US 8,943,596 B2Granted

System and method for improving the efficiency of application emulation acceleration

AssigneeKaspersky Lab ZAO

InventorSergey Y. Belov

Life of this patent

Estimating the term…

Loading patent…

Abstract

An improved emulator for analyzing software code, and associated method. The emulator includes a virtual execution environment in which a series of virtual processing states are represented during emulation of a first portion of the software code, and a hardware accelerator that performs an initialization of the computing hardware to directly execute a second portion of the software code under investigation without emulation thereof in the virtual execution environment. An efficiency assessment module determines a measure of efficiency of performing the executing of the second portion of the software code under investigation without emulation thereof, and an acceleration decision module performs selection of the second portion of the software code under investigation to be directly executed by the hardware accelerator module based on the determined measure of efficiency.

Claims18

Dependent claims

In a computer system that includes computing hardware, including at least one processor, and data storage, a method for emulating an object of software code under investigation, the method comprising:

executing, by the computing hardware operating under program control, a virtual execution environment in which a first portion of the object of software code under investigation is emulated, wherein a series of virtual processing states are represented during emulation of the first portion;
executing, by the computing hardware, a second portion of the object of software code under investigation without emulation thereof;
prior to the executing of the second portion of the object of software code without emulation, initializing the computing hardware according to one of the series of virtual processing states that preceded the second portion of the object of software code;
determining, by the computing hardware operating under program control, a measure of efficiency for the executing of the second portion of the object of software code without emulation;
and
determining, by the computing hardware operating under program control, suitability of execution of the second portion of the object of software code without emulation, wherein determining of the suitability is based on a comparison of the measure of efficiency against an efficiency criterion.

3 more elements

A security arrangement for detecting malware in an object of software code under investigation, the security arrangement comprising:

computing hardware, including at least one processor, and data storage, the data storage containing instructions that, when executed, cause the computing hardware to establish an emulator system including:
a virtual execution environment in which a series of virtual processing states are represented during emulation of a first portion of the object of software code;
a hardware accelerator module that performs an initialization of the computing hardware to directly execute a second portion of the object of software code under investigation without emulation thereof in the virtual execution environment;
an efficiency assessment module that determines a measure of efficiency of performing the executing of the second portion of the object of software code under investigation without emulation thereof;
and
an acceleration decision module that performs selection of the second portion of the object of software code under investigation to be directly executed by the hardware accelerator module based on the determined measure of efficiency.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/852,778Filed 28 Mar 2013
Priority: RU 201215644525 Dec 2012
Published: US 2014/0181970 A126 Jun 2014
Granted: 27 Jan 2015
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 9/45508
Abstract machines for program code execution, e.g. Java virtual machine [JVM], interpreters or emulators: runtime interpretation or emulation, e…
G06F 9/45516
Abstract machines for program code execution, e.g. Java virtual machine [JVM], interpreters or emulators: runtime code conversion or optimisation
G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…