PATENT CLAIM ANALYSIS

Application Number: 15863574
Application Type: Utility
Filing Date: 2018-01
Publication Date: 2018-10
Patent Classification: ["726", "023000"]

Abstract:
In an approach, an intermediary guest manager operates within a virtual machine hosted by a host machine and managed by a hypervisor. The intermediary guest manager manages one or more guest operating systems operating within the virtual machine and implements one or more security services for the guest operating systems. The security services provided to the guest operating systems may include system call filtering, memory protections, secure memory dumps, and others. In some cases, the intermediary guest manager consults a threat defense policy which contains a number of records, where each record has one or more triggers representing suspicious activity and one or more actions to take in response to being triggered. When the intermediary guest manager identifies a request, such as a system call or memory access, that meets the trigger of a particular record, the intermediary guest manager executes the associated actions to remediate the suspicious activity.

Claim (Index 11):
A non-transitory computer-readable storage medium storing one or more instructions which, when executed by one or more processors, cause the one or more processors to perform steps comprising:\n receiving, via a virtual machine on a computer, a particular request from a guest operating system on the virtual machine, wherein the virtual machine intercepts one or more requests made by the guest operating system and then effectuates the one or more requests by invoking a hypervisor; in response to receiving the particular request, determining whether the particular request meets a particular threat response trigger of a plurality of threat response triggers defined within a threat defense policy, wherein each threat response trigger of the plurality of threat response triggers defined within the threat defense policy has a corresponding remedial action; in response to determining that the particular request meets the particular threat response trigger, performing the corresponding remedial action of the particular threat response trigger; in response to determining that the particular request meets none of the plurality of threat response triggers, invoking the hypervisor to effectuate the particular request.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 86.0
- Lexical Diversity: 2.01235
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['15483971', '15633685', '15008058', '13842670', '15197634']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2910930618611106
- 35 USC 102 Novelty (BERT): 0.5392379740508059
- Combined Prediction Score: 0.3159075530800801
- Mean Citation Score: 241.282688
- Max Citation Score: 392.4658
- Similarity Product: 347.49258679555646

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test