Patent ID: 7861300
Filing Date: 2010-12-28
Classification: G06F

Abstract:
1. A method, comprising: executing, by a first computer system, a program suspected of containing an undesirable software entity exhibiting non-replicative behavior in at least one controlled environment, where executing the program comprises infecting a plurality of goat files, selecting an infected goat file deemed to be most effective for soliciting side effects generations based on at least one criterion, and executing the selected infected goat file; automatically examining, by a second computer system, the at least one controlled environment to detect if a change has occurred in the environment as a result of the execution of the program and, if a change is detected, automatically analyzing the detected change to determine if the change resulted from normal execution of the program or from execution of the undesirable software entity, where normal execution of the program comprises execution of the program when the program does not contain the undesirable software entity, where automatically examining the at least one controlled environment comprises comparing a first system state that results from the execution of the selected infected goat file with a second system state that results from the execution of a non-infected version of the selected goat file; and using, by a third computer system, a result of the analysis for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the changes that have been observed to result from the execution of the undesired software entity, where if the step of infecting a plurality of goat files is unsuccessful the step of executing the program executes the program and a generically repaired version of the program, and the step of automatically examining the at least one controlled environment comprises comparing a third system state that results from the execution of the program with a fourth system state that results from the execution of the generically repaired version of the program.