Detection of polymorphic virus code using dataflow analysis

Details Detection of polymorphic virus code using dataflow analysis Detection of polymorphic virus code using dataflow analysis

2006-06-27

2006-06-27

Moise, Emmanuel L. (Department: 2137)

Information security

Access control or authentication

Network

Reexamination Certificate

active

07069583

ABSTRACT:
A method and apparatus for detecting polymorphic viral code in a computer program is provided. The apparatus comprises an emulator, an operational code analyzer and an heuristic analyzer. The emulator emulates a selected number of instructions of the computer program. The operational code analyzer collects and stores information corresponding to operands and operators used in the instructions and the state of registers/flags after each emulated instruction execution. The heuristic analyzer determines a probability that the computer program contains viral code based on an heuristic analysis of register/flag state information supplied by the operational code analyzer.

REFERENCES:
patent: 5826013 (1998-10-01), Nachenberg
patent: 5964889 (1999-10-01), Nachenberg
patent: 6357008 (2002-03-01), Nachenberg

Affiliated with

Also associated with

Rating

Detection of polymorphic virus code using dataflow analysis does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Detection of polymorphic virus code using dataflow analysis, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Detection of polymorphic virus code using dataflow analysis will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3668632