# US 10,121,005 B2 · Virus detection by executing electronic message code in a virtual machine

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,121,005 B2
- Document ID: US10121005B2
- Status: Granted
- Kind: B2
- Application number: 15/595,001
- Filed: 2017-05-15
- Published: 2017-08-31
- Granted: 2018-11-06
- Earliest claimed: 2002-01-17
- Assignees: Trustwave Holdings, Inc.
- Applicants: Trustwave Holdings, Inc.
- Inventors: Walter L. Marsden; David L. Green
- Web page: https://patentgrep.com/patent/US10121005B2

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/567: {using dedicated hardware}
- G06F 2221/033: Test or assess software
- G06F 2221/2149: Restricted operating environment
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Virus detection by executing electronic message code in a virtual machine is disclosed. An example method includes detecting that an electronic message includes executable code, the electronic message designating a destination recipient. Two or more destination computing systems are identified for the electronic message corresponding to the destination recipient specified in the electronic message prior to delivery of the electronic message to the two or more destination computing systems, the two or more destination computing systems including a first destination computing system and a second destination computing system different from the first destination computing system. Two or more simulation environments corresponding to the two or more destination computing systems are identified. The executable code is executed in the two or more simulation environments. The two or more simulation environments are monitored for a malicious action. The electronic message is delivered to the destination recipient if the action is detected.

## Claims

### Claim 1

A method for analyzing executable code associated with electronic messages, the method comprising:
detecting that an electronic message includes executable code, the electronic message designating a destination recipient;
identifying, for the electronic message, by executing an instruction with a processor, two or more destination computing systems corresponding to the destination recipient specified in the electronic message prior to delivery of the electronic message to the two or more destination computing systems, the two or more destination computing systems including a first destination computing system and a second destination computing system different from the first destination computing system;
identifying two or more different simulation environments respectively corresponding to the two or more destination computing systems;
executing the executable code in the two or more simulation environments;
monitoring, by executing an instruction with the processor, for a malicious action in response to execution of the executable code in the two or more simulation environments; and
delivering the electronic message to the destination recipient if the malicious action is not detected.

### Claim 2 (depends on 1)

The method of claim 1, further including flagging the electronic message as having malicious executable code when the action is detected.

### Claim 3 (depends on 1)

The method of claim 1, further including:
determining a sender of the electronic message; and
restricting future electronic message deliveries from the sender when the malicious action is detected.

### Claim 4 (depends on 1)

The method of claim 1, further including notifying a receiving user that the electronic message may be harmful, the notifying occurring when the malicious action is detected.

### Claim 5 (depends on 1)

The method of claim 1, further including notifying a system administrator that the electronic message may be harmful, the notifying occurring when the malicious action is detected.

### Claim 6 (depends on 1)

The method of claim 1, wherein the executable code is an attachment of the electronic message.

### Claim 7 (depends on 1)

The method of claim 1, wherein the executable code is embedded within a body of the electronic message.

### Claim 8 (depends on 1)

The method of claim 1, wherein the malicious action includes at least one of accessing a recipient book, modifying a file, or reading a file.

### Claim 9 (depends on 1)

The method of claim 1, wherein the malicious action includes modifying sector zero of a storage disc or storage device.

### Claim 10

A tangible machine readable hardware storage disk or storage device comprising instructions which, when executed, cause a machine to at least:
detect that an electronic message includes executable code, the electronic message designating a destination recipient;
identify, for the electronic message, two or more destination computing systems corresponding to the destination recipient specified in the electronic message prior to delivery of the electronic message to the two or more destination computing systems, the two or more destination computing systems including a first destination computing system and a second destination computing system different from the first destination computing system;
identify two or more different simulation environments corresponding respectively to the two or more destination computing systems;
execute the executable code in the two or more simulation environments;
monitor for a malicious action in response to execution of the executable code in the two or more simulation environments; and
deliver the electronic message to the destination recipient if the malicious action is not detected.

### Claim 11 (depends on 10)

The tangible machine readable hardware storage disk or storage device of claim 10, wherein the instructions, when executed, further cause the machine to flag the electronic message as having malicious executable code when the malicious action is detected.

### Claim 12 (depends on 10)

The tangible machine readable hardware storage disk or storage device of claim 10, wherein the instructions, when executed, further cause the machine to at least:
determine a sender of the electronic message; and
restrict future electronic message deliveries from the sender when the malicious action is detected.

### Claim 13 (depends on 10)

The tangible machine readable hardware storage disk or storage device of claim 10, wherein the instructions, when executed, further cause the machine to notify a receiving user that the electronic message may be harmful, the notifying occurring when the malicious action is detected.

### Claim 14 (depends on 10)

The tangible machine readable hardware storage disk or storage device of claim 10, wherein the instructions, when executed, further cause the machine to notify a system administrator that the electronic message may be harmful, the notifying occurring when the malicious action is detected.

### Claim 15 (depends on 10)

The tangible machine readable hardware storage disk or storage device of claim 10, wherein the executable code is an attachment of the electronic message.

### Claim 16 (depends on 10)

The tangible machine readable hardware storage disk or storage device of claim 10, wherein the executable code is embedded within a body of the electronic message.