Method and apparatus for determination of the non-replicative behavior of a malicious program

  • US 20030212906A1
  • Filed: 05/08/2002
  • Published: 11/13/2003
  • Est. Priority Date: 05/08/2002
  • Status: Active Grant
First Claim
Patent Images

1. A method for determining a non-replicative behavior of a program suspected of containing an undesirable software entity, comprising:

  • executing the program in at least one known environment;

    automatically examining the at least one known environment to detect if a change has occurred in the environment as a result of the execution of the program and, if a change is detected, automatically analyzing the detected change to determine if the change resulted from execution of the program or from execution of the undesirable software entity; and

    using a result of the analysis for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the changes that have been observed to result from the execution of the undesired software entity.

View all claims

    Thank you for your feedback