System and method for detection of malicious code by iterative emulation of microcode
AssigneeLeviathan Security Group, Inc.
InventorsMikhail Davidov, Patrick Stach
Life of this patent
Estimating the term…
Abstract
Examples of systems, methods and media are shown for iteratively emulating potentially malicious code involving, for each offset of a microarchitecture for the code, emulating a first ring of an operating system, executing a segment of code in the emulated first ring, checking the behavior of the executing code for suspect behavior, and identifying the executing code as malicious code if suspect behavior is detected. Some examples include emulating a second ring of the operating system having a higher level of privilege than the first ring, such that the second ring emulation returns results to the executing code segment, but does not actually perform the functionality in a host platform.
Claims20
A method for iteratively emulating potentially malicious code, the method comprising the steps of:
- for each offset of a microarchitecture for the code:
- emulating a first ring of an operating system;
- executing a segment of code in the emulated first ring;
- checking the behavior of the executing code for suspect behavior;
- and
- identifying the executing code as malicious code if suspect behavior is detected.
A system for iteratively emulating potentially malicious code, the system comprising:
- one or more processors;
- and
- at least one non-transitory computer storage medium having computer executable instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to:
- emulate a first ring of an operating system for each offset of a microarchitecture for the code;
- execute a segment of code in the emulated first ring;
- check the behavior of the executing code for suspect behavior;
- and
- identify the executing code as malicious code if suspect behavior is detected.
A non-transitory computer readable medium storing computer code configured to a cause a processing device to operate to iteratively emulate potentially malicious code, the computer code including instructions that configure the processing device to:
- for each offset of a microarchitecture for the code:
- emulate a first ring of an operating system;
- execute a segment of code in the emulated first ring;
- check the behavior of the executing code for suspect behavior;
- and
- identify the executing code as malicious code if suspect behavior is detected.
Dependencies are inferred from the claim text.