US 7,925,888 B1 · Data driven detection of viruses

Abstract

A virus detection system (VDS) (400) operates under the control of P-code to detect the presence of a virus in a file (100) having multiple entry points. P-code is an intermediate instruction format that uses primitives to perform certain functions related to the file (100). The VDS (400) executes the P-code, which provides Turing-equivalent capability to the VDS. The VDS (400) has a P-code data file (410) for holding the P-code, a virus definition file (VDF) (412) for holding signatures of known viruses, and an engine (414) for controlling the VDS. The engine (414) contains a P-code interpreter (418) for interpreting the P-code, a scanning module (424) for scanning regions of the file (100) for the virus signatures in the VDF (412), and an emulating module (426) for emulating entry points of the file. When executed, the P-code examines the file (100), posts (514) regions that may be infected by a virus for scanning, and posts (518) entry points that may be infected by a virus for emulating. The P-code can also detect (520) certain viruses algorithmically. Then, the posted regions and entry points of the file (100) are scanned (526) and emulated (534) to determine if the file is infected with a virus. This technique allows the VDS (400) to perform sophisticated analysis of files having multiple entry points in a relatively brief amount of time. In addition, the functionality of the VDS (400) can be changed by changing the P-code, reducing the need for burdensome engine updates.

Claims15

Dependent claims

A virus detection system for detecting if a computer file is infected by a virus, the file having a plurality of potential virus entry points, the system comprising:

a non-transitory computer-readable storage medium storing executable computer program modules comprising:
an engine module adapted to examine the plurality of potential virus entry points and post for emulating ones of the plurality of potential virus entry points exhibiting characteristics indicating a possible virus infection, to post for scanning regions of the file exhibiting characteristics indicating a possible virus infection, and to merge overlapping regions posted for scanning;
an emulating module for emulating the posted entry points of the file in a memory, wherein a virus signature becomes apparent during the emulation of an entry point if the file is infected by the virus;
and
a scanning module for scanning the memory and the posted regions of the file for virus signatures.

2 more elements

Dependencies are inferred from the claim text.

Data driven detection of viruses

Life of this patent

Data driven detection of viruses

Life of this patent

Abstract

Claims15