# US 2020/0401698 A1 · Analysis system, analysis method, analysis device, and storage medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401698 A1 - Document ID: US20200401698A1 - Status: Published application - Kind: A1 - Application number: 16/990,319 - Filed: 2020-08-11 - Published: 2020-12-24 - Earliest claimed: 2015-06-16 - Assignees: NEC Corporation - Applicants: NEC Corporation - Inventors: Masaru KAWAKITA - Web page: https://patentgrep.com/patent/US20200401698A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 9/44505: {Configuring for program initiating, e.g. using registry, configuration files} - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Provided is an analysis system including: an operation analysis unit that analyzes operation of an analysis target program that is a target program to be analyzed, by executing the analysis target program in a second execution environment that is a computing environment for analysis, the second execution environment being configured to emulate at least a partial configuration of a first execution environment that is a computing environment for real operation where the analysis target program is able to be executed; and a configuration unit that builds the second execution environment capable of emulating a specific configuration of the first execution environment, the specific configuration relevant to an operation of the analysis target program, by modifying at least a partial configuration of the second execution environment in accordance with the operation of the analysis target program analyzed by the operation analysis unit. ## Claims ### Claim at position 1 -17. (canceled) ### Claim 18 A method comprising: executing a program in an execution environment, detecting an operation performed by the program to identify the execution environment, and performing a reaction based on the operation being detected, wherein information associating the operation and the reaction is stored in a memory. ### Claim 19 (depends on 18) The method according to claim 18, wherein, the operation comprises accessing an internal network, and the reaction comprises virtually building the internal network. ### Claim 20 (depends on 18) The method according to claim 18, wherein, the operation comprises accessing an external network, and the reaction comprises allowing access to the external network via TOR. ### Claim 21 (depends on 18) The method according to claim 18, wherein, the operation comprises accessing an I/O port, and the reaction comprises concealing a specific I/O port. ### Claim 22 (depends on 18) The method according to claim 18, wherein, the execution environment is provided by a virtual machine configured to emulate a real operating environment and to analyze the program, the program is malware, and the reaction comprises emulating the real operating environment. ### Claim 23 (depends on 22) The method according to claim 22, wherein, the operation comprises accessing a folder, and the reaction comprises creating a folder structure in the virtual machine similar to a folder structure in the real operating environment. ### Claim 24 (depends on 18) The method according to claim 18, wherein, the execution environment is provided by a virtual machine configured to emulate a real operating environment and to analyze the program, the program is malware, and the reaction comprises deceiving the program by emulating the real operating environment. ### Claim 25 (depends on 18) The method according to claim 18, further comprising storing the information associating the operation and the reaction in the memory. ### Claim 26 An analysis device comprising: a memory storing instructions; and one or more processors configured to execute the instructions to: execute a program in an execution environment, detect an operation performed by the program to identify the execution environment, and perform a reaction based on the operation being detected, wherein information associating the operation and the reaction is stored in the memory. ### Claim 27 (depends on 26) The analysis device according to claim 26, wherein, the operation comprises accessing an internal network, and the reaction comprises virtually building the internal network. ### Claim 28 (depends on 26) The analysis device according to claim 26, wherein, the operation comprises accessing an external network, and the reaction comprises allowing access to the external network via TOR. ### Claim 29 (depends on 26) The analysis device according to claim 26, wherein, the operation comprises accessing an I/O port, and the reaction comprises concealing a specific I/O port. ### Claim 30 (depends on 26) The analysis device according to claim 26, wherein, the execution environment is provided by a virtual machine configured to emulate a real operating environment and to analyze the program, the program is malware, and the reaction comprises emulating the real operating environment. ### Claim 31 (depends on 30) The analysis device according to claim 30, wherein, the operation comprises accessing a folder, and the reaction comprises creating a folder structure in the virtual machine similar to a folder structure in the real operating environment. ### Claim 32 (depends on 26) The analysis device according to claim 26, wherein, the execution environment is provided by a virtual machine configured to emulate a real operating environment and to analyze the program, the program is malware, and the reaction comprises deceiving the program by emulating the real operating environment. ### Claim 33 (depends on 26) The analysis device according to claim 26, wherein the one or more processors are further configured to execute the instructions to store the information associating the operation and the reaction in the memory. ### Claim 34 A non-transitory computer-readable recording medium having recorded thereon instructions for executing a method, the method comprising: executing a program in an execution environment, detecting an operation performed by the program to identify the execution environment, and performing a reaction based on the operation being detected, wherein information associating the operation and the reaction is stored in the non-transitory computer-readable medium.