PROGRAM ANALYSIS SYSTEM AND METHOD THEREOF

• US 20130227690A1
• Filed: 02/22/2013
• Published: 08/29/2013
• Est. Priority Date: 02/23/2012
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: KAWAGUCHI, Nobutaka, KAJI, Tadashi, YAMAGUCHI, Hiroki
• Application Number:
  US13/773,976
• Publication Number:
  US 20130227690A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A program analysis system that analyzes a program while adjusting time elapse velocity in program execution environment sets analysis conditions such as time elapse velocity in the execution environment, program execution start time and execution termination time, adjusts the time elapse velocity and the program execution start time according to the determination of an analysis manager, executes the program till the execution termination time, monitors the execution environment, acquires an action record of the program, analyzes the action record, and clarifies the behavior of the program. Further, the program analysis system resets the analysis conditions based upon a result of analysis, re-analyzes, monitors communication between a sample and an external terminal, and varies the time elapse velocity set by the analysis manager to prevent time-out from occurring in communication.

Claims

1. A program analysis system that operates a program the operation of which is to be verified in execution environment where time elapse velocity can be arbitrarily adjusted, comprising:

a system management device provided with an analysis manager that manages an analysis situation of the program and determines time elapse velocity;

at least one sample execution device provided with a sample executor that executes the program in the execution environment based upon the time elapse velocity specified by the analysis manager and an action recorder that acquires the behavior of the program in the execution environment as an action record;

at least one action analyzer provided with an action analyzer that analyzes the action record and outputs a characteristic of the program as a result of analysis; and

at least one communication monitoring device provided with a communication monitor that adjusts the time elapse velocity so as to prevent time-out from occurring when the program communicates with an external device.

2. The program analysis system according to claim 1, wherein the communication monitoring device sets the time elapse velocity of the sample execution device to a predetermined value when the communication of the program is started.

3. The program analysis system according to claim 1, wherein the communication monitoring device resets the time elapse velocity of the sample execution device to a predetermined value when the communication of the program is finished.

4. The program analysis system according to claim 1, wherein the communication monitoring device sets time elapse velocity by transmitting a time elapse velocity change instruction to the sample execution device.

5. The program analysis system according to claim 1, wherein the communication monitoring device analyzes the contents of communication and estimates the time-out time of the communication.

6. The program analysis system according to claim 5, wherein the communication monitoring device analyzes the contents of communication and acquires a request statement from the sample execution device and a response statement to the request statement.

7. The program analysis system according to claim 6, wherein the communication monitoring device calculates a difference in time between the response statement and the request statement and estimates the time-out time based upon the difference in time.

8. The program analysis system according to claim 7, wherein the communication monitoring device estimates the time-out time based upon the difference in time.

9. The program analysis system according to claim 8, wherein the communication monitoring device calculates optimum time elapse velocity based upon the time-out time.

10. The program analysis system according to claim 8, wherein the communication monitoring device transmits the time elapse velocity change instruction to the sample execution device every time the optimum time elapse velocity is updated.

11. The program analysis system according to claim 10, wherein the communication monitoring device transmits the smaller value of the optimum time elapse velocity acquired from each communication as the time elapse velocity change instruction when the program executes a plurality of communications.

12. A program analysis method for operating a program the operation of which is to be verified in execution environment where time elapse velocity can be arbitrarily adjusted using a processor, comprising:

an analysis management step for managing an analysis situation of the program and determining time elapse velocity;

a sample execution step for executing the program in the execution environment based upon the time elapse velocity specified in the analysis management step;

an action recording step for acquiring the behavior of the program in the execution environment as an action record;

an action analysis step for analyzing the action record and outputting a characteristic of the program as a result of analysis; and

a communication monitoring step for adjusting the time elapse velocity so as to prevent time-out from occurring when the program communicates with an external device.

13. A program analysis system that operates a program the operation of which is to be verified in execution environment where time elapse velocity can be arbitrarily adjusted, comprising:

a system management device provided with an analysis manager that manages an analysis situation of the program and determines time elapse velocity; and

a processor provided with a sample executor that executes the program in the execution environment based upon the time elapse velocity specified by the analysis manager, an action recorder that acquires the behavior of the program in the execution environment as an action record, an action analyzer that analyzes the action record and outputs a characteristic of the program as a result of analysis, and a communication monitor that adjusts the time elapse velocity so as to prevent time-out from occurring when the program communicates with an external device.