Back to results
US 8,151,352 B1Granted
Anti-malware emulation systems and methods
AssigneeBitdefender IPR Managament Ltd.
InventorMihai Novitchi
Life of this patent
Estimating the term…
Loading patent…
Loading patent…
AssigneeBitdefender IPR Managament Ltd.
InventorMihai Novitchi
Estimating the term…
In some embodiments, antivirus/malware behavior-based scanning (emulation) is accelerated by identifying known code sequences and executing pre-stored native-code routines (e.g. decompression, decryption, checksum routines) implementing the functionality of the known code sequences before returning to the emulation. During emulation, target machine code instructions are compared to a set of known signatures. If a known code sequence is identified, the emulator calls a native code routine and caches the current instruction address. If the emulator subsequently reaches a cached address, a native code routine may be called without scanning the data at the address for known signatures. Signature scanning may be performed selectively for instructions following code flow changes (e.g. after jump, call or interrupt instructions). The emulator may also call native-code routines implementing virtual operating system calls, and native-code unpacked file reconstruction routines that reconstruct unpacked files from the contents of virtual memory for scanning by a content-based malware scanner.
A computer-implemented method to detect malware on a computing system, the method comprising:
A computer implemented method to detect malware on a computing system, the method comprising:
A computer implemented method to detect malware on a computing system, the method comprising:
A computer system comprising computer hardware programmed to perform the steps of:
A malware detection computer system comprising computer hardware programmed with computer software, comprising:
A malware detection computer system comprising computer hardware programmed with computer software, comprising:
A non-transitory computer-readable medium encoding instructions which, when executed, cause a computer system to perform the steps of:
A non-transitory computer-readable medium encoding instructions which, when executed, cause a computer system to perform the steps of:
A non-transitory computer-readable medium encoding instructions which, when executed, cause a computer system to perform the steps of:
A computer-implemented method to detect malware on a computing system, the method comprising:
Dependencies are inferred from the claim text.