System and method for analyzing a log in a virtual machine based on a template
US11048795B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Dec 16, 2019 |
| Grant date | Jun 29, 2021 |
| Priority date | — |
| Expiry date | Dec 16, 2039 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/60
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Disclosed is a method for analyzing a log for conducting an antivirus scan of a file. The method includes opening a file in a virtual machine. The opening of the file includes execution of a guest process having a thread in a virtual processor of the virtual machine. A plurality of events in the thread of the guest process is intercepted. Registers associated with a system call made during execution of the first thread of the guest process are determined. Execution of the thread of the guest process is halted. In a log associated with the opening of the file, information is saved indicating events intercepted during execution of the thread in an altered guest physical memory page, and context data of the virtual processor. Using at least one template having rules, the saved log is analyzed to determine whether the file opened in the virtual machine is harmful.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.