# US 8,782,791 B2 · Computer virus detection systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,791 B2 - Document ID: US8782791B2 - Status: Granted - Kind: B2 - Application number: 12/958,306 - Filed: 2010-12-01 - Published: 2012-06-07 - Granted: 2014-07-15 - Earliest claimed: 2010-12-01 - Assignees: Symantec Corporation - Applicants: Anand D. Sankruthi - Inventors: Anand D. Sankruthi - Web page: https://patentgrep.com/patent/US8782791B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/564: {by virus signature recognition} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for computer virus detection are presented. In one embodiment; an computer virus detection method includes: receiving an indication of a change to a file; performing a virus analysis process, including executing the changes to the file in a virtual machine and examining results of the executing the changes; and handling the file based upon the virus analysis. The virus analysis can be performed in a system in which the change to the file occurs. Handling the file can include treating the file as potentially infected with a virus based upon the virus analysis. In one exemplary implementation, examining the results includes comparing the results of executing the changes to the file to other results from executing changes to another file, wherein the file is identified as potentially infected with a virus if the examining results indicates the results of executing the changes to the file are similar to results from executing changes to another file. Examining results includes examining behavior resulting from executing the file (e.g., examining system calls, etc.). Outcome of the examining results can be forwarded for utilization in developing virus data sets. ## Claims ### Claim 1 A computer virus detection method comprising: performing a virus analysis process, including: executing changes to a first and a second file in a virtual machine; comparing resulting behavior of executing said changes to said first file in said virtual machine to resulting behavior of executing said changes to said second file in said virtual machine; and executing said changes to said first and second files outside the virtual machine based upon receiving an indication from said virus analysis process that said first and second files are not infected; wherein said first and second files are identified as potentially infected with a virus if said resulting behavior of executing said changes to said first file in said virtual machine shares common characteristics with said resulting behavior of executing said changes to said second file in said virtual machine. ### Claim 2 (depends on 1) The computer virus detection method of claim 1 wherein said performing said virus analysis process is performed in a system in which said changes to said first and second files occur. ### Claim 3 (depends on 1) The computer virus detection method of claim 1 wherein said first and second files are treated as potentially infected with a virus based upon said virus analysis process indicating behavior of both the first and second files share common characteristics. ### Claim 4 (depends on 1) The computer virus detection method of claim 1 wherein said first and second files are treated as potentially infected with a virus based upon said virus analysis indicating behavior of said first and second changed files and a process that directed said change share common characteristics. ### Claim 5 (depends on 1) The computer virus detection method of claim 1 wherein said examining said behavior includes examining system calls. ### Claim 6 (depends on 1) The computer virus detection method of claim 1 further comprising forwarding an outcome of said examining results for utilization in developing virus data sets. ### Claim 7 A non-transitory computer readable storage medium having stored thereon computer executable instructions that, when executed by a computer system, cause the computer system to perform a method comprising: performing a virus analysis process, including: executing changes to a first and a second file in a virtual machine; comparing resulting behavior of executing said changes to said first file in said virtual machine to resulting behavior of executing said changes to said second file in said virtual machine; and executing said changes to said first and second files outside the virtual machine based upon receiving an indication from said virus analysis process that said file is first and second files are not infected; wherein said first and second files are identified as potentially infected with a virus if said resulting behavior of executing said changes to said first file in said virtual machine shares common characteristics with said resulting behavior of executing said changes to said second file in said virtual machine. ### Claim 8 (depends on 7) The non-transitory tangible computer readable storage medium of claim 7 wherein said performing said virus analysis process is performed in a system in which said changes to said first and second files occur. ### Claim 9 (depends on 7) The non-transitory tangible computer readable storage medium of claim 7 wherein said first and second files are treated as potentially infected with a virus based upon said virus analysis process indicating behavior of both the first and second files share common characteristics. ### Claim 10 (depends on 7) The non-transitory tangible computer readable storage medium of claim 7 wherein said first and second files are treated as potentially infected with a virus based upon said virus analysis indicating behavior of said first and second changed files and a process that directed said change share common characteristics. ### Claim 11 (depends on 7) The non-transitory tangible computer readable storage medium of claim 7 wherein said examining said behavior includes examining system calls. ### Claim 12 (depends on 7) The non-transitory tangible computer readable storage medium of claim 7 further comprising forwarding an outcome of said examining results for utilization in developing virus data sets. ### Claim 13 A computer system, comprising: a computer system having a processor coupled to a non-transitory computer readable storage medium and executing computer readable code which causes the computer system to perform operations including: performing a virus analysis process, including: executing changes to a first and a second file in a virtual machine; comparing resulting behavior of executing said changes to said first file in said virtual machine to resulting behavior of executing said changes to said second file in said virtual machine; and executing said changes to said first and second files outside the virtual machine based upon receiving an indication from said virus analysis process that said file is first and second files are not infected; wherein said first and second files are identified as potentially infected with a virus if said resulting behavior of executing said changes to said first file in said virtual machine shares common characteristics with said resulting behavior of executing said changes to said second file in said virtual machine. ### Claim 14 (depends on 13) The computer system of claim 13 wherein said performing said virus analysis process is performed in a system in which said changes to said first and second files occur. ### Claim 15 (depends on 13) The computer system of claim 13 wherein said first and second files are treated as potentially infected with a virus based upon said virus analysis process indicating behavior of both the first and second files share common characteristics. ### Claim 16 (depends on 13) The computer system of claim 13 wherein said first and second files are treated as potentially infected with a virus based upon said virus analysis indicating behavior of said first and second changed files and a process that directed said change share common characteristics. ### Claim 17 (depends on 13) The computer system method of claim 13 further comprising forwarding an outcome of said examining results for utilization in developing virus data sets.