# US 8,151,352 B1 · Anti-malware emulation systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,151,352 B1 - Document ID: US8151352B1 - Status: Granted - Kind: B1 - Application number: 11/486,803 - Filed: 2006-07-14 - Granted: 2012-04-03 - Earliest claimed: 2006-07-14 - Assignees: Bitdefender IPR Managament Ltd. - Inventors: Mihai Novitchi - Web page: https://patentgrep.com/patent/US8151352B1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 9/45508: {Runtime interpretation or emulation, e g. emulator loops, bytecode interpretation} - G06F 21/564: {by virus signature recognition} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In some embodiments, antivirus/malware behavior-based scanning (emulation) is accelerated by identifying known code sequences and executing pre-stored native-code routines (e.g. decompression, decryption, checksum routines) implementing the functionality of the known code sequences before returning to the emulation. During emulation, target machine code instructions are compared to a set of known signatures. If a known code sequence is identified, the emulator calls a native code routine and caches the current instruction address. If the emulator subsequently reaches a cached address, a native code routine may be called without scanning the data at the address for known signatures. Signature scanning may be performed selectively for instructions following code flow changes (e.g. after jump, call or interrupt instructions). The emulator may also call native-code routines implementing virtual operating system calls, and native-code unpacked file reconstruction routines that reconstruct unpacked files from the contents of virtual memory for scanning by a content-based malware scanner. ## Claims ### Claim 1 A computer-implemented method to detect malware on a computing system, the method comprising: employing a behavior analysis application running on an operating system of the computing system to perform an accelerated emulation of an untrusted computer file by emulating a first code sequence of a plurality of code sequences of the untrusted computer file in a virtual environment; and upon identifying a known code sequence in the untrusted computer file, executing outside the virtual environment a native-code routine functionally implementing the known code sequence, wherein the native-code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; and determining whether the untrusted computer file is malicious according to a result of the accelerated emulation. ### Claim 2 (depends on 1) The method of claim 1, wherein the native-code routine comprises a decompression routine. ### Claim 3 (depends on 1) The method of claim 1, wherein the native-code routine comprises a decryption routine. ### Claim 4 (depends on 1) The method of claim 1, wherein the native-code routine comprises a checksum routine. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining whether a current emulation address is a code flow change target address; selectively performing a code signature database search if the current emulation address is determined to be a code flow change target address, wherein performing the code signature database search comprises searching a code signature database for a match to a content of the current emulation address to determine whether the content of the current emulation address forms part of the known code sequence. ### Claim 6 (depends on 1) The method of claim 1, wherein identifying the known code sequence comprises comparing a hash of a content of a current emulation address to a set of code signature hashes stored in a code signature database. ### Claim 7 (depends on 1) The method of claim 1, wherein identifying the known code sequence comprises determining whether a current emulation virtual memory address is present in a known-code virtual address cache. ### Claim 8 (depends on 1) The method of claim 1, wherein the behavior analysis application comprises a memory-based pattern matching module configured to examine a virtual memory of the virtual environment at a plurality of time points during said emulating the first instruction sequence, for determining whether the untrusted computer file is malicious. ### Claim 9 (depends on 8) The method of claim 8, wherein the behavior analysis application further comprises a virtual machine content inspector module configured to examine a virtual hard drive and a virtual memory of the virtual environment upon completion of the accelerated emulation, for identifying a result of a malicious behavior of the untrusted computer file during the accelerated emulation. ### Claim 10 (depends on 9) The method of claim 9, wherein the behavior analysis application further comprises a file-based pattern matching module configured to examine a virtual hard drive of the virtual environment for malware signatures upon completion of the accelerated emulation. ### Claim 11 (depends on 1) The method of claim 1, wherein the native code routine is identical to the known code sequence. ### Claim 12 (depends on 1) The method of claim 1, wherein the native code routine is different from the known code sequence. ### Claim 13 A computer implemented method to detect malware on a computing system, the method comprising: upon identifying a known code sequence in an untrusted computer file comprising a plurality of code sequences, executing outside a virtual environment a native code routine functionally implementing the known code sequence, wherein the native-code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; employing a result of said executing the native code routine to emulate in the virtual environment a second code sequence of the untrusted computer file; and determining whether the untrusted computer file is malicious according to a result of emulating the second code sequence. ### Claim 14 A computer implemented method to detect malware on a computing system, the method comprising: determining whether a part of a plurality of parts of an untrusted computer file matches a known code signature; and in response to determining whether the part of the untrusted computer file matches the known code signature, when the part matches the known code signature, executing outside the virtual environment a preexisting trusted code routine functionally implementing the part, and when the part does not match the known code signature, emulating the part in a virtual machine, wherein the preexisting trusted code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine. ### Claim 15 A computer system comprising computer hardware programmed to perform the steps of: employing a behavior analysis application running on an operating system of the computer system to perform an accelerated emulation of an untrusted computer file by emulating a first code sequence of a plurality of code sequences of the untrusted computer file in a virtual environment; and upon identifying a known code sequence in the untrusted computer file, executing outside the virtual environment a native-code routine functionally implementing the known code sequence, wherein the native-code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; and determining whether the untrusted computer file is malicious according to a result of the accelerated emulation. ### Claim 16 (depends on 15) The system of claim 15, wherein the native-code routine comprises a decompression routine. ### Claim 17 (depends on 15) The system of claim 15, wherein the native-code routine comprises a decryption routine. ### Claim 18 (depends on 15) The system of claim 15, wherein the native-code routine comprises a checksum routine. ### Claim 19 (depends on 15) The system of claim 15, wherein the system is further programmed to perform the steps of: determining whether a current emulation address is a code flow change target address; selectively performing a code signature database search if the current emulation address is determined to be a code flow change target address, wherein performing the code signature database search comprises searching a code signature database for a match to a content of the current emulation address to determine whether the content of the current emulation address forms part of the known code sequence. ### Claim 20 (depends on 15) The system of claim 15, wherein identifying the known code sequence comprises comparing a hash of a content of a current emulation address to a set of code signature hashes stored in a code signature database. ### Claim 21 (depends on 15) The system of claim 15, wherein identifying the known code sequence comprises determining whether a current emulation virtual memory address is present in a known-code virtual address cache. ### Claim 22 A malware detection computer system comprising computer hardware programmed with computer software, comprising: means for performing an accelerated emulation of an untrusted computer file by emulating a first code sequence of a plurality of code sequences of the untrusted computer file in a virtual environment; and upon identifying a known code sequence in the untrusted computer file, executing outside the virtual environment a native-code routine functionally implementing the known code sequence, wherein the native-code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; and means for determining whether the untrusted computer file is malicious according to a result of the accelerated emulation. ### Claim 23 A malware detection computer system comprising computer hardware programmed with computer software, comprising: an emulator configured to emulate an untrusted computer file comprising a plurality of code sequences in a virtual environment, and to recognize a known code sequence in the untrusted computer file; and a native-code acceleration routine responsive to the emulator and functionally implementing the known code sequence, wherein the native-code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; wherein the emulator calls the native-code acceleration routine upon recognizing the known code sequence, receives a result of an execution of the native-code acceleration routine, and employs the result of the execution to continue an emulation of the untrusted computer file. ### Claim 24 A non-transitory computer-readable medium encoding instructions which, when executed, cause a computer system to perform the steps of: perform an accelerated emulation of an untrusted computer file by emulating a first code sequence of a plurality of code sequences of the untrusted computer file in a virtual environment; and upon identifying a known code sequence in the untrusted computer file, executing outside the virtual environment a native-code routine functionally implementing the known code sequence, wherein the native-code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; and determine whether the untrusted computer file is malicious according to a result of the accelerated emulation. ### Claim 25 A non-transitory computer-readable medium encoding instructions which, when executed, cause a computer system to perform the steps of: upon identifying a known code sequence in an untrusted computer file comprising a plurality of code sequences, executing outside a virtual environment a native code routine functionally implementing the known code sequence, wherein the native-code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; employing a result of said executing the native code routine to emulate in the virtual environment a second code sequence of the untrusted computer file; and determining whether the untrusted computer file is malicious according to a result of emulating the second code sequence. ### Claim 26 A non-transitory computer-readable medium encoding instructions which, when executed, cause a computer system to perform the steps of: determining whether a part of a plurality of parts of an untrusted computer file matches a known code signature; and in response to determining whether the part of the untrusted computer file matches the known code signature, when the part matches the known code signature, executing outside the virtual environment a preexisting trusted code routine functionally implementing the part, and when the part does not match the known code signature, emulating the part in a virtual machine, wherein the trusted code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine. ### Claim 27 A computer-implemented method to detect malware on a computing system, the method comprising: performing an accelerated emulation of an untrusted computer file by emulating a first code sequence of a plurality of code sequences of the untrusted computer file in a virtual environment; and upon identifying a known code sequence in the untrusted computer file, executing outside the virtual environment a preexisting trusted routine functionally implementing the known code sequence, wherein the trusted routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; and determining whether the untrusted computer file is malicious according to a result of the accelerated emulation.