Patent ID: 9117080
Filing Date: 2015-08-25
Classification: G06F

Abstract:
1. A host system comprising at least one hardware processor configured to execute: a hypervisor configured to expose a virtual machine; a process evaluator executing within the virtual machine; a memory introspection engine executing outside the virtual machine; and a process-scoring module, wherein: the process evaluator is configured to: determine whether an evaluated process executing within the virtual machine performs an action and in response, when the evaluated process performs the action, transmit a first process evaluation indicator to the process-scoring module, the first process evaluation indicator determined for the evaluated process; the memory introspection engine is configured to: intercept a call to an operating system function, to detect a launch of a protected process executing within the virtual machine, wherein the operating system function is configured to add the protected process to a list of processes executing within the virtual machine, and in response to detecting the launch, determine whether the evaluated process attempts to modify a memory page of the protected process, and in response, when the evaluated process attempts to modify the memory page, transmit a second process evaluation indicator to the process-scoring module, the second process evaluation indicator determined for the evaluated process; and the process-scoring module is configured to: receive a first weight and a second weight from a security server configured to perform anti-malware transactions with a plurality of computer systems including the host system, receive the first and second process evaluation indicators, and in response, determine whether the evaluated process is malicious according to the first and second process evaluation indicators, wherein determining whether the evaluated process is malicious comprises determining a weighted sum of a first score and a second score, the first weight multiplying the first score in the weighted sum, and the second weight multiplying the second score in the weighted sum, wherein the first and second scores are determined according to the first and second process evaluation indicators, respectively.