Patent ID: 9679139
Date: 2017-06-13
CPC Classifications: G06F

Claim:
1. A method for performing an antivirus scan of a file on a virtual machine, the method comprising: performing a first execution of the file on the virtual machine; recording, in memory, a first log that includes at least one application programming interface (API) function call and at least one internal event comprising at least one system call of a process launched from the file to an operating system kernel detected during the first execution of the file; determining if any signatures from a first database of signatures are detected in the first log; responsive to determining that at least one signature from the first database of signatures is detected in the first log, performing a second execution of the file on the virtual machine and recording, in the memory, a second log that includes at least one internal event detected during the second execution of the file, wherein the second log does not include API function calls occurring during the second execution of the file; determining if any signatures from a second database of signatures are detected in the second log; responsive to determining that at least one signature from the second database of signatures is detected in the second log, generating a combined log associated with the file based on at least the first log and the second log, wherein one or more records of internal events in the second log are replaced with a plurality of records of corresponding internal events and at least one API function call in the first log; and classifying the file as malicious in response to detection of a malicious signature in the combined log associated with the file.