Patent ID: 11886350
Assignee: RAYTHEON COMPANY
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 8:
9. A computer program product including one or more non-transitory machine readable mediums encoded with instructions that when executed by one or more processors cause a process to be carried out, the process comprising:
determining, by a hypervisor, that an operating system (OS) is started in a host virtualization system, wherein the started OS comprises a boot fingerprint comprising an allocation of one or more host physical memory (HPM) pages;
examining, by the hypervisor, contents of at least one system memory page of the one or more HPM pages to determine a type of OS that is loaded on the at least one system memory page of the one or more HPM pages, wherein the examination comprises analyzing information loaded on the one or more HPM pages when the OS is started and based on the boot fingerprint, wherein the boot fingerprint identifies various operating systems based on the one or more HPM pages storing particular aspects of the OS in specific addresses; and
assigning, by the hypervisor and subsequent to the examination, at least one tag to the at least one system memory page of the one or more HPM pages based on the determined type of OS and the examination of the contents of the at least one system memory page of the one or more HPM pages,
wherein the at least one tag indicates characteristics of the contents stored in the at least one system memory page of the one or more HPM pages including characteristics of data stored in an extended page table (EPT), and wherein the at least one tag allows for context-aware monitoring of the at least one system memory page.