Dynamic heuristic method for detecting computer viruses using decryption exploration and evaluation phases
AssigneeSymantec Corporation
InventorCarey S. Nachenberg
Life of this patent
Estimating the term…
Abstract
A method for detecting computer viruses comprising three phases: a decryption phase, an exploration phase, and an evaluation phase. A purpose of the decryption phase is to emulate a sufficient number of instructions to allow an encrypted virus to decrypt its viral body. A purpose of the exploration phase is to emulate at least once all sections of code within a region deemed likely to contain any virus present in the target program. A purpose of the evaluation phase is to analyze any suspicious behavior observed during the decryption and exploration phases to determine whether the target appears to be infected.
Claims31
A method for detecting a virus in a digital file, the method comprising the steps of:
- determining at least one region of the digital file in which the virus is likely to be present;
- emulating code within only the at least one region in order to fully explore the at least one region for the virus during an exploration phase;
- pointing to an instruction to be emulated from a section of code;
- determining whether during the exploration phase the instruction to be emulated has already been emulated;
- and
- if the instruction to be emulated has already been emulated during the exploration phase, then not emulating the instruction to be emulated.
A method for detecting a computer virus in a target program, the method comprising:
- a first emulation of instructions of the target program to allow the computer virus to decrypt a viral body;
- a determination of at least one region of the target program in which the decrypted viral body is likely to be present;
- a second emulation of instructions of the at least one region of the target program in which the decrypted viral body is likely to be present;
- and
- an evaluation of suspicious operations observed during the first and the second emulations, to detect the computer virus.
In a computer system, a method for detecting computer viruses in a target program comprising the steps of:
- emulation of instructions of the target program;
- evaluation of operations observed during the emulation, to detect computer viruses;
- and
- stopping the evaluation if an innocent operation is observed and no highly suspicious operation is observed.
A method for detecting a virus in a target program including the step of detecting a presence of an operation comprising a seek to an end-of-file followed by a file write of a jump instruction, wherein the seek determines a size in bytes and the jump instruction covers a similar number of bytes.
Dependencies are inferred from the claim text.