# US 7,614,084 B2 · System and method for detecting multi-component malware > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,614,084 B2 - Document ID: US7614084B2 - Status: Granted - Kind: B2 - Application number: 11/865,808 - Filed: 2007-10-02 - Published: 2009-04-02 - Granted: 2009-11-03 - Earliest claimed: 2007-10-02 - Assignees: Kaspersky Lab ZAO - Inventors: Alexey V. Monastyrsky; Andrey V. Sobko; Mikhail A. Pavlyushchik - Web page: https://patentgrep.com/patent/US7614084B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Malicious behavior of a computer program is detected using an emulation engine, an event detector and an event analyzer. The emulation engine includes a system emulator configured to emulate, in an isolated computer environment, at least a part of a computer system and a program emulator configured to emulate in the isolated computer environment execution of the computer program, including execution of a plurality of executable components of the computer program, such as execution processes and threads. The event detector is configured to monitor events being generated by two or more of the executable components. The event analyzer is configured to determine, substantially in real time, based at least on one or more events generated by each of two or more of the plurality of executable components whether or not the computer program exhibits malicious behavior, wherein individually one or more of the plurality of executable components may exhibit benign behavior. ## Claims ### Claim 1 A method for detecting malicious program behavior, the method comprising: emulating at least a part of a computer program in an isolated computing environment, detecting events being generated by one or more executable components of the emulated computer program; determining, substantially in real time, whether one or more detected events are associated with a malicious program behavior; storing in a data structure only detected events associated with the malicious program behavior; and comparing events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program. ### Claim 2 (depends on 1) The method of claim 1, wherein individually one or more executable components of a malicious computer program exhibit benign behavior. ### Claim 3 (depends on 2) The method of claim 2, further comprising continuing emulation of the computer program even when one or more executable components are terminated. ### Claim 4 (depends on 3) The method of claim 3, wherein detecting an event generated by an executable component of the computer program includes detecting at least one of one or more program's system calls and one or more system responses to the program's system calls. ### Claim 5 (depends on 4) The method of claim 4, wherein emulating an executable component includes one or more of emulating a main process of the computer program; emulating one or more child processes of the computer program; emulating one or more threads of the computer program; and emulating one or more remote threads of the computer program. ### Claim 6 (depends on 5) The method of claim 5, wherein emulating two or more executable components of the computer program includes one or more of emulating at least two or more executable components sequentially and emulating at least two or more executable components in parallel. ### Claim 7 (depends on 1) The method of claim 1, wherein the isolated computing environment includes at least a part of a virtual multitasking computer system. ### Claim 8 A system for detecting malicious program behavior, the system comprising: a system memory; and a processor operably coupled to the system memory and configured to emulate in the system memory at least a part of a computer program; detect events being generated by one or more executable components of the emulated computer program; determine, substantially in real time, whether one or more detected events are associated with a malicious program behavior; store in a data structure in the system memory only detected events associated with the malicious program behavior; and compare events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program. ### Claim 9 (depends on 8) The system of claim 8, wherein individually one or more executable components of a malicious computer program exhibit benign behavior. ### Claim 10 (depends on 9) The system of claim 9, wherein the processor is further configured to continue emulating the computer program even when one or more executable components are terminated. ### Claim 11 (depends on 10) The system of claim 10, wherein the processor is further configured to detect at least one of one or more program's system calls and one or more system responses to the program's system calls. ### Claim 12 (depends on 11) The system of claim 11, wherein an executable component includes one or more of a main process of the computer program; one or more child processes of the computer program; one or more threads of the computer program; and one or more remote threads of the computer program. ### Claim 13 (depends on 12) The system of claim 12, wherein emulation of two or more executable components of the computer program includes emulation of at least two or more executable components sequentially and emulation of at least two or more executable components in parallel. ### Claim 14 (depends on 8) The system of claim 8, wherein the processor is operable to emulate at least a part of the computer program in a virtual multitasking computer system. ### Claim 15 A computer-readable medium comprising computer-executable instructions for detecting malicious program behavior, the computer-executable instructions include: instructions for emulating at least a part of a computer program in an isolated computing environment, instructions for detecting events being generated by one or more executable components of the emulated computer program; instructions for determining, substantially in real time, whether one or more detected events are associated with a malicious program behavior; instructions for storing in a data structure only detected events associated with the malicious program behavior; and instructions for comparing events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program. ### Claim 16 (depends on 15) The computer-readable medium of claim 15, wherein individually one or more executable components of a malicious computer program exhibit benign behavior. ### Claim 17 (depends on 16) The computer-readable medium of claim 16, further including instructions for continuing emulating the computer program even when emulation of one or more executable components is terminated. ### Claim 18 (depends on 17) The computer-readable medium of claim 17, wherein detecting an event generated by an executable component of the computer program includes detecting at least one of one or more program's system calls and one or more system responses to the program's system calls. ### Claim 19 (depends on 18) The computer-readable medium of claim 18, wherein instructions for emulating two or more executable components include instructions for emulating two or more executable components sequentially and instructions for emulating two or more executable components in parallel. ### Claim 20 (depends on 15) The computer readable medium of claim 15, wherein the isolated computing environment includes at least a part of a virtual multitasking computer system.