EVALUATION OF PROCESS OF MALWARE DETECTION IN VIRTUAL MACHINES Russian patent published in 2017 - IPC G06F21/53 G06F21/56 G06F9/455 

FIELD: information technology.

SUBSTANCE: described systems and methods provide the ability to protect the computer system against malware, in particular against viruses and rootkits. The anti-malware component runs inside the virtual machine (VM) provided by the hypervisor. The memory self-analysis module is executed outside the virtual machine at the hypervisor level of the processor privilege and protects the process running inside the virtual machine by protecting memory page of the corresponding process against writing. By combining the anti-malware components running inside and outside the corresponding VM, some embodiments of the invention can use a variety of behaviour data that components within the VM have access to while ensuring the integrity of these components outside the corresponding VM.

EFFECT: placement of a component that detects process startups outside the corresponding virtual machine to a higher level of processor privileges than the operating system privilege level, which allows to prevent malware from hiding from the anti-malware components.

21 cl, 11 dwg