Method and apparatus for the automatic determination of potentially worm-like behavior of a program
First Claim
1. A method for the automatic determination of potentially worm-like behavior of a program, comprising:
- determining a behavioral profile of the program in an environment that does not emulate the operation of a network;
comparing the determined behavioral profile against a profile indicative of worm-like behavior; and
providing an indication of potentially worm-like behavior based on the result of the comparison.
3 Assignments
0 Petitions
Accused Products
Abstract
A method and system for the automatic determination of the behavioral profile of a program suspected of having worm-like characteristics includes analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like characteristics, running the program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the program in the non-network environment. A logged record of the observed behavior is analyzed to determine if the behavior is indicative of the program having worm-like characteristics. The non-network environment may simulate the appearance of a network to the program, without emulating the operation of the network.
-
Citations
45 Claims
-
1. A method for the automatic determination of potentially worm-like behavior of a program, comprising:
-
determining a behavioral profile of the program in an environment that does not emulate the operation of a network;
comparing the determined behavioral profile against a profile indicative of worm-like behavior; and
providing an indication of potentially worm-like behavior based on the result of the comparison. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17)
-
- 18. A method for the automatic determination of the behavioral profile of a program suspected of having worm-like characteristics, comprising analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like characteristics, running the program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the program in the non-network environment.
- 20. A computer program embodied on a computer readable medium for implementing a method for the automatic determination of the behavioral profile of a sample program suspected of having worm-like characteristics, where the execution of the computer program causes a computer to analyze computer system resources required by the sample program and, if the required resources are not indicative of the sample program having worm-like characteristics, further execution of the computer program causes the computer to run the program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the program in the non-network environment.
-
22. A data processing system comprising at least one computer for executing a stored program for making an automatic determination of potentially worm-like behavior of a program, comprising:
-
means for determining a behavioral profile of the program in an environment that does not emulate the operation of a network;
means for comparing the determined behavioral profile against a stored profile indicative of worm-like behavior; and
means for providing an indication of potentially worm-like behavior based on the result of the comparison. - View Dependent Claims (23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38)
-
-
39. A computer program embodied on a computer readable medium for implementing a method for the automatic determination of potentially worm-like behavior of a program, where the execution of the computer program causes a computer to determine a behavioral profile of the program in an environment that does not emulate the operation of a network;
- to compare the determined behavioral profile against a profile indicative of worm-like behavior; and
to provide an indication of potentially worm-like behavior based on the result of the comparison. - View Dependent Claims (40, 41, 42, 43, 44, 45)
- to compare the determined behavioral profile against a profile indicative of worm-like behavior; and
Specification