Patent ID: 8826245
Filing Date: 2014-09-02
Classification: G06F

Abstract:
1. A method for optimizing emulation of a suspected malware program, the method comprising the steps of: a computer identifying a first instruction in the suspected malware program that initiates a loop, and in response, the computer determining a length of the loop based at least in part on a number of times that the loop will be repeated, and if the length exceeds a predetermined threshold, generating a first hash value based at least in part on a hash of instructions in the loop; the computer identifying a second, subsequent instruction in the suspected malware program that initiates a loop, and in response, the computer determining a length of the loop initiated by the second instruction, based at least in part on a number of times that the loop initiated by the second instruction will be repeated, and if the length exceeds a predetermined threshold, generating a second hash value based at least in part on a hash of instructions within the loop initiated by the second instruction; and if the second hash value matches the first hash value, the computer bypassing the loop initiated by the second instruction, and if the second hash value does not match the first hash value, the computer executing the loop initiated by the second instruction.