Patent ID: 8966623
Filing Date: 2015-02-24
Classification: G06F

Abstract:
1. A computer implemented method for managing execution of a running-page in a virtual machine running on a first host, comprising: associating a first trace code with the running-page, wherein the first trace code generates a notification upon initiation of the execution of the running-page by the virtual machine; receiving, at a security virtual machine executing on a second host that is distinct from the first host, the notification; determining that the running-page includes code that is configured to execute at a kernel level of the virtual machine; based on the determination, intercepting, by the security virtual machine, the execution of the running-page at the virtual machine; comparing the running-page with a list that identifies pages that are authorized to execute at the kernel level of the virtual machine; based on the comparing, determining if code within the running-page is authorized for executing at the kernel level of the virtual machine; and if the code is authorized: if the code is unauthorized, generating, by the security virtual machine, an exception that prevents the execution of the running-page in the virtual machine.