Patent ID: 9383934
Filing Date: 2016-07-05
CPC Classification: G06F

Claim Text:
1. A method comprising: employing a first hardware processor of a computer system to execute a code sample loaded into a first memory of the computer system, the computer system further comprising a memory shadower and an interrupt generator, wherein the memory shadower includes a second memory and logic configured to take snapshots of the first memory, wherein each snapshot comprises a current content of a memory section of the first memory, wherein taking snapshots comprises copying the current content from the first memory to the second memory; employing the interrupt generator to inject a hardware interrupt into the first hardware processor, the hardware interrupt causing the computer system to transition into a sleeping state, wherein the sleeping state is a state wherein the first hardware processor is not executing instructions and the first memory is powered; in response to the computer system transitioning to the sleeping state, employing the memory shadower to take a first snapshot of the first memory; and in response to taking the first snapshot, employing the memory shadower to transmit at least a part of the first snapshot to a second hardware processor configured to determine according to the first snapshot whether the code sample poses a computer security threat.