# US 8,789,049 B2 · Offloading operations to a replicate virtual machine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,049 B2 - Document ID: US8789049B2 - Status: Granted - Kind: B2 - Application number: 13/623,411 - Filed: 2012-09-20 - Published: 2013-01-24 - Granted: 2014-07-22 - Earliest claimed: 2006-03-31 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Gregory Hutchins; Christian Czezatke; Satyam B. Vaghani; Mallik Mahalingam; Shaw Chuang; Bich Cau Le - Web page: https://patentgrep.com/patent/US8789049B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2209/509: Offload - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for detecting malicious code within a first virtual machine comprising creating a snapshot of the first virtual machine and transferring the snapshot to a second machine. A scan operation is run on the snapshot using resources of the second machine. In response to detecting malicious code during the scan operation, action is taken at the first virtual machine to address the detection of the malicious code. Thus, the action in response to detecting the malicious code may include placing the first virtual machine in quarantine. ## Claims ### Claim 1 A method for detecting malicious code within a first virtual machine comprising: creating a snapshot of the first virtual machine; creating a second virtual machine; making the second virtual machine to be a replica of the first virtual machine, including transferring the snapshot of the first virtual machine to the second virtual machine as a disk image; running a scan operation on the snapshot of the first virtual machine at the second virtual machine using resources of the second virtual machine; and in response to detecting malicious code during the scan operation using the resources of the second virtual machine, taking action at the first virtual machine to address the detection of the malicious code. ### Claim 2 (depends on 1) The method of claim 1 wherein taking action in response to detecting the malicious code includes placing the first virtual machine in quarantine. ### Claim 3 (depends on 1) The method of claim 1 further comprising deleting the second virtual machine after the scan operation is complete. ### Claim 4 (depends on 1) The method of claim 1 further comprising creating the second virtual machine on a host machine that is different than the host machine on which the first virtual machine is implemented. ### Claim 5 (depends on 1) The method of claim 1 wherein running the scan operation is executed such that execution has no effect on processing occurring at the first virtual machine. ### Claim 6 (depends on 1) The method of claim 1, wherein the scan operation is performed by a virus scanning application running in the second virtual machine that is a replica of the first virtual machine. ### Claim 7 A non-transitory computer-readable medium having computer-executable instructions for performing steps comprising: creating a snapshot of the first virtual machine; creating a second virtual machine; making the second virtual machine to be a replica of the first virtual machine, including transferring the snapshot of the first virtual machine to the second virtual machine as a disk image; running a scan operation on the snapshot of the first virtual machine using resources of the second virtual machine; and in response to detecting malicious code during the scan operation using the resources of the second virtual machine, taking action at the first virtual machine to address the detection of the malicious code. ### Claim 8 (depends on 7) The non-transitory computer-readable medium of claim 7 wherein the computer-executable instructions are such that taking action in response to detecting the malicious code includes placing the first virtual machine in quarantine. ### Claim 9 (depends on 7) The non-transitory computer-readable medium of claim 7 wherein the computer-executable instructions further comprise deleting the second virtual machine after the scan operation is complete. ### Claim 10 (depends on 7) The non-transitory computer-readable medium of claim 7 wherein the computer-executable instructions further comprise creating the second virtual machine on a host machine that is different than the host machine on which the first virtual machine is implemented. ### Claim 11 (depends on 7) The non-transitory computer-readable medium of claim 7 wherein the computer-executable instructions are such that running the scan operation is executed such that execution has no effect on processing occurring at the first virtual machine. ### Claim 12 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the scan operation is performed by a virus scanning application running in the second virtual machine that is a replica of the first virtual machine. ### Claim 13 A method for detecting malicious code within a first virtual machine comprising: making a second virtual machine to be a replica of the first virtual machine, including receiving a snapshot of a disk of the first virtual machine, the snapshot being received at the second virtual machine; utilizing resources of the second virtual machine to run a scan operation on the snapshot of the disk of the first virtual machine; and in response to detecting malicious code during the scan operation using the resources of the second virtual machine, sending instructions from the second virtual machine to take action to address the detection of the malicious code on the first virtual machine. ### Claim 14 (depends on 13) The method of claim 13 wherein sending the instructions include providing instructions to place the first virtual machine in quarantine. ### Claim 15 (depends on 14) The method of claim 14 wherein the instructions are sent to a host on which the first virtual machine runs. ### Claim 16 (depends on 13) The method of claim 13, wherein the scan operation is performed by a virus scanning application running in the second virtual machine that is a replica of the first virtual machine.