Computer immune system and method for detecting unwanted code in a computer system
First Claim
1. A method for identifying presence of malicious code in program code within a computer system, the method comprising:
- initializing a virtual machine within the computer system, the virtual machine comprising a virtual personal computer (PC) implemented by software simulating functionality of a central processing unit and memory and a virtual operating system simulating functionality of a multi-threaded operating system of the computer system;
virtually executing a target program within the virtual PC so that the target program interacts only with an instance of the virtual operating system;
analyzing behavior of the target program upon completion of virtual execution to identify an occurrence of malicious code behavior based upon an evaluation by the virtual machine of a behavior pattern representing information about all functions simulated by the target program during virtual execution;
generating the behavior pattern for the target program by tracking functions performed and not performed by the target program with flags in a behavior pattern field and by tracking a sequence in which the functions are called by the target program with the behavior pattern field; and
terminating the virtual PC after the analyzing process, thereby removing from the computer system a copy of the target program that was contained within the virtual PC.
4 Assignments
0 Petitions
Accused Products
Abstract
An automated analysis system detects malicious code within a computer system by generating and subsequently analyzing a behavior pattern for each computer program introduced to the computer system. Generation of the behavior pattern is accomplished by a virtual machine invoked within the computer system. An initial analysis may be performed on the behavior pattern to identify infected programs on initial presentation of the program to the computer system. The analysis system also stores behavior patterns and sequences with their corresponding analysis results in a database. Newly infected programs can be detected by analyzing a newly generated behavior pattern for the program with reference to a stored behavior pattern to identify presence of an infection or payload pattern.
660 Citations
34 Claims
-
1. A method for identifying presence of malicious code in program code within a computer system, the method comprising:
-
initializing a virtual machine within the computer system, the virtual machine comprising a virtual personal computer (PC) implemented by software simulating functionality of a central processing unit and memory and a virtual operating system simulating functionality of a multi-threaded operating system of the computer system; virtually executing a target program within the virtual PC so that the target program interacts only with an instance of the virtual operating system; analyzing behavior of the target program upon completion of virtual execution to identify an occurrence of malicious code behavior based upon an evaluation by the virtual machine of a behavior pattern representing information about all functions simulated by the target program during virtual execution; generating the behavior pattern for the target program by tracking functions performed and not performed by the target program with flags in a behavior pattern field and by tracking a sequence in which the functions are called by the target program with the behavior pattern field; and terminating the virtual PC after the analyzing process, thereby removing from the computer system a copy of the target program that was contained within the virtual PC. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A method for identifying presence of malicious code in program code within a computer system, the method comprising:
-
initializing a virtual machine within the computer system, the virtual machine comprising software simulating functionality of a central processing unit and memory and a virtual operating system simulating functionality of a multi-threaded operating system of the computer system; virtually executing a target program with the virtual machine so that the target program interacts with an instance of the virtual operating system rather than with the operating system of the computer system, whereby the malicious code is fully executed during virtual execution of the target program if the target program comprises the malicious code; generating a behavior pattern for the target program by tracking functions performed and not performed by the target program with flags in a behavior pattern field and by tracking a sequence in which the functions are called by the target program with the behavior pattern field in order to collect information about all functions simulated by the target program during virtual execution; and terminating the virtual machine upon completion of the virtual execution of the target program, leaving behind a record of the behavior pattern that is representative of operations of the target program with the computer system, including operations of the malicious code if the target program comprises the malicious code. - View Dependent Claims (12, 13, 14, 15, 16, 17)
-
-
18. A memory storage device comprising computer-executable steps for identifying the presence of malicious code in program code in a computer system, comprising:
-
initializing a virtual machine for the computer system, the virtual machine comprising a virtual personal computer (PC) implemented by software simulating functionality of a central processing unit memory a virtual operating system simulating functionality of a multi-threaded operating system of the computer system; executing a target program within the virtual PC so that the target program completes a virtual execution by interacting only with an instance of the virtual operating system; generating a behavior pattern by completing virtual execution of the target program within the virtual PC and by tracking functions performed and not performed by the target program with flags in a behavior pattern field and by tracking a sequence in which the functions are called by the target program, the behavior pattern representative of operational functions completed by the target program during virtual execution, including at least one of virtual operating system calls, Input/Output functions and program functions supported by the target program; upon completion of virtual execution, operating the virtual machine to compare the behavior pattern generated by virtual execution of the target program to a behavior pattern representative of operations by the malicious code to identify an occurrence of malicious code behavior; and in the event that the comparison process results in a match representing an identification of malicious code behavior by the target program, then identifying the target program as comprising the malicious code. - View Dependent Claims (19)
-
-
20. A memory storage device comprising computer-executable steps for identifying the presence of malicious code in program code in a computer system, comprising:
-
executing a target program within a virtual personal computer (PC) so that the target program completes a virtual execution by interacting only with an instance of a virtual operating system, the virtual PC comprising software operative to simulate functionality of a processor and memory, the virtual operating system operative to simulate functionality of a multi-threaded operating system for the computer system, the virtual PC and the virtual operating system operating in combination to form a virtual machine; collecting information about the behavior of the target program during virtual execution of the target program by the virtual machine by tracking functions performed and not performed by the target program with flags in a behavior pattern field and by tracking a sequence in which the functions are called by the target program in order to create a record of virtual operations of the target program, whereby the record reflects a plurality of operations of the malicious code if the target program comprises the malicious code; upon completion of virtual execution of the target program, analyzing the record with the virtual machine to identify an occurrence of malicious code behavior by comparing the record to a behavior pattern representative of the operations performed by the malicious code; and in the event that the record matches the malicious code behavior, then identifying the target program as comprising the malicious code. - View Dependent Claims (21)
-
-
22. A computer-implemented method for identifying a presence of malicious code in program code for a computer system, comprising the steps:
-
virtually executing a target program within a virtual machine comprising a virtual personal computer (PC) implemented by software operative to simulate functionality of a processor, and memory and a virtual operating system having software simulating functionality of a multi-threaded operating system for the computer system wherein virtual execution of the target program comprises interactions with an instance of the virtual operating system;
creating a record of all functions simulated by the target program during virtual execution of the target program by the virtual machine, the record comprising a behavior pattern representative of the behavior of the target program as if it were executed on the computer system, the behavior pattern comprising characteristics of malicious code behavior in the event that the target program comprises the malicious code; andcreating the behavior pattern by tracking functions performed and not performed by the target program with flags in a behavior pattern field and by tracking a sequence in which the functions are called by the target program with the behavior pattern field. - View Dependent Claims (23, 24, 25)
-
-
26. A memory storage device comprising computer-executable steps for identifying the presence of malicious code in program code in a computer system, comprising:
-
executing a target program within a virtual personal computer (PC) so that the target program completes a virtual execution by interacting only with an instance of a virtual operating system, the virtual PC comprising software operative to simulate functionality of a processor and memory, the virtual operating system operative to simulate functionality of a multi-threaded operating system for the computer system the virtual PC and the virtual operating system operating in combination to form a virtual machine; collecting information about the behavior of the target program in response to virtual execution of the target program by the virtual machine; in response to completing virtual execution of the target program, collecting information about interrupt call operations that call any interrupt service routine modified by the virtual execution of the target program; creating a record by tracking functions performed and not performed by the target program with flags in a behavior pattern field and by tracking a sequence in which the functions are called by the target program with the behavior pattern field, the functions comprising the interrupt call operations, the record comprising the information collected about the virtual execution of the target program and the interrupt call operations that call any interrupt service routine modified by the virtual execution of the target program; analyzing the record to identify an occurrence of malicious code behavior by comparing the record to a behavior pattern representative of the operations performed by the malicious code; and in the event that the record matches the malicious code behavior, then identifying the target program as comprising the malicious code. - View Dependent Claims (27, 28)
-
-
29. A memory storage device comprising computer-executable steps for identifying the presence of malicious code in program code in a computer system, comprising:
-
initializing a virtual machine for the computer system, the virtual machine comprising a virtual personal computer (PC) implemented by software simulating functionality of a central processing unit and memory and a virtual operating system simulating functionality of a multi-threaded operating system of the computer system, the initializing step comprising the steps of extracting the file structure of a target program and loading the target program into the software-simulated memory of the virtual PC; executing a target program within the virtual PC so that the target program completes a virtual execution by interacting only with an instance of the virtual operating system; generating a behavior pattern by completing virtual execution of the entire code of the target program within the virtual PC and by tracking functions performed and not performed by the target program with flags in a behavior pattern field and by tracking a sequence in which the functions are called by the target program, the behavior pattern representative of a sequence of operational functions completed by the target program during virtual execution, including at least one of virtual operating system calls, Input/Output functions and program functions supported by the target program; upon completion of virtual execution, operating the virtual machine to compare the behavior pattern generated by virtual execution of the target program to a behavior pattern representative of operations by the malicious code to identify an occurrence of malicious code behavior; and in the event that the comparison process results in a match representing an identification of malicious code behavior by the target program, then identifying the target program as comprising the malicious code. - View Dependent Claims (30, 31, 32, 33, 34)
-
Specification