Patent ID: 7900258
Filing Date: 2011-03-01
Classification: G06F

Abstract:
1. A method for identifying presence of malicious code in a target program within a computer system, the method comprising: the computer system virtually executing the target program within a virtual computer so that the target program interacts with the computer system through the virtual computer, the virtual computer comprising (a) software simulating functionality of a central processing unit, an operating system, input/output ports and memory and (b) software simulating functionality of an interpreter and library routines exposed as program interfaces for virtual execution of the target program; the computer system (a) tracking functions performed by the target program during virtual execution, a sequence in which the functions are performed, and information associated with the functions performed by the target program during virtual execution and (b) identifying other functions from a predetermined set that normally accompany the performed functions but are not performed by the target program during virtual execution of the target program; and the computer system determining a of malicious function associated with the target program based upon the tracked functions, the sequence in which the functions are performed, the information associated with the functions performed, and the identified other functions.