Patent ID: 9356945
Filing Date: 2016-05-31
CPC Classification: G06F,H04L

Claim Text:
1. A method of inspecting content intended for a workstation to inspect content that performs exploits, comprising: receiving the content for inspection at an inspection server using a processor and memory; loading a virtual machine at the inspection server with an operating system and processes for inspecting the content, wherein the operating system and processes emulate those executed at the intended workstation; activating the content in the virtual machine; and, tracing the activity of the virtual machine to form trace data by using features of the processor, the tracing the activity including receiving a memory page marked as read/write/execute and changing the memory page permissions in a shadow page table to read/write; and, upon an occurrence of an exception, transferring control from the inspection server to an analyzer that analyzes the trace data based on a context of the exception, and, a notification is provided if suspicious activity is detected.