Systems and methods of analyzing a software component

• US 9,336,025 B2
• Filed: 07/12/2013
• Issued: 05/10/2016
• Est. Priority Date: 07/12/2013
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Kirk, Terrance J., Bialek, Matthew S., Kospiah, Shaun, Lemm, Timothy M., Thompson, Scott G.
• Primary Examiner(s): Brown, Anthony
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US13/941,325
• Publication Number:
  US 20150020066A1
• Time in Patent Office: 1,033 Days
• Field of Search: 726/22, 370/252, 709/203
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines

Abstract

A particular method includes receiving, at a device, a request to analyze a software component. The request indicates a target operating system. The method also includes generating a virtual machine at a computing device. The virtual machine implements the target operating system. The method further includes executing the software component in the target operating system on the virtual machine and generating data indicating effects of executing the software component on the virtual machine.

Claims

1. A method comprising:

receiving, at a computing device, a request to analyze a software component, wherein the request indicates a target operating system, wherein the target opera system is a custom operating system derived from an image from a golden master source;

generating a virtual machine at the computing device, wherein the virtual machine implements the target operating system;

executing the software component in the target operating system on the virtual machine; and

generating data indicating effects of executing the software component on the virtual machine, wherein the data identifies at least one of a function call, a memory modification, a file access, a network access, a registry modification, a file system modification, or a system resource utilization.

2. The method of claim 1, wherein a plurality of operating systems, stored at the computing device, include the target operating system, and wherein the virtual machine is generated using a copy of the target operating system.

3. The method of claim 1, wherein the virtual machine is generated to emulate a particular client operating environment indicated in the request.

4. The method of claim 1, wherein the data is generated by sensor functions that monitor the virtual machine.

5. The method of claim 1, further comprising removing the virtual machine from the computing device after execution of the software component.

6. The method of claim 1, wherein the software component includes malware.

7. The method of claim 1, wherein the request includes the software component.

8. A system comprising:

a processor; and

a memory storing instructions that, when executed by the processor, cause the processor to perform operations comprising;

receiving a request to analyze a first software component, wherein the request indicates a target operating system, wherein the target operating system is a custom operating system derived from an image from a golden master source;

generating a virtual machine, wherein the virtual machine implements the target operating system;

executing the first software component in the target operating system on the virtual machine; and

generating first data associated with execution of the first software component on the virtual machine, wherein the first data identifies at least one of a function call, a memory modification, a file access, a network access, a registry modification, a file system modification, or a system resource utilization.

9. The system of claim 8, wherein the first data is generated by sensor functions that monitor the virtual machine.

10. The system of claim 8, wherein the first data indicates effects of executing kernel level events of the software component on the virtual machine.

11. The system of claim 8, wherein the operations further comprise generating a report based on the first data, wherein the report is generated using a standardized reporting language, and wherein the request indicates the standardized reporting language.

12. The system of claim 11, wherein the operations further comprise:

storing the first data in a database along with an identifier of the first software component; and

storing the report in the database along with the identifier of the first software component.

13. The system of claim 8, wherein the operations further comprise comparing the first data to information in a database to generate a result.

14. The system of claim 13, wherein the information in the database is related to a second software component and wherein the operations further comprise identifying similar effects of executing the first software component and executing the second software component based on the result.

15. The system of claim 14, wherein the operations further comprise identifying distinct effects of executing the first software component and the second software component based on the result.

16. The system of claim 15, wherein the operations further comprise generating second data indicating the similar effects and the distinct effects.

17. The system of claim 13, wherein the operations further comprise:

identifying a second software component that has a same effect upon execution as the first software component, wherein the second software component is identified based on the information in the database; and

generating second data indicating the second software component.

18. A non-transitory computer-readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving a request to analyze a software component, wherein the request indicates a target operating system, wherein the target operating system is a custom operating system derived from an image from a golden master source;

generating a virtual machine at a computing device, wherein the virtual machine implements the target operating system;

executing the software component in the target operating system on the virtual machine; and

generating first data associated with execution of the software component on the virtual machine, wherein the first data identifies at least one of a function call, a memory modification, a file access, a network access, a registry modification, a file system modification, or a system resource utilization.

19. The non-transitory computer-readable storage device of claim 18, wherein the first data indicates effects of executing application level events of the software component on the virtual machine.

20. The non-transitory computer-readable storage device of claim 18, wherein the operations further comprise:

comparing the first data to second data to generate a result, wherein the second data indicates publicized effects of executing the software component; and

determining whether the effects of executing the software component on the virtual machine match the publicized effects based on the result.