Patent ID: 9171146
Filing Date: 2015-10-27
Classification: G06F

Abstract:
1. A computing device comprising: a processor; and a memory having stored therein a plurality of instructions that, in response to being executed by the processor, causes the processor to: set a memory permission of an extended page table (EPT) to cause an error in response to an attempted execution of a monitored application programming interface (API) function located in a memory page associated with the EPT; generate an EPT permission violation error in response to the attempted execution of the monitored API function; transfer control to a virtual machine monitor (VMM) of the computing device in response to the EPT permission violation error; invoke an error handler with the VMM to (i) determine whether the call to the monitored API function is made to perform a malicious activity on the computing device and (ii) prevent execution of the monitored API function in response to a determination that the call to the monitored API function is made to perform the malicious activity on the computing device.