Detection of polymorphic virus code using dataflow analysis

A method of detecting polymorphic viral code, comprising:

• emulating a first predetermined number of instructions of a computer program;
• detecting at least one unused or misused operand or operator of the first predetermined number of instructions, wherein detecting at least one unused or misused operand or operator comprises identifying at least one undefined operand or operator used during emulation of the first predetermined number of instructions;
• collecting information after emulating at least one instruction, wherein at least a portion of the collected information corresponds to a plurality of registers and/or flags and to the at least one detected unused or misused operand or operator;
• and
• determining a probability that the computer program contains polymorphic viral code based at least in part on an heuristic analysis of the collected information.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for detecting polymorphic viral code in a subject computer program, the method comprising:

• emulating a selected number of instructions of the computer program;
• detecting at least one unused or misused operand or operator of the selected number of instructions, wherein detecting at least one unused or misused operand or operator comprises identifying at least one operand or operator that is not used during emulation of the selected number of instructions;
• collecting information after emulating at least one instruction, wherein at least a portion of the collected information corresponds to a plurality of registers and/or flags and to the at least one detected unused or misused operand or operator;
• and
• determining a probability that the computer program contains polymorphic viral code based at least in part on an heuristic analysis of the collected information.

A system for detecting polymorphic viral code, comprising:

• a processor;
• and
• a program storage device readable by the system, tangibly embodying a program of instructions executable by the processor to perform a method for detecting a polymorphic viral code in a computer program, the method comprising:
• emulating a selected number of instructions of the computer program;
• detecting at least one unused or misused operand or operator of the selected number of instructions, wherein detecting at least one unused or misused operand or operator comprises identifying at least one undefined operand or operator used during emulation of the selected number of instructions;
• collecting and storing information after emulating at least one instruction, wherein at least a portion of the collected information corresponds to a plurality of registers and/or flags and to the at least one detected unused or misused operand or operator;
• and
• determining a probability that the computer program contains polymorphic viral code based at least in part on an heuristic analysis of the collected information.

A computer data signal embodied in a transmission medium, the computer data signal embodying instructions executable by a computer to detect polymorphic viral code in a computer program the computer data signal comprising:

• a first segment including emulator code to emulate a selected number of instructions of the computer program;
• a second segment including detection code to detect at least one unused or misused operand or operator of the selected number of instructions, wherein detecting at least one unused or misused operand or operator comprises identifying at least one operand or operator that is not used during emulation of the selected number of instructions;
• a third segment including analyzer code to analyze a plurality of registers and/or flags accessed during emulation of at least one instruction;
• and
• a fourth segment including heuristic processor code to determine a probability that the computer program contains polymorphic viral code based at least in part on an heuristic analysis of the plurality of registers and/or flags and the at least one detected unused or misused operand or operator.

An apparatus for detecting polymorphic viral code, comprising:

• an emulator operable to emulate a first predetermined number of instructions of a computer program;
• an operational code analyzer operable to:
• detect at least one unused or misused operand or operator of the first predetermined number of instructions, wherein detecting at least one unused or misused operand or operator comprises identifying at least one undefined operand or operator used during emulation of the first predetermined number of instructions;
• and
• analyze a plurality of registers and/or flags accessed during emulation of at least one instruction;
• and
• an heuristic analyzer operable to determine a probability that the computer program contains polymorphic viral code based at least in part on an heuristic analysis of the plurality of registers and/or flags and the at least one detected unused or misused operand or operator.

An apparatus for detecting polymorphic viral code, comprising:

• an emulator operable to emulate a first predetermined number of instructions of a computer program;
• an operational code analyzer operable to:
• detect at least one unused or misused operand or operator of the first predetermined number of instructions, wherein detecting at least one unused or misused operand or operator comprises identifying at least one operand or operator that is not used during emulation of the first predetermined number of instructions;
• and
• analyze a plurality of registers and/or flags accessed during emulation of at least one instruction;
• and
• an heuristic analyzer operable to determine a probability that the computer program contains polymorphic viral code based at least in part on an heuristic analysis of the plurality of registers and/or flags and the at least one detected unused or misused operand or operator.