Computer virus trap

• US 5,842,002 A
• Filed: 05/30/1997
• Issued: 11/24/1998
• Est. Priority Date: 06/01/1994
• Status: Expired due to Fees

• Current Assignee: Quantum Leap Innovations, Inc.
• Original Assignee: Quantum Leap Innovations, Inc.
• Inventors: Klemmer, Timothy J., Schnurer, John
• Primary Examiner(s): Teska, Kevin J.
• Assistant Examiner(s): MOHAMED, AYNI Y
• Application Number:
  US08/865,786
• Time in Patent Office: 543 Days
• Field of Search: 395/180, 395/183.14, 395/500, 371/16.21, 371/16.23
• US Class Current: 703/21
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A computer virus trapping device is described that detects and eliminates computer viruses before they can enter a computer system and wreck havoc on its files, peripherals, etc. The trapping device creates a virtual world that simulates the host computer system intended by the virus to infect. The environment is made as friendly as possible to fool a computer virus into thinking it is present on the host, its intended target system. Within this virtual world, the virus is encouraged to perform its intended activity. The invention is able to detect any disruptive behavior occurring within this simulated host computer system. It is further able to remove the virus from the data stream before it is delivered to the host and and/or take any action previously instructed by a user.

Claims

1. A computer virus trapping device comprising:

link adapter means connected to a source of data input for converting external protocols into a data stream understood by said trapping device;

emulation means connected to said link adapter means for accepting said data stream from said link adapter means;

said emulation means including means for providing an environment isolated from a protected computer system and for simulating the architecture of said protected computer system whereby a computer virus is coaxed into performing its intended activity; and

detection means responsive to said emulation means for looking for consequences of the intended viral activity upon completion of the simulation by said emulation means.

2. The device of claim 1, whereby said emulation means comprises processing means suitably programmed to create a virtual world for said computer virus that simulates said protected computer system.

3. The device of claim 2, whereby said processing means comprises a microcomputer circuit, temporary and permanent data storage and an I/O interface.

4. A computer virus trapping device comprising:

link adapter means connected to a source of data input for converting external protocols into a data stream understood by said trapping device;

emulation means connected to said link adapter means for accepting said data stream from said link adapter means;

said emulation means including means for providing an environment isolated from a protected computer system and for simulating the architecture of said protected computer system whereby a computer virus is coaxed into performing its intended activity;

detection means responsive to said emulation means for looking for consequences of the intended viral activity upon completion of the simulation by said emulation means; and

response means responsive to said detection means for taking action according to preset user instructions upon said detection means determining said computer virus exists.

5. A computer virus trapping device comprising:

link adapter means connected to a source of data input for bidirectionally converting external protocols into a converted data stream understood by said trapping device;

emulation means connected to said link adapter means for accepting said data stream from said link adapter means;

said emulation means including means for providing an environment isolated from a protected computer system and for simulating the architecture of said protected computer system whereby a computer virus is coaxed into performing its intended activity;

detection means responsive to said emulation means for looking for consequences of the intended viral activity upon completion of the simulation by said emulation means;

response means responsive to said detection means for taking action according to preset user instructions upon said detection means determining said computer virus exists; and

I/O buffer means responsive to said emulation means for reassembling said converted data back into said external data stream protocol and delivering said data stream to said protected computer system.

6. The device of claim 5, whereby said emulation means comprises microprocessor means programmed to stimulate the environment of said protected computer system.