Patent ID: 7730530
Filing Date: 2010-06-01
Classification: G06F,H04L

Abstract:
1. A computer system for securely gathering exhibited behaviors of a code module that is to be executed in an environment, the computer system comprising: a memory; an interpreter module that provides a secure virtual environment for executing selected instructions in the code module, the secure virtual environment implementing the functionality of the environment to the extent that a sufficiently realistic virtual environment is created for the code module based on the selected instructions; a behavior recorder module that records calls from the code module to subroutines in the secure virtual environment and records parameter values passed from code module to called subroutines in the secure virtual environment, the recorded calls and recorded parameter values recorded into a behavior signature for the code module, the behavior signature including items representing a behavior that was exhibited by the code module as the behavior was executed and recorded, and at least a unique behavior token and one or more recorded parameter values, the unique behavior token representing an interesting behavior that was recorded; and a stub library module comprising virtual subroutines that simulate corresponding system-supplied subroutines of the environment, at least some virtual subroutines being fully implemented, at least some virtual subroutines not being implemented and, when handled, being ignored, and at least some virtual subroutines, when handled, returning a default return value,