Simulated computer system for monitoring of software performance

• US 20030135791A1
• Filed: 09/25/2002
• Published: 07/17/2003
• Est. Priority Date: 09/25/2001
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Norman ASA
• Inventors: Natvig, Kurt
• Granted Patent: US 7,356,736 B2
• Time in Patent Office: Days
• US Class Current: 714/38
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A system S is defined which is capable of simulating a computer (virtual computer, VC) for the purpose of software performance monitoring. The system is implemented as a set of software modules (SM) that can be exchanged to change the behavior of the VC. The VC is driven by a CPU emulator, and can run any operating system (virtual operating system, VOS) that is supported by the available SM'"'"'s. The system is designed to log accesses to system resources and the nature of these accesses. The system is particularly useful for determining whether an executable or file contains an unknown virus, with a very low risk of false positives. Detected viruses include encrypted, polymorphic, metamorphic and other virus types.

Claims

1. A simulated virtual computer system for testing the performance of a program, said virtual computer system executing on a real computer system, the virtual computer system comprising:

a CPU emulation module;

a first plurality of software modules that simulate hardware devices in the virtual computer system;

a second plurality of software modules that simulate software executing in the CPU emulation module in the virtual computer system; and

a system kernel module that manages the virtual computer system environment, wherein the program to be tested is executed in the virtual computer system, and wherein the system kernel logs accesses to the resources simulated by the first and second plurality of software modules.

2. The virtual computer system of claim 1, wherein the first plurality of software modules include a virtual random access memory (VRAM) module, a virtual read-only memory (VROM) memory module and one or more virtual storage device modules.

3. The virtual computer system of claim 2, wherein each virtual storage device module includes one of a virtual hard disk (VHD) module and a virtual floppy disk (VFD) module.

4. The virtual computer system of claim 2, wherein the second plurality of software modules include a virtual operating system (VOS) module, a virtual BIOS (VBIOS) module and one or more virtual files (VF).

5. The virtual computer system of claim 4, wherein each VF resides on a virtual storage device simulated by one of said one or more virtual storage device modules.

6. The virtual computer system in claim 4, wherein each VF includes one or more of an executable and a data file.

7. The virtual computer system of claim 1, wherein each of the first and second plurality of software modules provide event notification and description calls to the system kernel module.

8. The virtual computer system of claim 1, wherein the first plurality of software modules execute on a real CPU in the real computer system.

9. The virtual computer system of claim 1, wherein the second plurality of software modules execute through the CPU emulation module.

10. A computer-implemented method of testing a program in a virtual environment to determine whether the program includes damaging software or a virus, the method comprising:

providing a virtual computer system in a real computer system, the virtual computer system including software modules for simulating resources including hardware devices and software;

executing a program under test, P_test, in the virtual computer system until a stop condition occurs; and

determining whether a simulated resource has been written to or accessed, and if so, reassigning P_test to be at least a portion of a simulated resource that was written to or accessed, and thereafter

re-executing P_test in the virtual computer system until a stop condition occurs; and

determining whether re-execution of P_test causes a similar action or whether the virtual computer is unbootable, wherein if both steps of determining show the same or a similar result, the program under test is identified as including a virus, wherein if the virtual computer is unbootable upon re-execution, the program under test is identified as including damaging software, and wherein otherwise the program under test is identified as not containing damaging software or a virus.

11. The method of claim 10, wherein a stop condition includes one of a natural program termination, and one or more exceptions triggered by the emulated program.

12. The method of claim 10, wherein the simulated resources include a virtual storage device.

13. The method of claim 12, wherein the step of determining includes determining whether one the virtual storage device has been written to, and if so setting P_test to be the portion of the virtual storage device that was written to.

14. The method of claim 12, wherein the step of determining includes determining whether one of a virtual file (VF), a virtual master boot sector (MBS) and a virtual system boot sector (SBS) has been written to, and if so setting P_test to be at least a portion of the VF, VMBS or VSBS that was written to.

15. The method of claim 10, the simulated resources include a virtual network device, and wherein the step of determining includes determining whether an attempt has been made to transfer a file using the virtual network device, and if so setting P_test to be at least a portion of the file.