# US 2026/0093516 A1 · Enhanced live virtual machine file system instrumentation for security analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0093516 A1 - Document ID: US20260093516A1 - Status: Published application - Kind: A1 - Application number: 18/901,952 - Filed: 2024-09-30 - Published: 2026-04-02 - Earliest claimed: 2024-09-30 - Applicants: Palo Alto Networks, Inc. - Inventors: Robert Jung; Michael S. Hughes; Daniel Raygoza; Esmid Idrizovic; Abhiroop Dabral - Web page: https://patentgrep.com/patent/US20260093516A1 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for providing enhanced live virtual machine file system instrumentation for security analysis are disclosed. In some embodiments, a system/process/computer program product for providing enhanced live virtual machine file system instrumentation for security analysis includes receiving a sample for automated dynamic analysis using a computing environment; freezing time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files; and performing an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive a sample for automated dynamic analysis using a computing environment; freeze time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files; and perform an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the computing environment comprises a virtual machine instance. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the computing environment comprises a virtual machine instance, and wherein the virtual machine instance provides an enhanced live virtual machine file system instrumentation for security analysis. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the computing environment comprises a virtual machine instance, wherein the virtual machine instance provides an enhanced live virtual machine file system instrumentation for security analysis, and wherein a virtual machine infrastructure is instrumented to facilitate extracting one or more files directly from a virtual machine memory and a disk during the automated dynamic analysis. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the computing environment comprises a virtual machine instance, and wherein the virtual machine instance provides an instrumented emulation environment that is executed outside of a guest operating system (OS) virtual machine environment. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the one or more reassembled files are fully reassembled. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the one or more reassembled files are fully reassembled, and wherein the one or more fully reassembled files are automatically analyzed to identify a potential malware binary. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the one or more reassembled files are fully reassembled, wherein the one or more fully reassembled files are automatically analyzed to identify a potential malware binary, and wherein the potential malware binary is submitted for further dynamic analysis and/or static analysis. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the one or more reassembled files are fully reassembled from a memory and/or a disk, wherein the memory and the disk are each associated with a virtual machine instance. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the event includes one or more of the following: a file system related event and/or an application programming interface (API) related event. ### Claim 11 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: stop execution of a guest operating system in the computing environment and execute one or more read operations to read one or more sector(s) from a disk, wherein the disk is associated with a virtual machine instance. ### Claim 12 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: stop execution of a guest operating system in the computing environment and execute one or more read operations to read one or more sector(s) from a memory and/or a disk, wherein the memory and the disk are each associated with a virtual machine instance, and wherein the memory includes a file system cache. ### Claim 13 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: stop execution of a guest operating system in the computing environment and execute one or more read operations to read one or more sector(s) from a memory and/or a disk, wherein the memory and the disk are each associated with a virtual machine instance, and wherein the memory includes a file system cache; and perform a reconciliation on the memory and on the disk for the one or more reassembled files. ### Claim 14 A method, comprising: receiving a sample for automated dynamic analysis using a computing environment; freezing time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files; and performing an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files. ### Claim 15 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: generate a signature based on the automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files, wherein the sample was determined to be malicious. ### Claim 16 (depends on 14) The method of claim 14, wherein the computing environment comprises a virtual machine instance. ### Claim 17 (depends on 14) The method of claim 14, wherein the computing environment comprises a virtual machine instance, and wherein the virtual machine instance provides an enhanced live virtual machine file system instrumentation for security analysis. ### Claim 18 (depends on 14) The method of claim 14, wherein the computing environment comprises a virtual machine instance, wherein the virtual machine instance provides an enhanced live virtual machine file system instrumentation for security analysis, and wherein a virtual machine infrastructure is instrumented to facilitate extracting one or more files directly from a virtual machine memory and a disk during the automated dynamic analysis. ### Claim 19 A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for: receiving a sample for automated dynamic analysis using a computing environment; freezing time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files; and performing an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files. ### Claim 20 (depends on 19) The computer program product recited in claim 19, wherein the computing environment comprises a virtual machine instance.