Analytical virtual machine

• US 20070118350A1
• Filed: 11/10/2006
• Published: 05/24/2007
• Est. Priority Date: 06/19/2001
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: VCIS Incorporated
• Inventors: van der Made, Peter
• Granted Patent: US 7,657,419 B2
• Time in Patent Office: Days
• US Class Current: 703/22
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105

Abstract

An analytical virtual machine (AVM) analyzes computer code using a software processor including a register that stores behavior flags indicative of behaviors identified by virtually executing the code within the virtual machine. The AVM includes a sequencer that stores the sequence in which behavior flags are set in the behavior flags register. The AVM analyzes machine performance by emulating execution of the code being analyzed on a fully virtual machine and records the observed behavior. When emulation and analysis are complete, the AVM returns the behavior flags register and sequencer to the real machine and terminates.

Claims

1. A virtual machine system for computer code behavior analysis of a target program, the virtual machine system operating within a host real computer system having a software processor comprising:

a behavior record storing behavior flags representative of computer code behavior observed by virtually executing the computer code of the target program under analysis within the virtual machine system;

a sequencer that stores a sequence in which behavior flags are set and reset in the behavior record during virtual execution of the computer code of the target program under analysis; and

simulated memory automatically configured with a map of the virtual machine system comprising assigned areas for receiving predetermined types of data from the target program based on a file format of the target program; and

a simulated operating system representative of a host real computer system, the simulated operating system comprising one or more layered operating system shells that correspond with the memory map so that the virtual machine system is capable of executing DOS target programs, the computer code of the target program under analysis interacting with the simulated memory and the simulated operating system to generate the behavior flags,

wherein the virtual machine system passes data representative of the behavior record to the host real computer system prior to termination of the virtual machine system.

11. The system of claim 1, wherein the software processor identifies a type of operating system intended for the target program that is to be executed by the virtual machine system.

12. The system of claim 1, wherein the software processor executes the target program starting at each entry point defined within an entry point table.

13. The system of claim 1, wherein the software processor loads a language interpreter.

14. The system of claim 1, wherein the host real computer system terminates the virtual machine system after execution of the target program, thereby removing the target program that was contained within the virtual machine system.

15. The system of claim 1, wherein the real host computer system evaluates the behavior flag data and sequence flag data to determine if the target program contains malicious code.

2. A virtual machine system for computer code behavior analysis of a target program, the virtual machine system having a software processor, comprising:

a register or structure that stores behavior flags representative of computer code behavior observed by virtually executing the computer code of the target program under analysis within the virtual machine system;

a register or structure that stores a sequence in which behavior flags are set and reset in the behavior flags register or structure during virtual execution of the computer code of the target program under analysis;

an entry point table that stores all entry points to the computer code of the target program under analysis within the virtual machine system;

a structure that stores interrupt vector addresses, pointing at interrupt service routines loaded into memory reserved by the virtual machine system when the virtual machine system is initialized;

a memory structure simulating input and output ports;

a memory structure simulating processor memory automatically configured with a map of the virtual machine system comprising assigned areas for receiving predetermined types of data from the target program based on a file format of the target program;

one or more layered operating system simulation shells that simulate values returned by a real operating system under which the computer code of the target program under analysis is intended to operate, the one or more layered operating system shells corresponding with the memory map so that the virtual machine system is capable of executing DOS target programs.

3. The system of claim 2, wherein the software processor executes the computer code under analysis, or fragments of the computer code under analysis, starting at each of the entry points defined within the entry point table and produces a behavior pattern comprising a set of behavior flags.

4. The system of claim 2, wherein the software processor executes the computer code under analysis, starting at each entry point defined within the entry point table and produces a sequence in which the behavior flags are set or reset.

5. The system of claim 2, wherein the software processor interprets a high level language within the virtual machine system.

6. The system of claim 5, wherein the software processor executes the computer code under analysis, or fragments of the computer code under analysis, starting at each of the entry points defined within the entry point table and produces a behavior pattern comprising a set of behavior flags.

7. The system of claim 5, wherein the software processor executes the computer code under analysis, starting at each entry point defined within the entry point table and produces a sequence in which the behavior flags are set or reset.

8. The system of claim 2, wherein the software processor executes 32-bit or 64-bit program code and the operating system simulation shell responds to application program interface calls.

9. The system of claim 8, wherein the software processor executes the computer code under analysis, or fragments of the computer code under analysis, starting at each of the entry points defined within the entry point table and produces a behavior pattern comprising a set of behavior flags.

10. The system of claim 8, wherein the software processor executes the computer code under analysis, starting at each entry point defined within the entry point table and produces a sequence in which the behavior flags are set or reset.

16. A computerized method for identifying malicious code in a target program

running in a virtual machine of a computer system, the method comprising:

automatically configuring a memory map of the virtual machine by assigning areas of the memory map to receive predetermined types of data from the target program based on a file format in order to execute the target program;

constructing the virtual machine from one or more layered operating system shells that correspond with the memory map so that the virtual machine is capable of executing DOS target programs;

setting and resetting behavior flags in a register in order to track behavior of the target program in response to simulated values during execution of the target program by the virtual machine; and

storing a sequence in which the behavior flags are set and reset in the register by the target program during execution of the target program by the virtual machine.

17. The method of claim 16, further comprising executing the target program by the virtual machine in one of at least three modes of operation based on the file format and the control fields within the header of a file.

18. The method of claim 17, wherein a first mode of operation comprises a real mode for executing programs comprising instructions based on DOS, a second mode of operation for executing target programs comprises a high level programming language, and a third mode of operation comprises a protected mode for executing target programs comprising thirty-two bit code.

19. The method of claim 16, further comprising simulating values of the computer system with the one or more layered operating system shells of the virtual machine.

20. The method of claim 16, further comprising evaluating the behavior flag data and sequence flag data with the computer system to determine if the target program contains malicious code.