Analytical virtual machine

• US 20020056076A1
• Filed: 06/19/2001
• Published: 05/09/2002
• Est. Priority Date: 10/24/2000
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: VCIS Incorporated
• Inventors: Made, Peter A.J. van der
• Granted Patent: US 7,146,305 B2
• Time in Patent Office: Days
• US Class Current: 717/129
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

An analytical virtual machine (AVM) analyzes computer code using a software processor including a register that stores behavior flags indicative of behaviors identified by virtually executing the code within the virtual machine. The AVM includes a sequencer that stores the sequence in which behavior flags are set in the behavior flags register. The AVM analyzes machine performance by emulating execution of the code being analyzed on a fully virtual machine and records the observed behavior. When emulation and analysis are complete, the AVM returns the behavior flags register and sequencer to the real machine and terminates.

Claims

1. A virtual machine system for computer code behavior analysis, the virtual machine system having a software processor comprising:

a behavior record storing behavior flags representative of computer code behavior observed by virtually executing the computer code under analysis within the virtual machine;

a sequencer that stores a sequence in which behavior flags are set in the behavior record during virtual execution of the computer code under analysis; and

simulated memory and a simulated operating system representative of a host real computer system, the computer code under analysis interacting with the simulated memory and the simulated operating system to generate the behavior flags;

wherein the virtual machine passes data representative of the behavior record to the host real computer system prior to termination of the virtual machine.

2. A virtual machine system for computer code behavior analysis, the virtual machine system having a software processor, comprising:

a register or structure that stores behavior flags representative of computer code behavior observed by virtually executing the computer code under analysis within the virtual machine;

a register or structure that stores a sequence in which behavior flags are set in the behavior flags register or structure;

an entry point table that stores all entry points to the computer code under analysis within the virtual machine;

a structure that stores interrupt vector addresses, pointing at interrupt service routines loaded into memory reserved by the virtual machine when the virtual machine is initialized;

a memory structure simulating input and output ports;

a memory structure simulating processor memory;

one or more operating system simulation shells that simulate values returned by a real operating system under which the computer code under analysis is intended to operate.

3. The system of claim 2, wherein the software processor executes the computer code under analysis, or fragments of the computer code under analysis, starting at each of the entry points defined within the entry point table and produces a behavior pattern comprising a set of behavior flags.

4. The system of claim 2, wherein the software processor executes the computer code under analysis, starting at each entry point defined within the entry point table and produces a sequence in which the behavior flags are set or reset.

5. The system of claim 2, wherein the software processor interprets a high level language within the virtual machine system.

6. The system of claim 5, wherein the software processor executes the computer code under analysis, or fragments of the computer code under analysis, starting at each of the entry points defined within the entry point table and produces a behavior pattern comprising a set of behavior flags.

7. The system of claim 5, wherein the software processor executes the computer code under analysis, starting at each entry point defined within the entry point table and produces a sequence in which the behavior flags are set or reset.

8. The system of claim 2, wherein the software processor executes 32-bit or 64-bit program code and the operating system simulation shell responds to application program interface calls.

9. The system of claim 8, wherein the software processor executes the computer code under analysis, or fragments of the computer code under analysis, starting at each of the entry points defined within the entry point table and produces a behavior pattern comprising a set of behavior flags.

10. The system of claim 8, wherein the software processor executes the computer code under analysis, starting at each entry point defined within the entry point table and produces a sequence in which the behavior flags are set or reset.