Patent ID: 9733976
Date: 2017-08-15
CPC Classifications: G06F

Claim:
1. A security system for efficiently monitoring and securing a computer including a memory and processor, to defend against malicious intrusions, the system comprising: an in-band software monitor disposed within a kernel in communication with an operating system (OS) of the computer, the in-band software monitor configured to intercept system calls made from an MSR (Model Specific Register) of the processor, to execute monitoring operations, and to subsequently return execution to the OS; an out-of-band hypervisor communicably coupled to the OS, the hypervisor having read shadow means for trapping read requests to the MSR, and write mask means for trapping write requests to the MSR; the hypervisor having means for responding to the trapped read requests and trapped write requests; the processor having an instruction set architecture (ISA) including a system return (sysret) instruction configured to effect a return of execution from the OS to an application running on the computer; and sysret monitoring means for intercepting calls to the sysret instruction, for executing sysret monitoring operations, and for subsequently effecting said return of execution; wherein the in-band software monitor comprises a monitor program stored on the memory and executable by the processor, the monitor program configured to: receive system calls; execute system monitoring operations; forward the in-band software monitor's base address and size in memory to the hypervisor; forward the in-band software monitor's entry point address to the hypervisor; and forward a state of the MSR to the hypervisor.