Method and apparatus for determination of the non-replicative behavior of a malicious program

Patent 7103913 Issued on September 5, 2006. Estimated Expiration Date:

May 8, 2022. Estimated Expiration Date is calculated based on simple USPTO term provisions. It does not account for terminal disclaimers, term adjustments, failure to pay maintenance fees, or other factors which might affect the term of a patent.

Abstract Claims Description Full Text

Patent References

Automatic immune system for computers and computer networks
Patent #: 5440723
Issued on: 08/08/1995
Inventor: Arnold, et al.

Automatic analysis of a computer virus structure and means of attachment to its hosts
Patent #: 5485575
Issued on: 01/16/1996
Inventor: Chess, et al.

Generic disinfection of programs infected with a computer virus
Patent #: 5613002
Issued on: 03/18/1997
Inventor: Kephart, et al.

System and method for recovering PC configurations
Patent #: 5745669
Issued on: 04/28/1998
Inventor: Hugard, et al.

Polymorphic virus detection module
Patent #: 5826013
Issued on: 10/20/1998
Inventor: Nachenberg

Emulation repair system
Patent #: 6067410
Issued on: 05/23/2000
Inventor: Nachenberg

Automated sample creation of polymorphic and non-polymorphic marcro viruses Patent #: 6108799
Issued on: 08/22/2000
Inventor: Boulay, et al.

Inventors

Application

No. 10141896 filed on 05/08/2002

US Classes:

726/22, MONITORING OR SCANNING OF SOFTWARE OR DATA INCLUDING ATTACK PREVENTION726/23, Intrusion detection726/24, Virus detection726/25, Vulnerability assessment713/188, COMPUTER VIRUS DETECTION BY CRYPTOGRAPHY714/38, Of computer software714/3By masking or reconfiguration

Examiners

Primary: Song, Hosuk
Assistant: To, Baoquoc N.

Attorney, Agent or Firm

International Class

G06F 11/00

Abstract

Disclosed is a method, a computer system and a computer readable media product that contains a set of computer executable software instructions for directing the computer system to execute a process for determining a non-replicative behavior of a program that is suspected of containing an undesirable software entity. The process causes execution of the program in at least one known environment and automatically examines the at least one known environment to detect if a change has occurred in the environment as a result of the execution of the program. If a change is detected, the process automatically analyzes the detected change (i.e., the process performs a side effects analysis) to determine if the change resulted from execution of the program or from execution of the undesirable software entity. The process then uses the result of the analysis at least for undoing a detected change that results from execution of the undesirable software entity. The result of the analysis can also be used for informing a user of an anti-virus system of the non-replicative changes made to the environment.