# US 12,217,078 B2 · Efficient virtual machine scanning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,217,078 B2 - Document ID: US12217078B2 - Status: Granted - Kind: B2 - Application number: 18/366,239 - Filed: 2023-08-07 - Published: 2023-11-23 - Granted: 2025-02-04 - Earliest claimed: 2020-07-16 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Liron Levin; Eran Yanay; Gilad Astrin; Dima Stopel - Web page: https://patentgrep.com/patent/US12217078B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 9/54: Interprogram communication - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/575: {Secure boot} - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for scanning of virtual machine images. The method includes creating a virtual machine instance of a virtual machine based on a virtual machine image of the virtual machine and an application programming interface (API) of an environment in which the virtual machine is to be deployed, wherein the virtual machine image has an entry point such that the virtual machine instance executes the entry point; and replacing the entry point of the virtual machine instance with a lightweight script, wherein the lightweight script is configured to retrieve a static scanner executable, to execute the static scanner executable, and to send results of the scanning. ## Claims ### Claim 1 A method comprising: modifying an entry point of a virtual machine image to indicate a script which, when executed, causes retrieval and running of a scanner executable to scan the virtual machine image, wherein modifying the entry point of the virtual machine image to indicate the script comprises one of, replacing the entry point with the script; and inserting one or more instructions into the entry point to retrieve the script from a storage location and to run the retrieved script; and creating a virtual machine instance based on the modified virtual machine image with an application programming interface (API) of a cloud computing environment in which the virtual machine image is stored. ### Claim 2 (depends on 1) The method of claim 1, wherein the storage location is within the cloud computing environment. ### Claim 3 (depends on 1) The method of claim 1 further comprising the virtual machine instance retrieving the scanner executable from a software-as-a-service provider system or an on-premises console when the script is run. ### Claim 4 (depends on 1) The method of claim 1, wherein the script is configured to use a storage mechanism of the cloud computing environment to store results of scanning the virtual machine image when firewall rules of the cloud computing environment do not allow for external traffic of nodes therein. ### Claim 5 (depends on 1) The method of claim 1, wherein modifying the entry point comprises inserting the one or more instructions into the entry point if one or more rules of the cloud computing environment do not allow for initialization scripts. ### Claim 6 (depends on 1) The method of claim 1, wherein creating the virtual machine instance with the API comprises creating the virtual machine instance that utilizes excess computing resources of the cloud computing resource environment. ### Claim 7 (depends on 1) The method of claim 1, wherein creating the virtual machine instance with the API comprises creating a preemptive virtual machine instance or a spot virtual machine instance with the API. ### Claim 8 (depends on 1) The method of claim 1, wherein startup of the virtual machine instance runs the scanner executable which causes scanning of the virtual machine image. ### Claim 9 (depends on 1) The method of claim 1, wherein creating the virtual machine instance is based on a historical scanning based budget for scanning and an expected scanning time that is based on at least one of size and type of the virtual machine image. ### Claim 10 (depends on 1) The method of claim 1, further comprising configuring the virtual machine instance with at least one configuration, wherein the at least one configuration includes at least one of: no internal traffic allowed, only predetermined allowable applications are allowed to run, no code which could perform changes in the environment is allowed to run, access is limited, and no communications are allowed via unsecured networks. ### Claim 11 (depends on 1) The method of claim 1 further comprising performing one or more mitigation actions based on results of scanning the virtual machine image indicating that the underlying virtual machine image is not in compliance or exhibits a known vulnerability, wherein the one or more mitigation actions comprise at least one of removing the virtual machine image from a repository and sending a notification to a system associated with the cloud computing environment. ### Claim 12 A non-transitory, computer-readable medium having program code stored thereon, the program code comprising instructions to: modify an entry point of a virtual machine image to indicate a script which, when executed, causes retrieval and running of a scanner executable to scan the virtual machine image, wherein the instructions to modify the entry point of the virtual machine image to indicate the script comprise at least one of, instructions to replace the entry point with the script; and instructions to insert one or more instructions into the entry point to retrieve the script from a storage location and to run the retrieved script; and create a virtual machine instance based on the modified virtual machine image with an application programming interface (API) of a cloud computing environment in which the virtual machine image is stored. ### Claim 13 (depends on 12) The computer-readable media of claim 12, wherein the script is configured to use a storage mechanism of the cloud computing environment to store results of scanning the virtual machine image when firewall rules of the cloud computing environment do not allow for external traffic of nodes therein. ### Claim 14 (depends on 12) The computer-readable media of claim 12, wherein the instructions to create the virtual machine instance comprise the instructions to create the virtual machine instance based on a historical scanning based budget for scanning and an expected scanning time that is based on at least one of size and type of the virtual machine image. ### Claim 15 (depends on 12) The computer-readable media of claim 12, wherein the instructions to create the virtual machine instance with the API comprise instructions to create a preemptive virtual machine instance or a spot virtual machine instance with the API. ### Claim 16 (depends on 12) The computer-readable media of claim 12, wherein the program code further comprises instructions to perform one or more mitigation actions based on results of scanning the virtual machine image indicating that the underlying virtual machine image is not in compliance or exhibits a known vulnerability, wherein the one or more mitigation actions comprise at least one of removing the virtual machine image from a repository and sending a notification to a system associated with the cloud computing environment. ### Claim 17 An apparatus comprising: a processor; and a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, modify an entry point of a virtual machine image to indicate a script which, when executed, causes retrieval and running of a scanner executable to scan the virtual machine image, wherein the instructions to modify the entry point of the virtual machine image to indicate the script comprise at least one of, instructions to replace the entry point with the script; and instructions to insert one or more instructions into the entry point to retrieve the script from a storage location and to run the retrieved script; and create a virtual machine instance based on the modified virtual machine image with an application programming interface (API) of a cloud computing environment in which the virtual machine image is stored. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the instructions to create the virtual machine instance comprise the instructions being executable by the processor to cause the apparatus to create the virtual machine instance based on a historical scanning based budget for scanning and an expected scanning time that is based on at least one of size and type of the virtual machine image. ### Claim 19 (depends on 17) The apparatus of claim 17, wherein the instructions to create the virtual machine instance with the API comprise the instructions being executable by the processor to cause the apparatus to create a preemptive virtual machine instance or a spot virtual machine instance with the API. ### Claim 20 (depends on 17) The apparatus of claim 17, wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to perform one or more mitigation actions based on results of scanning the virtual machine image indicating that the underlying virtual machine image is not in compliance or exhibits a known vulnerability, wherein the one or more mitigation actions comprise at least one of removing the virtual machine image from a repository and sending a notification to a system associated with the cloud computing environment.