data (process list, network state, journal logs)
7. Alert the operator

The VM is offline and isolated within seconds. The forensic evidence is preserved for investigation. A fresh instance can be reconstituted from the vault master once the investigation concludes.

6. Ransomware Response

Because the master data is read-only at the kernel level, ransomware operating inside the VM cannot encrypt the originals. If ransomware strikes, it encrypts the overlay — a disposable layer of copy-on-write changes.

Recovery is not a restore-from-backup operation that takes hours. The overlay is wiped and a fresh one is mounted against the untouched master. Seconds. The “encrypted” files were never the actual data — they were garbage written to a disposable layer.

This is the design property that makes ransomware irrelevant: imagine not caring if someone encrypted your data and held it hostage.

7. Exfiltration Response

Exfiltration is harder to prevent than ransomware because the attacker needs only to read and transmit — not write. The defense here is layered:

• The overlay storage itself is encrypted, with decryption keys held exclusively on the host
• File-to-network correlation detects when protected data is read and transmitted, regardless of destination
• Behavioral baselining flags statistically significant deviations from normal activity patterns
• Even if data is exfiltrated, the vault master — the canonical source — is on a physically disconnected, powered-off server that no network attack can reach

8. Content Inspection via Local AI (Exploratory Direction)

Traditional content inspection (DLP) relies on regex patterns — credit card numbers, SSNs, API keys. This works for structured data but fails on semantic threats. A regex cannot tell you that a document contains sensitive negotiation details, or that a config file has credentials embedded in an unusual format.

Small language models could change this. Models in the 0.5B to 8B parameter range — small enough to run on a single GPU, fast enough to scan documents in seconds — could theoretically perform semantic risk assessment that no regex engine matches. They understand context, recognize sensitive content by meaning rather than pattern, and could score documents on a risk spectrum rather than a binary match.

I intend to explore using general-purpose language models as security analysis engines — scoring file contents for exfiltration risk, identifying anomalous content patterns, and flagging documents that shouldn’t be leaving the network. Most LLM use cases are generative. Repurposing these models as analytical tools for security classification is a direction I’m actively pursuing rather than theorizing about. The theory is sound; the implementation requires building and testing before it enters production use.

9. Two-Tier Physical Architecture

9.1 Tier 1: Working Machine (Laptop)

• Always-online during work sessions
• Runs the VM, monitoring stack, and overlay
• Accepts some residual risk (physical compromise, local attack vectors)
• Uses VFIO passthrough to make the host invisible on the network
• Promotes validated data to Tier 2 via encrypted offsite backup

9.2 Tier 2: Vault Server

• Physically disconnected from all networks the majority of the time
• Powers on only during scheduled activation windows
• Accepts no network exposure
• Receives, validates, and promotes data to the master
• Powers off, clears encryption keys from memory, physically disconnects

This isn’t just network isolation. It’s temporal isolation. The attack surface exists for minutes, not months. When the vault is powered off, there are no decryption keys in memory, no running services, no network path. The data exists as ciphertext on powered-down storage.

You can’t hack what isn’t on.

9.3 What Compromise Means at Each Tier

If the vault is compromised, it was an inside job. Literally. At that point, you’re not writing a security tool — you’re calling law enforcement.

10. Theft and Disaster Resilience

This architecture wasn’t designed solely for security. It also addresses a long-standing operational pain point: the multi-day effort to restore a working environment after hardware failure or theft.

Because the VM is disposable and the data is sovereign (vault + encrypted offsite backups), recovery follows a defined pipeline:

1. Provision new hardware with a base OS (minutes)
2. Run configuration-as-code to install the hypervisor, monitoring stack, and networking (minutes)
3. Restore VM configuration from version control (minutes)
4. Pull the latest VM snapshot from encrypted offsite backup (minutes to hours)
5. Attach the overlay to the vault master and start the VM (minutes)

Target: under four hours from power-on to a fully functional working environment, including all security monitoring. Compare that to the traditional multi-day process of reinstalling packages, reconfiguring tools, and hunting down settings that lived only on the dead machine.

The VM is a temporary vessel. What matters is the state it carries, which can be recreated anywhere.

11. AI-Enhanced Threat Considerations

The threat landscape is shifting. AI-enhanced attackers can generate novel attack patterns on every attempt — polymorphic code, adaptive timing, process behavior that mimics legitimate software. Fixed-threshold detection systems lose to an adversary that can vary behavior infinitely.

This architecture’s resilience comes from the distinction between structural and algorithmic protections:

Structural protections (overlay read-only enforcement, LUKS encryption, air-gapped vault, human approval gate) — AI doesn’t matter here. These are physics and kernel enforcement. No amount of intelligence bypasses a read-only mount or a disconnected cable.

Algorithmic protections (behavioral rules, correlation thresholds, content scanning) — AI raises the stakes here. The mitigation is making these layers adaptive rather than static: behavioral baselining that learns normal patterns, cumulative volume thresholds that catch slow exfiltration, and semantic content analysis that recognizes context rather than just patterns.

Ultimately, the human reviewing quarantined files before promotion is the layer that AI has the hardest time defeating. The human isn’t looking for a pattern. They’re looking for something that feels wrong. That’s the kind of judgment neither defensive nor offensive AI models can replicate.

12. Industry Context

This architecture borrows from several established security domains — data loss prevention, endpoint detection and response, container runtime security, and classified network handling all inform pieces of the design. The concepts are not new in isolation.

The intent is not to compete with enterprise security platforms. It’s to demonstrate that an individual practitioner can build a security posture that rivals enterprise-grade controls using open-source tools, commodity hardware, and disciplined architectural thinking. Most security advice for individuals stops at “use a password manager and enable two-factor authentication.” There’s a wide gap between that baseline and what enterprises deploy. This architecture attempts to close that gap.

13. Summary

The overlay model changes the ransomware calculus: the attacker encrypts a disposable layer, and the master remains untouched. The correlation model changes the exfiltration calculus: it’s not about where data is going, but whether protected files are in the outbound stream. The vault model changes the persistence calculus: the canonical data source exists as ciphertext on powered-down storage that no network attack can reach.

The AI dimension cuts across both sides. As AI-enhanced attackers gain the ability to generate novel attack patterns, vary their behavior infinitely, and mimic legitimate process activity, static detection systems become increasingly inadequate. The counter is not a better static system — it’s an adaptive one. Behavioral baselining that learns what normal looks like for a specific environment. Semantic content analysis that understands what a file means, not just what patterns it contains. A correlation engine that adapts its thresholds based on observed activity rather than relying on fixed heuristics an AI attacker can probe and learn.

The structural protections — read-only enforcement, encryption at rest, air-gapped vault, human approval gate — are immune to AI-driven attacks because they are enforced by physics and kernel constraints, not by algorithms an attacker can outmaneuver. The algorithmic protections are where the arms race plays out, and that is precisely why pairing them with AI-driven analysis rather than static rulesets is the direction this architecture is heading. AI defending against AI, with structural guarantees as the backstop that neither side can bypass.

None of these concepts are individually revolutionary. Combined into a single coherent architecture, they create a defense-in-depth posture that is substantially harder to defeat than conventional endpoint security — and one that scales with the threat rather than being fixed at the moment of deployment.