US5398196A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for detection of computer viruses
Assignee: Gen Digital Inc
•
Filing: 1993-07-29
•
Granted: 1995-03-14
•
Expires: 2013-07-29
Abstract
Abstract A behavior analyzing antivirus program detects viral infection of a target program by emulating the execution of the target program and analyzing the emulated execution to detect viral behavior. The antivirus monitor program contains both variables corresponding to the CPU's registers and emulation procedures corresponding to the CPU's instructions. The target program is loaded into memory and its execution is emulated by the antivirus monitor program. Intelligent procedures contained in the monitor program are given control between every instruction emulated so as to detect aberrant or dangerous behavior in the target program in which case the danger of a viral presence is flagged and emulation is terminated.
Inventors
- 👤 David A. Chambers
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 19:43
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/566; G06F11/00; G06F11/22; G06F11/26; G06F11/261
Claims Analysis
Total Claims: 31
Claim 1
Independent Claim
120 words
A computer system configured to monitor the execution of a target program intended to run on a target computer, said target computer having an instruction set, said computer system comprising: a processing unit; instruction emulation means for operating said processing unit to emulate instructions in said target program corresponding to said instruction set as if said instructions were running on said target computer; monitor means, coupled to said instruction emulation means, for emulating execution of said target program as if said target program were running on said target computer and for monitoring said emulated target program execution to detect a predetermined behavior by said target program; and means, coupled to said monitor means, for logging said predetermined behavior when detected.
Claim 2
Dependent Claim
120 words
A computer system configured to monitor the execution of a target program intended to run on a target computer, said target computer having an instruction set, said computer system comprising: a processing unit; instruction emulation means for operating said processing unit to emulate instructions in said target program corresponding to said instruction set as if said instructions were running on said target computer; monitor means, coupled to said instruction emulation means, for emulating execution of said target program as if said target program were running on said target computer and for monitoring said emulated target program execution to detect a predetermined behavior by said target program; and means, coupled to said monitor means, for logging said predetermined behavior when detected.
Claim 3
Dependent Claim
36 words
The computer system of claim 1, wherein said computer system is configured to detect viral activity associated with said target program, wherein said predetermined behavior is chosen to be indicative of effects of said viral activity.
Claim 4
Dependent Claim
39 words
The computer system of claim 1 wherein said instruction emulation means comprises: a register emulator for emulating registers of said target computer; and a procedure controller for substituting emulation procedures for procedures accessed by said target program during emulation.
Claim 5
Dependent Claim
24 words
The computer system of claim 1 wherein said instruction emulation means comprises: a memory access controller for controlling access by said instructions to memory.
Claim 6
Dependent Claim
14 words
The computer system of claim 1 wherein said target computer is said computer system.
Claim 7
Dependent Claim
55 words
In a computer system, a method for monitoring execution of a target program intended to run on a target computer comprising the steps of: emulating the target program as if it were running on said target computer; and monitoring emulation of the target program to detect a predetermined behavior indicating presence of a computer virus.
Claim 8
Dependent Claim
55 words
In a computer system, a method for monitoring execution of a target program intended to run on a target computer comprising the steps of: emulating the target program as if it were running on said target computer; and monitoring emulation of the target program to detect a predetermined behavior indicating presence of a computer virus.
Claim 9
Dependent Claim
13 words
The method of claim 6 wherein said target computer is said computer system.
Claim 10
Dependent Claim
95 words
In a computer system including a processing unit and a viral behavior monitor, a method for monitoring execution of a target program intended to run on a target computer comprising the steps of: using said processing unit to emulate execution of an instruction as if said instruction were running on said target computer; using said viral behavior monitor to control access by said instruction to memory; using said viral behavior monitor to control access by said instruction to procedures; and repeating said step of using said processing unit for successive instructions of the target program.
Claim 11
Dependent Claim
95 words
In a computer system including a processing unit and a viral behavior monitor, a method for monitoring execution of a target program intended to run on a target computer comprising the steps of: using said processing unit to emulate execution of an instruction as if said instruction were running on said target computer; using said viral behavior monitor to control access by said instruction to memory; using said viral behavior monitor to control access by said instruction to procedures; and repeating said step of using said processing unit for successive instructions of the target program.
Claim 12
Dependent Claim
64 words
The method of claim 8 wherein said step of using said viral behavior monitor to control access by the instruction to memory comprises the substeps of: substituting an alternative memory address for a memory address to which the instruction intends access and which has been preselected for controlled access; and logging an attempted access to the memory address to which the instruction intends access.
Claim 13
Dependent Claim
13 words
The method of claim 8 wherein said target computer is said computer system.
Claim 14
Dependent Claim
50 words
The method of claim 8 wherein said step of using said vital behavior monitor to control access by the instruction to procedures comprises the substep of: upon a determination that the instruction is located at a controlled procedure entry point, logging an access attempt to the controlled procedure entry point.
Claim 15
Dependent Claim
75 words
The method of claim 11 wherein said step of using said viral behavior monitor to control access by the instruction to procedures further comprises the substeps of: upon a determination that the controlled procedure entry point belongs to a special case list, performing a special case emulation of the instruction; and upon a determination that the controlled procedure entry point does not belong to a special case list, performing a standard emulation of the instruction.
Claim 16
Dependent Claim
33 words
The method of claim 12 wherein said step of performing a special case emulation of the instruction comprises substituting an alternate procedure for the procedure which begins at the controlled procedure entry point.
Claim 17
Dependent Claim
26 words
The method of claim 8 further comprising the step of: using said viral behavior monitor to control access by the instruction to operating system access points.
Claim 18
Dependent Claim
47 words
The method of claim 14 wherein said step of using said vital behavior monitor to control access by the instruction to operating system access points comprises the substep of: upon a determination that an operating system entry point has changed, logging an operating system entry point change.
Claim 19
Dependent Claim
77 words
The method of claim 15 wherein said step of using said viral behavior monitor to control access by the instruction to operating system access points further comprises the substeps of: opening a guinea pig file; closing the guinea pig file; examining the guinea pig file to check if contents of the guinea pig file have changed; and upon a determination that contents of the guinea pig file have changed, logging unauthorized access to the guinea pig file.
Claim 20
Dependent Claim
71 words
The method of claim 15 wherein said step of using said viral behavior monitor to control access by the instruction to operating system access points comprises the substeps of: executing a guinea pig file; examining the guinea pig file to check if contents of the guinea pig file have changed; and upon a determination that contents of the guinea pig file have changed, logging unauthorized access to the guinea pig file.
Claim 21
Dependent Claim
94 words
The method of claim 16 wherein said step of using said viral behavior monitor to control access to operating system entry points further comprises the substeps of: upon a determination that contents of the guinea pig file have changed, loading the guinea pig file for emulation as a new target program and proceeding through said steps of emulating execution and controlling access to operating system entry points, thereby creating a second guinea pig file; and upon a determination that the new target program has written to the second guinea pig file, logging a virus.
Claim 22
Dependent Claim
95 words
The method of claim 17 wherein said step of using said viral behavior monitor to control access to operating system entry points further comprises the substeps of: upon a determination that contents of the guinea pig file have changed, loading the guinea pig file for emulation as a new target program and proceeding through said steps of emulating execution and controlling access to operating system entry points, thereby creating a second guinea pig file; and upon a determination that the new target program has written to the second guinea pig file, logging a replicative virus.
Claim 23
Dependent Claim
87 words
A computer system configured to monitor the execution of a target program intended to run on a target computer, said target computer having an instruction set, said computer system comprising: a processing unit; an instruction emulator for operating said processing unit to emulate instructions corresponding to the instruction set as if said instructions were executed by said target computer; an entry point access controller for controlling access to operating system entry points; and a logger for logging improper access by said instructions to operating system entry points.
Claim 24
Dependent Claim
87 words
A computer system configured to monitor the execution of a target program intended to run on a target computer, said target computer having an instruction set, said computer system comprising: a processing unit; an instruction emulator for operating said processing unit to emulate instructions corresponding to the instruction set as if said instructions were executed by said target computer; an entry point access controller for controlling access to operating system entry points; and a logger for logging improper access by said instructions to operating system entry points.
Claim 25
Dependent Claim
31 words
The computer system of claim 20 further comprising a procedure access controller for controlling access to procedures during instruction emulation, wherein said logger logs improper access by said instructions to procedures.
Claim 26
Dependent Claim
34 words
The computer system of claim 20 further comprising a memory access controller for controlling access by said instructions to memory during instruction emulation wherein said logger logs improper access by said instructions to memory.
Claim 27
Dependent Claim
14 words
The computer system of claim 20 wherein said target computer is said computer system.
Claim 28
Dependent Claim
20 words
The computer system of claim 20 wherein said entry point access controller checks if a viral interrupt has been installed.
Claim 29
Dependent Claim
37 words
The computer system of claim 24 wherein said entry point access controller opens and closes a guinea pig file and tests for modification of the guinea pig file to determine if a viral interrupt has been installed.
Claim 30
Dependent Claim
35 words
The computer system of claim 24 wherein said entry point access controller executes a guinea pig file and tests for modification of the guinea pig file to determine if a viral interrupt has been installed.
Claim 31
Dependent Claim
49 words
The computer system of claim 26 wherein said entry point access controller executes the guinea pig file as a new target program, thereby creating a second guinea pig file, and tests for modification of the second guinea pig file to determine if a replicative viral interrupt has been installed.
References Cited (Backward Citations)
US4080650A
Cited
US4773028A
Cited
EP0304033A2
Cited
DE3736760A1
Cited
FR2629231A1
Cited
FR2632747A2
Cited
US5144660A
Cited
US5121345A
Cited
SE461879B
Cited
GB2231418A
Cited
US5086502A
Cited
WO1991013403A1
Cited
CN1057534A
Cited
GB2246901A
Cited
US5233611A
Cited
BR9006430A
Cited
GB2253511A
Cited
EP0510244A1
Cited
WO1992021087A1
Cited
EP0514815A2
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1998-03-13 | 1998-09-12 | 1999-03-14 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2002-03-13 | 2002-09-12 | 2003-03-14 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2006-03-13 | 2006-09-12 | 2007-03-14 | $7700.00 | Window Closed / Lapsed |