Source: https://patents.google.com/patent/US9652613B1/en
Timestamp: 2019-07-19 22:02:38
Document Index: 42623183

Matched Legal Cases: ['§119', 'Application No. 60', '§119', 'Application No. 60', '§119', 'Application No. 60', '§119', 'Application No. 60', '§119', 'Application No. 60']

US9652613B1 - Virus detection by executing electronic message code in a virtual machine - Google Patents
US9652613B1
US9652613B1 US12/113,010 US11301008A US9652613B1 US 9652613 B1 US9652613 B1 US 9652613B1 US 11301008 A US11301008 A US 11301008A US 9652613 B1 US9652613 B1 US 9652613B1
US12/113,010
2008-04-30 Application filed by Trustwave Holdings Inc filed Critical Trustwave Holdings Inc
2008-07-16 Assigned to AVINTI CORPORATION reassignment AVINTI CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: MARSDEN, WALTER L., GREEN, DAVID E.
2017-05-16 Publication of US9652613B1 publication Critical patent/US9652613B1/en
An intermediary isolation server receives electronic messages and isolates any viral behavior from harming its intended destination. After the intermediary receives an electronic message, it determines that the electronic message has associated executable code, and then identifies the environment in which the electronic message code would be executed if delivered. The intermediary then executes the code by emulating how it would be executed in its ultimate environment. If a viral-like behavior is detected, appropriate action is taken to prevent the execution of the code at its intended destination. The attachment is executed in a contained environment that allows for the contained environment to be easily restarted in a clean state.
The present application is a continuation-in-part of U.S. patent application Ser. No. 11/356,570 entitled “Virus Detection by Executing Electronic Message Code in a Virtual Machine,” filed on Feb. 17, 2006, which is a continuation-in-part and claims priority from U.S. patent application Ser. No. 10/299,452, entitled “Virus Detection by Executing E-Mail Code in A Virtual Machine,” filed on Nov. 18, 2002, which claims priority, under 35 U.S.C. §119(e), to U.S. Provisional Application No. 60/349,019, entitled “Isolation Server Email Quarantine System for Email Virus Protection,” filed Jan. 17, 2002; the present application also is a continuation-in part of U.S. patent application Ser. No. 11/012,742 entitled “Virus Detection By Executing Code Associated with a Virtual Machine That Uses Configuration Information to Emulate Destination Environments,” filed on Dec. 15, 2004, which is a continuation-in-part and claims priority from U.S. patent application Ser. No. 10/299,452, entitled “Virus Detection by Executing E-Mail Code in A Virtual Machine,” filed on Nov. 18, 2002, which claims priority, under 35 U.S.C. §119(e), to U.S. Provisional Application No. 60/349,019 entitled “Isolation Server Email Quarantine System for Email Virus Protection,” filed Jan. 17, 2002; U.S. patent application Ser. No. 11/012,742 also claims priority, under 35 U.S.C. §119(e), to U.S. Provisional Application No. 60/529,638 entitled “Software Process of Determining Appropriate Network Client Environment for Use In a Virus Detection System that Executes E-Mail Code in a Virtual Machine,” filed Dec. 15, 2003; the present application also is a continuation-in-part of U.S. patent application Ser. No. 10/933,967 entitled “Virus Detection by Executing Code Associated with Outbound or Intra-Organizational E-Mail Code in a Virtual Machine,” filed on Sep. 3, 2004, which is a continuation-in-part and claims priority from U.S. patent application Ser. No. 10/299,452, entitled “Virus Detection by Executing E-Mail Code in A Virtual Machine,” filed on Nov. 18, 2002, which claims priority, under 35 U.S.C. §119(e), to U.S. Provisional Application No. 60/349,019, entitled “Isolation Server Email Quarantine System for Email Virus Protection,” filed Jan. 17, 2002; U.S. patent application Ser. No. 10/933,967 also claims priority, under 35 U.S.C. §119 (e), to U.S. Provisional Application No. 60/499,589 entitled “Analyzing and Isolating Outbound Network Traffic” filed on Sep. 3, 2003, all of which are incorporated by reference herein in their entirety.
One of the advantages of e-mail, for example, is that it allows for the delivery of text messages with attachments. The attachments may be of almost any type, even executable types such as “.dll” or “.exe” files or script files such as Javascript or VB script. When one selects an executable attachment, the attachment is typically executed. Executable code may also be embedded within the e-mail so as to be executed simply by opening the e-mail. For example, a-mails may now be in HyperText Markup Language (HTML) format, which permits script language to be executed when the HTML e-mail is simply opened.
The step 210 then includes a corresponding act of determining whether the act of executing results in any of one or more viral-like actions to occur in the emulated environment. (act 214). Such potential viral actions may include any behavior which contributes towards the unnecessary and disproportionate use of processor, memory, or network connection resources, which accesses system resources without authorization, which replicates itself or a derivative of itself, which automatically causes the electronic message and/or the associated code (or a derivative thereof) to be sent to other computing systems, which executes disk reads or writes, which accesses the system registry, which accesses any address list, and/or which alters any part of the physical or logical system. An emulation architecture that detects such viral behavior is illustrated in FIG. 4 as emulated environment 400.
1. A method for detecting whether executable code associated with electronic messages is harmful, the method comprising:
detecting that an electronic message includes executable code, the electronic message designating a destination email address;
identifying, for the electronic message, by executing an instruction with a processor, two or more destination computing systems corresponding to the destination email address specified in the electronic message prior to delivery of the electronic message to the two or more destination computing systems, the two or more destination computing systems including a first destination computing system and a second destination computing system different from the first destination computing system;
selecting, by executing an instruction with the processor, a first simulation environment among a plurality of simulation environments based on a first environment of the first destination computing system;
selecting, by executing an instruction with the processor, a second simulation environment among the plurality of simulation environments based on a second environment of the second destination computing system, the second simulation environment different from the first simulation environment;
executing the executable code in the first simulation environment and the second simulation environment;
determining, by executing an instruction with the processor, whether the executable code is harmful in at least one of the two or more destination computing systems by monitoring for a viral action in response to execution of the executable code in the first simulation environment and the second simulation environment; and
delivering the electronic message to the destination email address if the executable code is not harmful in the at least one of the two or more destination computing systems.
2. The method of claim 1, further including flagging the electronic message as having viral executable code when the viral action is detected in the at least one of the two or more destination computing systems.
restricting future electronic message deliveries from the sender when the viral action is detected in the at least one of the two or more destination computing systems.
4. The method of claim 1, further including notifying a receiving user that the electronic message may be harmful, the notifying occurring when the viral action is detected in the at least one of the two or more destination computing systems.
5. The method of claim 1, further including notifying a system administrator that the electronic message may be harmful, the notifying occurring when the viral action is detected in the at least one of the two or more destination computing systems.
8. The method of claim 1, wherein the destination email address is a first destination email address, and further including:
detecting a second electronic message that includes second executable code, the second electronic message designating a second destination email address;
identifying a third environment of a third destination computing system associated with the second destination email address;
selecting a third simulation environment that simulates the third environment of the third destination computing system;
executing the second executable code in the third simulation environment; and
monitoring for the viral action in response to execution of the second executable code in the third simulation environment.
determining an operating system running on the first environment of the first destination computing system;
accessing configuration information associated with the first environment of the first destination computing system, the accessed configuration information describing a characteristic of the first environment of the first destination computing system; and
selecting the first simulation environment based on the operating system running on the first environment of the first destination computing system and based on the configuration information associated with the first environment of the first destination computing system.
identifying client software installed on the first destination computing system; and
selecting the first simulation environment where software representative of the client software is installed.
accessing configuration information associated with the client software installed on the first destination computing system; and
configuring the software representative of the client software using the configuration information.
12. The method of claim 1, wherein the viral action includes at least one of accessing an address book, modifying a file, or reading a file.
13. The method of claim 1, wherein the viral action includes modifying sector zero of a storage disc or storage device.
14. The method as described in claim 1, wherein the first simulation environment represents a program to be executed by the first destination computing system.
15. A tangible computer-readable storage disc or storage device comprising instructions which, when executed, cause a machine to at least:
detect that an electronic message designates destination email address and includes executable code;
identify, for the electronic message, two or more destination computing systems corresponding to the destination email address specified in the electronic message prior to delivery of the electronic message to the two or more destination computing systems, the two or more destination computing systems including a first destination computing system and a second destination computing system different from the first destination computing system;
select a first simulation environment among a plurality of simulation environments based on a first environment of the first destination computing system;
select a second simulation environment among the plurality of simulation environments based on a second environment of the second destination computing system, the second simulation environment being different from the first simulation environment;
execute the executable code in the first simulation environment and the second simulation environment; and
determine whether the executable code is harmful in at least one of the two or more destination computing systems by monitoring for a viral action in response to execution of the executable code in the first simulation environment and the second simulation environment; and
deliver the electronic message to the destination email address if the executable code is not harmful in the at least one of the two or more destination computing systems.
16. The tangible computer-readable storage disc or storage device of claim 15, wherein the instructions, when executed, cause the machine to flag the electronic message as having viral code.
17. The tangible computer-readable storage disc or storage device of claim 15, wherein the instructions, when executed, cause the machine to at least:
restrict future electronic message deliveries from the sender.
18. The tangible computer-readable storage disc or storage device of claim 15, wherein the instructions, when executed, cause the machine to notify the destination email address or a system administrator that the electronic message may be harmful.
19. The tangible computer-readable storage disc or storage device of claim 15, wherein the destination email address is a first destination email address, and wherein the instructions, when executed, cause the machine to at least:
detect a second electronic message that includes a second executable code, the second electronic message designating a second destination email address;
identify a third environment of a third destination computing system associated with the second destination email address;
select a third simulation environment that simulates the third environment of the third destination computing system;
execute the second executable code in the third simulation environment; and
monitor for a viral action in response to execution of the second executable code in the third simulation environment.
US12/113,010 2002-01-17 2008-04-30 Virus detection by executing electronic message code in a virtual machine Active 2026-10-14 US9652613B1 (en)
US15/595,001 Continuation US10121005B2 (en) 2002-01-17 2017-05-15 Virus detection by executing electronic message code in a virtual machine
US9652613B1 true US9652613B1 (en) 2017-05-16
NPL19 United States Patent and Trademark Office, "Office action", issued in connection with U.S. Appl. No. 12/130,634, Dated Nov. 30, 2011, (15 pages).
NPL20 United States Patent and Trademark Office, "Office action", issued in connection with U.S. Appl. No. 12/130,634, Dated Apr. 12, 2011, (14 pages).
Strom, David, Web Informant #276, Dec. 24, 2001: Solutions to getting email on two computers, Dec. 24, 2001, David Strom, Inc., pp. 1-3, downloaded from http://strom.com/awards/276.html on Nov. 18, 2015. *
United States Patent and Trademark Office, "Notice of Allowance", issued in connection with U.S. Appl. No. 12/130,609, Dated Mar. 19, 2012 , (17 pages).
US10121005B2 (en) 2018-11-06
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MARSDEN, WALTER L.;GREEN, DAVID E.;SIGNING DATES FROM 20080710 TO 20080712;REEL/FRAME:021248/0023