Patent ID: 9465941
Filing Date: 2016-10-11
CPC Classification: G06F

Claim Text:
1. A method for a host computer to detect malicious code, wherein the host computer runs a virtual machine supervisor to manage a plurality of virtual machines running on the host computer, the method being performed by the host computer by means of the virtual machine supervisor and comprising: converting, by the virtual machine supervisor, a read-write request delivered from a virtual machine running on the host computer into an instruction for accessing hardware devices of the host computer, wherein the read-write request is generated during execution of program code in the virtual machine delivering the read-write request; monitoring, by the virtual machine supervisor, execution of the instruction, and obtaining execution characteristics of the instruction; comparing, by the virtual machine supervisor, the obtained execution characteristics with pre-stored execution characteristics of known malicious code; determining, by the virtual machine supervisor, that the program code is malicious when the obtained execution characteristics and the pre-stored execution characteristics are the same; and generating, by the virtual machine supervisor, a prompt message to indicate to a user that the program code of the virtual machine is malicious.