Patent ID: 9146767
Filing Date: 2015-09-29
Classification: G06F

Abstract:
1. A hypervisor monitor system comprising: one or more processors coupled to a memory, the one or more processors configured to execute instructions in the memory and generate an exception in response to a page fault; a hypervisor configured to operate on the one or more processors and to manage execution of a plurality of virtual machines on the one or more processors; a hashing module configured to calculate a mathematical hash of at least a portion of the instructions in the memory; a database isolated from the hypervisor, the database configured to store a list of mathematical hashes of registered code and a list of mathematical hashes of malware; a monitor configured to provide an interface between the one or more processors and the hypervisor, the monitor configured to respond to the exception by performing a comparison of the mathematical hash of a page of instructions loaded into the memory by the hypervisor with the list of mathematical hashes of registered code; a first network interface coupled to the monitor and isolated from the hypervisor; and a second network interface coupled to the hypervisor, the second network interface configured to be accessible by the plurality of virtual machines; wherein the monitor is configured, in response to the comparison, to prevent the one or more processors from executing the page of instructions when the comparison indicates the mathematical hash of the page of instructions is not included in the list of mathematical hashes of registered code.