EP0636977A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Method and apparatus for detection of computer viruses
Assignee: Individual
•
Filing: 1994-07-27
•
Granted: —
•
Expires: 2014-07-27
Abstract
Abstract A behavior analyzing antivirus program detects viral infection of a target program by emulating the execution of the target program and analyzing the emulated execution to detect viral behavior. The antivirus monitor program contains both variables corresponding to the CPU's registers and emulation procedures corresponding to the CPU's instructions. The target program is loaded into memory and its execution is emulated by the antivirus monitor program. Intelligent procedures contained in the monitor program are given control between every instruction emulated so as to detect aberrant or dangerous behavior in the target program in which case the danger of a viral presence is flagged and emulation is terminated.
Inventors
- 👤 David Alan Chambers
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-31 13:43
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/566; G06F11/00; G06F11/22; G06F11/26; G06F11/261
Claims Analysis
Total Claims: 12
Claim 1
Independent Claim
84 words
A computer system configured to monitor the execution of a target program, said computer system comprising: a processing unit having an instruction set; instruction emulation means for emulating instructions in the target program corresponding to said instruction set; monitor means, coupled to said instruction emulation means, for emulating execution of said target program and for monitoring said emulated target program execution to detect a predetermined behavior by said target program; and means, coupled to said monitor means, for logging said predetermined behavior when detected.
Claim 2
Dependent Claim
37 words
The computer system of claim 1, wherein said computer system is configured to detect a computer virus associated with said target program, wherein said predetermined behavior is chosen to be indicative of replication of said computer virus.
Claim 3
Dependent Claim
39 words
The computer system of claim 1 wherein said instruction emulation means comprises: a register emulator for emulating registers of said processing unit; and a procedure controller for substituting emulation procedures for procedures accessed by said target program during emulation.
Claim 4
Dependent Claim
24 words
The computer system of claim 1 wherein said instruction emulation means comprises: a memory access controller for controlling access by said instructions to memory.
Claim 5
Dependent Claim
39 words
In a computer system, a method for monitoring execution of a target program comprising the steps of: emulating the target program; and monitoring emulation of the target program to detect a predetermined behavior indicating presence of a computer virus.
Claim 6
Dependent Claim
62 words
A computer system configured to monitor the execution of a target program, said computer system comprising: a processing unit having an instruction set; an instruction emulator for emulating instructions corresponding to the instruction set; an entry point access controller for controlling access to operating system entry points; and a logger for logging improper access by said instructions to operating system entry points.
Claim 7
Dependent Claim
31 words
The computer system of claim 6 further comprising a procedure access controller for controlling access to procedures during instruction emulation, wherein said logger logs improper access by said instructions to procedures.
Claim 8
Dependent Claim
34 words
The computer system of claim 6 further comprising a memory access controller for controlling access by said instructions to memory during instruction emulation wherein said logger logs improper access by said instructions to memory.
Claim 9
Dependent Claim
25 words
The computer system of claim 6 wherein said entry point access controller includes an interrupt tester for checking if a viral interrupt has been installed.
Claim 10
Dependent Claim
33 words
The computer system of claim 9 wherein said interrupt tester executes a guinea pig file and tests for modification of the guinea pig file to determine if a viral interrupt has been installed.
Claim 11
Dependent Claim
35 words
The computer system of claim 9 wherein said interrupt tester opens and closes a guinea pig file and tests for modification of the guinea pig file to determine if a viral interrupt has been installed.
Claim 12
Dependent Claim
47 words
The computer system of claim 10 wherein said interrupt tester executes the guinea pig file as a new target program, thereby creating a second guinea pig file, and tests for modification of the second guinea pig file to determine if a replicative viral interrupt has been installed.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.