System and method for computer virus detection utilizing heuristic analysis

• US 20040243829A1
• Filed: 05/29/2003
• Published: 12/02/2004
• Est. Priority Date: 05/29/2003
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Jordan, Myles
• Granted Patent: US 7,231,667 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A computer virus detection method includes compiling a list of heuristic events and a chronological order in which they occur, comparing the list of heuristic events and the chronological order with a defined list of heuristic events occurring in a defined chronological order and determining whether a computer virus is present based on a result of the comparing.

Claims

1. A computer virus detection method comprising:

compiling a list of heuristic events and a chronological order in which they occur;

comparing the list of heuristic events and the chronological order with a defined list of heuristic events occurring in a defined chronological order; and

determining whether a computer virus is present based on a result of said comparing.

2. A computer virus detection method as recited in claim 1, further comprising emulating a target file and determining heuristic events that occur during the emulation and compiling the list of heuristic events based on the determined heuristic events.

3. A computer virus detection method as recited in claim 1, wherein a heuristic event comprises an action that may indicate viral activity.

4. A computer virus detection method as recited in claim 1, wherein if the defined list of heuristic events and the defined chronological order concur with the compiled list of heuristic events and the chronological order in which they occur, it is determined that a virus is present.

5. A computer virus detection method as recited in claim 1, wherein it is determined that a virus is present, when at least some of the heuristic events in the compiled list of heuristic events occur in at least a similar defined order as the defined list of heuristic events.

6. A computer virus detection method as recited in claim 1, wherein the defined list of heuristic events are retrieved from a remote website.

7. A computer virus detection method as recited in claim 1, wherein if it is determined that a virus is not present based on the result of the comparing, the list of heuristic events and the chronological order are compared with another defined list of heuristic events occurring in a defined chronological order.

21. A computer recording medium as recited in claim 1, wherein if it is determined that a virus is not present based on the result of the comparing, the list of heuristic events and the chronological order are compared with another defined list of heuristic events occurring in a defined chronological order.

8. A programmed computer system including computer executable code for performing a computer virus detection, said system comprising:

code for compiling a list of heuristic events and a chronological order in which they occur;

code for comparing the list of heuristic events and the chronological order with a defined list of heuristic events occurring in a defined chronological order; and

code for determining whether a computer virus is present based on a result of said comparing.

9. A programmed computer system as recited in claim 8, further comprising code for emulating a target file and determining heuristic events that occur during the emulation.

10. A programmed computer system as recited in claim 8, wherein a heuristic event comprises an action that may indicate viral activity.

11. A programmed computer system as recited in claim 8, wherein if the defined list of heuristic events and the defined chronological order concur with the compiled list of heuristic events and the chronological order in which they occur, it is determined that a virus is present.

12. A programmed computer system as recited in claim 8, wherein it is determined that a virus is present, when at least some of the heuristic events in the compiled list of heuristic events occur in at least a similar defined order as the defined list of heuristic events.

13. A programmed computer system as recited in claim 8, wherein the defined list of heuristic events are retrieved from a remote website.

14. A programmed computer system as recited in claim 8, wherein if it is determined that a virus is not present based on the result of the comparing, the list of heuristic events and the chronological order are compared with another defined list of heuristic events occurring in a defined chronological order.

15. A computer recording medium including computer executable code for performing a computer virus detection, said computer recording medium comprising:

code for compiling a list of heuristic events and a chronological order in which they occur;

code for comparing the list of heuristic events and the chronological order with a defined list of heuristic events occurring in a defined chronological order; and

code for determining whether a computer virus is present based on a result of said comparing.

16. A computer recording medium as recited in claim 15, further comprising code for emulating a target file and determining heuristic events that occur during the emulation.

17. A computer recording medium as recited in claim 15, wherein a heuristic event comprises an action that may indicate viral activity.

18. A computer recording medium as recited in claim 15, wherein if the defined list of heuristic events and the defined chronological order concur with the compiled list of heuristic events and the chronological order in which they occur, it is determined that a virus is present.

19. A computer recording medium as recited in claim 15, wherein it is determined that a virus is present, when at least some of the heuristic events in the compiled list of heuristic events occur in at least a similar defined order as the defined list of heuristic events.

20. A computer recording medium as recited in claim 15, wherein the defined list of heuristic events are retrieved from a remote website.

22. A computer virus detection method comprising:

compiling a list of possibly viral events and a chronological order in which they occur;

comparing the list of possibly viral events and the chronological order with a defined list of possibly viral events occurring in a defined chronological order; and

determining whether a computer virus is present based on a result of said comparing.

23. A programmed computer system computer including computer executable code for performing a computer virus detection, said system comprising:

code for compiling a list of possibly viral events and a chronological order in which they occur;

code for comparing the list of possibly viral events and the chronological order with a defined list of possibly viral events occurring in a defined chronological order; and

code for determining whether a computer virus is present based on a result of said comparing.

24. A computer recording medium including computer executable code for performing a computer virus detection, said computer recording medium comprising:

code for compiling a list of possibly viral events and a chronological order in which they occur;

code for comparing the list of possibly viral events and the chronological order with a defined list of possibly viral events occurring in a defined chronological order; and

code for determining whether a computer virus is present based on a result of said comparing.