US5854916A
Expired / Lapsed
US
⏱️ 0.0 years remaining
State-based cache for antivirus software
Assignee: Gen Digital Inc
•
Filing: 1996-11-27
•
Granted: 1998-12-29
•
Expires: 2016-11-27
Abstract
Abstract A computer-implemented method for executing a computer file in a CPU emulator (154) to detect a computer virus. The method includes simulating (302) the execution of a predetermined number of instructions of the computer file in the CPU emulator (154), suspending (303) the execution, constructing (304) a state record, temporarily storing (305) the state record in memory, comparing (306) the constructed state record to state records stored in a state cache (158), and indicating (308) that the file is virus free when the constructed state record matches one of the stored state records.
Inventors
- 👤 Carey S. Nachenberg
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-09 18:00
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/568; G06F21/562; G06F21/564; G06F21/565; G06F21/566
Claims Analysis
Total Claims: 10
Claim 1
Independent Claim
129 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: simulating execution of the computer file by a CPU emulator in a computer memory for a first predetermined number of instructions; suspending the simulated execution; constructing a current state record of the CPU emulator; comparing the current state record to state records previously stored in a state-based cache; indicating that no virus is detected when the current state record matches one of the previously stored state records; wherein each state record includes a total number of data writes to a virtual memory performed during the simulated execution of the computer file by the CPU emulator; and wherein each state record includes a cyclic redundancy check value calculated from the data writes to the virtual memory.
Claim 2
Dependent Claim
129 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: simulating execution of the computer file by a CPU emulator in a computer memory for a first predetermined number of instructions; suspending the simulated execution; constructing a current state record of the CPU emulator; comparing the current state record to state records previously stored in a state-based cache; indicating that no virus is detected when the current state record matches one of the previously stored state records; wherein each state record includes a total number of data writes to a virtual memory performed during the simulated execution of the computer file by the CPU emulator; and wherein each state record includes a cyclic redundancy check value calculated from the data writes to the virtual memory.
Claim 3
Dependent Claim
127 words
A computer program product comprising a computer-usable medium having computer-readable code embodied therein for detecting computer viruses in a computer file, comprising: computer-readable program code devices configured to simulate execution of the computer file on a CPU emulator for a first predetermined number of instructions wherein the first predetermined number of instructions is less than 20; computer-readable program code devices configured to suspend the simulated execution; computer-readable program code devices configured to construct a current state record of the CPU emulator; computer-readable program code devices configured to compare the current state record to state records previously stored in a state-based cache; and computer-readable program code devices configured to indicate that no virus is detected when the current state record matches one of the previously stored state records.
Claim 4
Dependent Claim
127 words
A computer program product comprising a computer-usable medium having computer-readable code embodied therein for detecting computer viruses in a computer file, comprising: computer-readable program code devices configured to simulate execution of the computer file on a CPU emulator for a first predetermined number of instructions wherein the first predetermined number of instructions is less than 20; computer-readable program code devices configured to suspend the simulated execution; computer-readable program code devices configured to construct a current state record of the CPU emulator; computer-readable program code devices configured to compare the current state record to state records previously stored in a state-based cache; and computer-readable program code devices configured to indicate that no virus is detected when the current state record matches one of the previously stored state records.
Claim 5
Dependent Claim
93 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: simulating execution of the computer file by a CPU emulator in a computer memory for a first predetermined number of instructions, wherein the first predetermined number of instructions is less than 20 suspending the simulated execution; constructing a current state record of the CPU emulator; comparing the current state record to state records previously stored in a state-based cache; and indicating that no virus is detected when the current state record matches one of the previously stored state records.
Claim 6
Dependent Claim
93 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: simulating execution of the computer file by a CPU emulator in a computer memory for a first predetermined number of instructions, wherein the first predetermined number of instructions is less than 20 suspending the simulated execution; constructing a current state record of the CPU emulator; comparing the current state record to state records previously stored in a state-based cache; and indicating that no virus is detected when the current state record matches one of the previously stored state records.
Claim 7
Dependent Claim
122 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: simulating execution of the computer file by a CPU emulator in a computer memory for a first predetermined number of instructions; suspending the simulated execution; constructing a current state record of the CPU emulator; comparing the current state record to state records previously stored in a state-based cache; indicating that no virus is detected when the current state record matches one of the previously stored state records; wherein each state record includes a value of a virtual instruction pointer within the CPU emulator; and wherein each state record includes a byte from a virtual memory address nearby an address corresponding to the value of the virtual instruction pointer.
Claim 8
Dependent Claim
122 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: simulating execution of the computer file by a CPU emulator in a computer memory for a first predetermined number of instructions; suspending the simulated execution; constructing a current state record of the CPU emulator; comparing the current state record to state records previously stored in a state-based cache; indicating that no virus is detected when the current state record matches one of the previously stored state records; wherein each state record includes a value of a virtual instruction pointer within the CPU emulator; and wherein each state record includes a byte from a virtual memory address nearby an address corresponding to the value of the virtual instruction pointer.
Claim 9
Dependent Claim
106 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: simulating execution of the computer file by a CPU emulator in a computer memory for a first predetermined number of instructions; suspending the simulated execution; constructing a current state record of the CPU emulator; comparing the current state record to state records previously stored in a state-based cache; indicating that no virus is detected when the current state record matches one of the previously stored state records; and wherein each state record includes a byte from a virtual memory address nearby an address corresponding to a value of a virtual stack pointer.
Claim 10
Dependent Claim
106 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: simulating execution of the computer file by a CPU emulator in a computer memory for a first predetermined number of instructions; suspending the simulated execution; constructing a current state record of the CPU emulator; comparing the current state record to state records previously stored in a state-based cache; indicating that no virus is detected when the current state record matches one of the previously stored state records; and wherein each state record includes a byte from a virtual memory address nearby an address corresponding to a value of a virtual stack pointer.
References Cited (Backward Citations)
US5321840A
Cited
US5144660A
Cited
US4975950A
Cited
US5121345A
Cited
US5319776A
Cited
US5408642A
Cited
US5349655A
Cited
US5421006A
Cited
US5359659A
Cited
US5440723A
Cited
US5452442A
Cited
EP0636977A2
Cited
US5398196A
Cited
US5442699A
Cited
US5485575A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-12-28 | 2002-06-29 | 2002-12-29 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-12-28 | 2006-06-29 | 2006-12-29 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-12-28 | 2010-06-29 | 2010-12-29 | $7700.00 | Window Closed / Lapsed |