Patent ID: 8763115

Claim:
A method of operating a virtualization system comprising virtualization software instantiated on an underlying hardware machine, the virtualization software running a virtual machine in which a plurality of execution contexts execute, a guest operating system also running in the virtual machine and coordinating the execution of the execution contexts, the method comprising: executing at the virtual machine, under control of the virtualization software, instruction sequences that correspond to the plurality of execution contexts; monitoring a particular one of the plurality of execution contexts of the virtual machine when the particular one of the plurality of execution contexts is identified as malicious, the virtualization software performing the monitoring; identifying the particular one of the plurality of execution contexts for impeding based on the monitoring; and impeding computational progress of the particular one of the plurality of execution contexts with respect to other execution contexts executing within the virtual machine while allowing the other execution contexts of the virtual machine to continue executing, the impeding being caused by the virtualization software, wherein the impeding includes, for a particular instruction sequence corresponding to the particular one of the plurality of execution contexts, selectively altering behavior of the virtual machine so that, with respect to the particular instruction sequence, the behavior diverges from faithful emulation of a physical machine.