Simulated computer system for monitoring of software performance

• US 7,356,736 B2
• Filed: 09/25/2002
• Issued: 04/08/2008
• Est. Priority Date: 09/25/2001
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Norman ASA
• Inventors: Natvig, Kurt
• Primary Examiner(s): Beausoliel; Robert
• Assistant Examiner(s): GUYTON, PHILIP A
• Application Number:
  US10/255,566
• Publication Number:
  US 20030135791A1
• Time in Patent Office: 2,022 Days
• Field of Search: 714/28, 714/38, 713/200
• US Class Current: 714/38.12
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A system S is defined which is capable of simulating a computer (virtual computer, VC) for the purpose of software performance monitoring. The system is implemented as a set of software modules (SM) that can be exchanged to change the behavior of the VC. The VC is driven by a CPU emulator, and can run any operating system (virtual operating system, VOS) that is supported by the available SM'"'"'s. The system is designed to log accesses to system resources and the nature of these accesses. The system is particularly useful for determining whether an executable or file contains an unknown virus, with a very low risk of false positives. Detected viruses include encrypted, polymorphic, metamorphic and other virus types.

Claims

1. A computer-implemented method of testing a program in a virtual environment to determine whether the program includes damaging software or a virus, the method comprising:

providing a simulated computer system in a real computer system, the simulated computer system including software modules for simulating resources including hardware devices and software;

executing a program under test, P_test, in the simulated computer system until a stop condition occurs; and

determining whether a simulated resource has been written to or accessed, and if so, reassigning P_test to be at least a portion of a simulated resource that was written to or accessed, and thereafter re-executing P_test in the simulated computer system until a stop condition occurs; and

determining whether re-execution of P_test causes a similar action or whether the simulated computer is unbootable, wherein if both steps of determining show the same or a similar result, the program under test is identified as including a virus, wherein if the simulated computer is unbootable upon re-execution, the program under test is identified as including damaging software, and wherein otherwise the program under test is identified as not containing damaging software or a virus.

2. The method of claim 1, wherein a stop condition includes one of a natural program termination, and one or more exceptions triggered by the emulated program.

3. The method of claim 1, wherein the simulated resources include a simulated storage device.

4. The method of claim 3, wherein the step of determining includes determining whether the simulated storage device has been written to, and if so setting P_test to be the portion of the simulated storage device that was written to.

5. The method of claim 3, wherein the step of determining includes determining whether one of a simulated file (SF), a simulated master boot sector (SMBS) and a simulated system boot sector (SSBS) has been written to, and if so setting P_test to be at least a portion of the SF, SMBS or-SSBS that was written to.

6. The method of claim 1, the simulated resources include a virtual network device, and wherein the step of determining includes determining whether an attempt has been made to transfer a file using the virtual network device, and if so setting P_test to be at least a portion of the file.