Patent ID: 9536084
Date: 2017-01-03
CPC Classifications: G06F

Claim:
1. A host system comprising a hardware processor and a memory, the hardware processor configured to: receive from the memory an introspection notification instruction instructing the hardware processor to deliver an introspection notification, the introspection notification instruction forming part of a guest process executing within a virtual machine exposed on the host system, wherein execution of the guest process would cause an occurrence of a trigger event within the virtual machine; in response to receiving the introspection notification instruction, determine an event type of the trigger event; in response to determining the event type, determine whether a delivery condition is satisfied according to a content of a trigger selection data structure comprising a plurality of fields, each field of the plurality of fields indicating whether introspection notifications are currently enabled for a selected type of event corresponding to the each field; in response to determining whether the delivery condition is satisfied, when the delivery condition is satisfied, deliver the introspection notification; and in response to determining whether the delivery condition is satisfied, when the delivery condition is not satisfied, continue execution of the guest process without delivering the introspection notification, wherein delivering the introspection notification comprises suspending execution of the guest process and in response, switching to executing a computer security program distinct from the guest process, wherein the computer security program is configured to determine whether the occurrence of the trigger event is indicative of a computer security threat, and wherein the computer security program is further configured to supply the content of the trigger selection data structure.