US 2006/0143707 A1 · Detecting method and architecture thereof for malicious codes

Abstract

A detecting method and architecture thereof for malicious codes is provided, which is applicable to a computer system having at least a host. Each host executes at least a process. The method is implemented with a system call interposition module and an analysis module for malicious codes. The system call module intercepts all system calls of process calls and all related arguments of the system calls. The analysis module for malicious codes analyzes the input data of pre-determined system calls, and executes the suspicious malicious codes. Once the same behaviors between the analysis module and the suspicious malicious codes are found, a system-intrusion warning is immediately triggered. The method is not required to maintain huge signature databases, and can detect unknown attack-skills in a manner of high correct rate and low incorrect ruling.

Claims20

Dependent claims

A detection method of malicious codes, applicable to a computer system, said computer system having at least a host, each said host executing at least an application program, and each said application program comprising at least a process;

said method comprising the steps of:
(a) intercepting all the system calls and related arguments from all said processes by a pre-installed system call monitor module on each said host;
(b) extracting a plurality of pre-defined system calls from all the intercepted system calls by a malicious code analysis module;
(c) determining whether said intercepted pre-defined system calls, arguments, and input data flow being suspicious of including malicious codes;
if not, returning to step (a);
(d) executing said suspicious malicious code and generating a behavior prediction of the suspicious malicious code;
(e) comparing said predicted behavior with the actual behavior of the execution of said suspicious malicious code;
if different, returning to step (a);
and
(f) issuing a warning of intrusion.

7 more elements

Dependencies are inferred from the claim text.

Detecting method and architecture thereof for malicious codes

Life of this patent

Detecting method and architecture thereof for malicious codes

Life of this patent

Abstract

Claims20