Object-oriented database for file system emulator

• US 8,407,196 B1
• Filed: 02/28/2009
• Issued: 03/26/2013
• Est. Priority Date: 02/28/2009
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Kryukov, Andrey V.
• Primary Examiner(s): Lewis, Cheryl
• Assistant Examiner(s): Hoffler, Raheem
• Application Number:
  US12/395,654
• Time in Patent Office: 1,487 Days
• Field of Search: None
• US Class Current: 707/705
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A system and computer program product for implementing an object-oriented hierarchical database architecture that supports functionality of an emulator. The hierarchical data architecture is created for implementing a files system and/or a system registry inside the emulator, where malware components are emulated and tested. The data architecture supports the emulator and provides for effective recovery of a database fragments after modifications of the fragments by the emulated malware. The non-relational object-oriented database consists of database objects. Each of the database objects has various data fields. Special user types are assigned to the database objects. Each user type is defined by a selected set of data fields. The database objects have a parent-child relationship. Each database object has a unique parent object and a unique set of index fields. The unique set of the index fields is a unique set of data fields of an object. The database has a root object which is unique for the database.

Claims

1. An object oriented non-relational database system for storing a file system used by a malware emulator, the system comprising:

a processor;

a memory coupled to the processor;

computer code loaded into the memory for implementing the following functionality;

an object hierarchy represented by relationships among the data objects of the object-oriented non-relational database;

a root object placed on top of the hierarchy, the root object being a parent-object to all database objects within the hierarchy;

a plurality of database objects, wherein;

each database object has a type assigned to it and which is defined by a selected set of data fields;

each database object has at least one data field;

each database object has a unique parent-object; and

each database object has a unique set of index fields,

wherein each database object is defined by a combination of object'"'"'s parent-object, object'"'"'s type and object'"'"'s unique set of the index fields, which are used to access the object;

wherein objects can only be accessed using the index fields, and

wherein at least some of the data fields are references that refer to other objects within the database regardless of their location;

wherein logical separation of the user types is provided by the hierarchy;

wherein the root object represents the file system and other objects represent files and directories of the file system, and system registry;

wherein fields of the root object have names that are unique and can only be assigned to the root object;

wherein a complete path to any destination object within the hierarchy is a list of objects that need to be passed on the way from the root object to the destination object;

wherein, for any object specified in the path is not found in the database, that object is automatically created as the path is being executed; and

wherein removal of an object includes first removing all references to the object, then removing child-objects together with their respective references to other objects and only then removing the object itself.

2. The database of claim 1, wherein the root object has unique data fields within the hierarchy.

3. The database of claim 1, wherein a single index field can be the same for several database objects.

4. The database of claim 1, wherein the objects are cross-referenced to each other.

5. The database of claim 4, wherein the objects are cross-references by a link located in data field.

6. The database of claim 1, wherein the data fields are any of:

a text string;

a Boolean expression;

a number;

a reference; and

a list.

7. The database of claim 1, wherein the objects on a first level of the hierarchy below the root object have the root object as a parent-object.

8. The database of claim 1, wherein an object table is associated with a type definition table and with a field definition table.

9. The database of claim 8, wherein the tables are associated by their reference fields.

10. The database of claim 9, wherein the reference fields can contain links to any object within the hierarchy except for the root object.

11. The database of claim 1, wherein the database is accessible by a malware component implemented in the emulator.

12. The database of claim 11, wherein the objects can be modified by the emulated malware component.

13. A method for using an object-oriented hierarchical non-relational database in a malware emulator, the method comprising:

forming an object hierarchy represented by relationships among the data objects of the object-oriented database, the object hierarchy being a proxy for a file system and system registry, each database object having a type assigned to it and which is defined by a selected set of data fields;

selecting a branch of the database to be used in the malware emulator;

allocating a memory block for the selected database branch;

loading the selected database branch into the allocated memory block;

creating a backup copy of the loaded database branch;

accessing objects in the loaded data base branch by the malware emulator, wherein the database branch is modified by a malware component and wherein each database object is defined by a combination of object'"'"'s parent-object, object'"'"'s type and object'"'"'s unique set of the index fields, which are used to access the object;

determining if the allocated memory block is sufficient for malware emulation, wherein if the allocated memory block is insufficient, providing additional memory to the emulator;

recording results of malware emulation upon its completion; and

restoring the modified database branch to its initial state by overwriting it with the backup copy in the allocated memory block;

wherein objects can only be accessed using the index fields;

wherein at least some of the data fields are references that refer to other objects within the database regardless of their location;

wherein logical separation of the user types is provided by the hierarchy;

wherein a complete path to any destination object within the hierarchy is a list of objects that need to be passed on the way from the root object to the destination object;

wherein, for any object specified in the path is not found in the database, that object is automatically created as the path is being executed; and

wherein removal of an object includes first removing all references to the object, then removing child-objects together with their respective references to other objects and only then removing the object itself.

14. The method of claim 13, wherein the backup copy includes all of cross-references.

15. The method of claim 13, wherein the integrity of the cross-references within the selected database branch remains unchanged after being modified by the malware.

16. The method of claim 13, wherein the database branch is loaded using paths to selected objects within the object-oriented hierarchical database.

17. The method of claim 16, wherein the path to the selected object consists of all objects in the hierarchical database located between a root object and the selected object.