US Patent 10536471 Malware detection in virtual machines

A system, computer program product, and computer-executable method of detecting malware in a virtual machine (VM), the computer-executable method comprising periodically creating snapshots of the VM, analyzing each of the snapshots in comparison to one or more previous snapshots to determine whether anomalies exist, and based on a threshold amount of anomalies detected, scanning the VM to determine whether malware is detected.