Patent ID: 8387046

Claim:
A system comprising: one or more virtual machines (VMs) executing in a computing device; a security VM coupled to the one or more VMs; and a device driver loaded into at least one VM of the one or more VMs, wherein the device driver is configured to: monitor kernel-level activities of a guest OS of the at least one VM; cause metadata corresponding to the monitored kernel-level activities to be stored; and provide an indication that said metadata has been stored; wherein, in response to detecting said indication, the security VM is configured to: read said metadata; detect an undesirable process within the at least one VM, based at least in part on said metadata; convey a first security computer program to the device driver within one of the VMs to be loaded into the kernel; halt execution of the device driver; and convey a second security program to the device driver to replace the first security program.