Scripting virus scan engine

A method for generating a virus signature using a virus scan engine, the method comprising:

• receiving a portion of interpreted language source code containing a computer virus;
• parsing the portion of interpreted language source code into tokens using a parser;
• inputting at least a portion of the tokens into a threadizor;
• generating a language-independent representation of the computer virus from said portion of the tokens using said threadizor, wherein said language independent representation is a linearized string of key actions;
• and
• storing the language-independent representation of the computer virus as a virus signature.

A method for identifying a virus in interpreted language source code using a virus scan engine, the method comprising:

• receiving a portion of interpreted language source code;
• parsing the portion of the interpreted language source code into tokens to generate a tokenized source code using a parser, wherein at least some of the tokens represent key actions;
• extracting selected key actions from the tokenized source code,
• linearizing the key actions to generate an executing thread;
• comparing the executing tread with a virus signature of a known virus in a pattern matcher;
• and
• determining whether the executing thread matches the virus signature.

A method using a virus scan engine for generating a virus signature from a portion of interpreted language source code including a computer virus, the method comprising:

• receiving a portion of interpreted language source code containing a computer virus;
• parsing the portion of the interpreted language source code containing the computer virus into tokens to generate tokenized source code using a parser, wherein at least some of the tokens represent key actions;
• extracting key actions from the tokenized source code,
• linearizing the key actions to generate an executing thread using a threadizor;
• determining the set of minimum key actions in the executing thread required to effect the computer virus;
• and
• storing the set of minimum key actions as a virus signature.

A computer readable medium containing program code for identifying a computer virus in interpreted language source code using a virus scan engine, the computer readable medium comprising instructions for:

• receiving a portion of interpreted language source code;
• parsing the portion of the interpreted language source code into tokens to generate a tokenized source code using a parser, wherein at least some of the tokens represent key actions;
• linearizing at least a portion of the key actions to generate an executing thread;
• comparing the executing thread with a virus signature of a known computer virus in a pattern matcher;
• and
• determining whether the executing head matches the virus signature.

A computer readable medium containing program code using a virus scan engine for generating a virus signature from a portion of interpreted language source code including a computer virus, the computer readable medium comprising instructions for:

• receiving a portion of interpreted language source code containing a computer virus;
• parsing the portion of the interpreted language source code containing the computer virus into tokens to generate tokenized source code using a parser, wherein at least some of the tokens represent key actions;
• linearizing at least a portion of the key actions to generate an executing thread using a threadizor;
• determining the set of minimum key actions in the executing had required to effect the computer virus;
• and
• storing the set of minimum key actions as a virus signature.