Back to results
US 11,080,400 B2Granted
Analyzing multiple CPU architecture malware samples
AssigneePalo Alto Networks, Inc.
InventorsZihang Xiao, Cong Zheng, ChienHua Lu
Life of this patent
Estimating the term…
Abstract
A sample is received for analysis by a virtualized environment. A determination is made that the sample was compiled for a CPU architecture that is different from a host CPU architecture. The sample is executed in an emulated user space corresponding to the CPU architecture for which the sample was compiled.
Claims23
A system, comprising:
- a processor configured to:
- receive a first sample for analysis;
- receive a second sample for analysis;
- determine that the first sample was compiled for a CPU architecture that is different from a host CPU architecture;
- execute the first sample in an emulated user space corresponding to the CPU architecture for which the first sample was compiled, wherein the emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture;
- and
- at a time at least partially overlapping a time during which the first sample is being executed, execute the second sample in a second emulated user space corresponding to a CPU architecture that is different from the CPU architecture for which the first sample was compiled;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
6 more elements
A method, comprising:
- receiving a first sample for analysis;
- receiving a second sample for analysis;
- determining that the first sample was compiled for a CPU architecture that is different from a host CPU architecture;
- executing the first sample in an emulated user space corresponding to the CPU architecture for which the first sample was compiled, wherein the emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture;
- and
- at a time at least partially overlapping a time during which the first sample is being executed, executing the second sample in a second emulated user space corresponding to a CPU architecture that is different from the CPU architecture for which the first sample was compiled.
3 more elements
A computer program product embodied in a tangible, non-transitory computer readable storage medium and comprising computer instructions for:
- receiving a first sample for analysis;
- receiving a second sample for analysis;
- determining that the first sample was compiled for a CPU architecture that is different from a host CPU architecture;
- executing the first sample in an emulated user space corresponding to the CPU architecture for which the first sample was compiled, wherein the emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture;
- and
- at a time at least partially overlapping a time during which the first sample is being executed, executing the second sample in a second emulated user space corresponding to a CPU architecture that is different from the CPU architecture for which the first sample was compiled.
3 more elements
Dependencies are inferred from the claim text.