Virtualization detection
AssigneeMicrosoft Corporation
InventorJames W. Mickens
Life of this patent
Estimating the term…
Abstract
A baseline set of graph information associated with a predefined execution environment of a program may be obtained, the baseline set associated with a baseline time interval. The predefined execution environment includes predefined environment objects, at least a portion of which are dynamically mutatable. A second set of graph information associated with the predefined execution environment may be obtained, the second set associated with a second time interval that is later in time than the baseline time interval. The baseline set and the second set may be compared to detect virtualization activity associated with a dynamic runtime.
Claims20
A system comprising:
- a device that includes at least one processor, the device including a virtualization detection engine comprising instructions tangibly embodied on a computer readable storage medium for execution by the at least one processor, the virtualization detection engine including:
- an environment state determination component configured to:
- obtain a baseline set of graph information associated with a predefined execution environment of a program, the baseline set associated with a baseline time interval, the predefined execution environment including predefined environment objects, at least a portion of the predefined environment objects being dynamically mutatable, and
- obtain a second set of graph information associated with the predefined execution environment, the second set associated with a second time interval that is later in time than the baseline time interval;
- and
- an environment state comparison component configured to compare the baseline set and the second set to detect virtualization activity associated with a dynamic runtime.
A method comprising:
- obtaining a baseline set of graph information associated with a predefined JAVASCRIPT execution environment of a web browser, the baseline set indicating a baseline state of the predefined JAVASCRIPT execution environment at a baseline time interval;
- obtaining a second set of graph information associated with the predefined JAVASCRIPT execution environment, the second set indicating a second state of the predefined JAVASCRIPT execution environment at a second time interval that is later in time than the baseline time interval;
- and
- comparing the baseline set and the second set to detect virtualization activity associated with a dynamic runtime.
A computer program product tangibly embodied on a computer-readable storage medium and including executable code that causes at least one data processing apparatus to:
- obtain, via a device processor, a baseline set of state information associated with predefined execution environment objects that are included in a predefined execution environment of a program, at least a portion of the predefined execution environment objects being dynamically mutatable, the baseline set of state information indicating a baseline state of the predefined execution environment at a baseline time interval;
- obtain a second set of state information associated with the predefined execution environment objects, the second set of state information indicating a second state of the predefined execution environment at a second time interval that is later in time than the baseline time interval;
- and
- initiate a comparison of the baseline set of state information and the second set of state information to determine virtualization activity associated with a dynamic runtime.
Dependencies are inferred from the claim text.