System and method of forming a log in a virtual machine for conducting an antivirus scan of a file
US10546120B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Sep 25, 2017 |
| Grant date | Jan 28, 2020 |
| Priority date | — |
| Expiry date | Feb 28, 2038 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/60
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Disclosed are systems and methods for generating a log for conducting an antivirus scan of a file. The described technique includes opening a file in a virtual machine, which causes execution of a guest process and a thread in a (virtual) processor of the virtual machine. The technique includes identifying, during execution of the first thread, events that involve alteration of guest physical memory pages of the virtual machine. The technique determines altered guest physical memory page based on analysis of the log and identifies when a transfer of control to altered guest physical memory pages has occurred. The resultant log for analysis by a security application includes information indicating the events occurring during execution of the thread in the altered guest physical memory page, and context data of the virtual processor on which the thread is being executed.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.