Offloading operations to a replicate virtual machine
A method for detecting malicious code within a first virtual machine comprising creating a snapshot of the first virtual machine and transferring the snapshot to a second machine. A scan operation is run on the snapshot using resources of the second machine. In response to detecting malicious code during the scan operation, action is taken at the first virtual machine to address the detection of the malicious code. Thus, the action in response to detecting the malicious code may include placing the first virtual machine in quarantine.
1. A method for detecting malicious code within a first virtual machine comprising:
creating a snapshot of the first virtual machine;
creating a second virtual machine;
making the second virtual machine to be a replica of the first virtual machine, including transferring the snapshot of the first virtual machine to the second virtual machine as a disk image;
running a scan operation on the snapshot of the first virtual machine at the second virtual machine using resources of the second virtual machine; and
in response to detecting malicious code during the scan operation using the resources of the second virtual machine, taking action at the first virtual machine to address the detection of the malicious code.
2. The method of claim 1 wherein taking action in response to detecting the malicious code includes placing the first virtual machine in quarantine.
3. The method of claim 1 further comprising deleting the second virtual machine after the scan operation is complete.
4. The method of claim 1 further comprising creating the second virtual machine on a host machine that is different than the host machine on which the first virtual machine is implemented.
5. The method of claim 1 wherein running the scan operation is executed such that execution has no effect on processing occurring at the first virtual machine.
6. The method of claim 1 , wherein the scan operation is performed by a virus scanning application running in the second virtual machine that is a replica of the first virtual machine.
7. A non-transitory computer-readable medium having computer-executable instructions for performing steps comprising:
creating a snapshot of the first virtual machine;
creating a second virtual machine;
making the second virtual machine to be a replica of the first virtual machine, including transferring the snapshot of the first virtual machine to the second virtual machine as a disk image;
running a scan operation on the snapshot of the first virtual machine using resources of the second virtual machine; and
in response to detecting malicious code during the scan operation using the resources of the second virtual machine, taking action at the first virtual machine to address the detection of the malicious code.
8. The non-transitory computer-readable medium of claim 7 wherein the computer-executable instructions are such that taking action in response to detecting the malicious code includes placing the first virtual machine in quarantine.
9. The non-transitory computer-readable medium of claim 7 wherein the computer-executable instructions further comprise deleting the second virtual machine after the scan operation is complete.
10. The non-transitory computer-readable medium of claim 7 wherein the computer-executable instructions further comprise creating the second virtual machine on a host machine that is different than the host machine on which the first virtual machine is implemented.
11. The non-transitory computer-readable medium of claim 7 wherein the computer-executable instructions are such that running the scan operation is executed such that execution has no effect on processing occurring at the first virtual machine.
12. The non-transitory computer-readable medium of claim 7 , wherein the scan operation is performed by a virus scanning application running in the second virtual machine that is a replica of the first virtual machine.
13. A method for detecting malicious code within a first virtual machine comprising:
making a second virtual machine to be a replica of the first virtual machine, including receiving a snapshot of a disk of the first virtual machine, the snapshot being received at the second virtual machine;
utilizing resources of the second virtual machine to run a scan operation on the snapshot of the disk of the first virtual machine; and
in response to detecting malicious code during the scan operation using the resources of the second virtual machine, sending instructions from the second virtual machine to take action to address the detection of the malicious code on the first virtual machine.
14. The method of claim 13 wherein sending the instructions include providing instructions to place the first virtual machine in quarantine.
15. The method of claim 14 wherein the instructions are sent to a host on which the first virtual machine runs.
16. The method of claim 13 , wherein the scan operation is performed by a virus scanning application running in the second virtual machine that is a replica of the first virtual machine.