Emulation system, method and computer program product for malware detection by back-stepping in program code
View Patent ↗A system, method, and computer program product are provided for detecting malware. In use, a search is conducted for known elements of computer code. Upon the detection of at least one known element of computer code, various operations are performed. In particular, the present technique steps back in the computer code, and emulates the computer code. Such emulation and stepping are performed for detecting malware.
1. A method, comprising:
searching for known elements of computer code among a plurality of computer code elements including a first computer code element and a second computer code element subsequent to the first computer code element, the computer code elements including parts of the computer code and the known elements of the computer code including elements of the computer code that are both known before emulation and are capable of being located in the computer code;
upon detection of the second computer code element including at least one known element of computer code,
stepping back in the computer code by moving from the second computer code element to the first computer code element, and
emulating the computer code as a function of the stepping back; detecting malware based on the emulation and the stepping;
comparing results of the emulation with data in a database;
wherein the results include parameters associated with execution of the computer code.
2. The method of claim 1 , wherein the at least one known element of the computer code is identified as a key point in the computer code.
3. The method of claim 2 , wherein the key point is associated with an application programming interface.
4. The method of claim 2 , wherein the key point is associated with an operating system application programming interface.
5. The method of claim 2 , wherein the stepping back occurs from the key point.
6. The method of claim 1 , wherein the database includes a malware database.
7. The method of claim 2 , wherein the parameters include parameters with which the execution of the computer code arrives at the key point.
8. The method of claim 2 , and further comprising repeating the stepping and the emulation in association with a plurality of the key points to generate a set of results.
9. The method of claim 8 , and further comprising comparing the set of results of the emulation with the data in the database.
10. The method of claim 1 , wherein the stepping is performed prior to the emulation.
11. The method of claim 1 , wherein the malware includes viruses.
12. The method of claim 1 , wherein the malware is selected from the group consisting of malware, spyware, and unwanted programs.
13. The method of claim 1 , wherein the stepping is minimized by the stepping back from a key point.
14. The method of claim 2 , wherein the emulation is carried out on a portion of the computer code starting with a point defined by the stepping and the key point.
15. The method of claim 1 , wherein the stepping reduces an amount of the computer code to be emulated.
16. The method of claim 2 , and further comprising determining whether an additional key point exists, and repeating the stepping and the emulation in association with the additional key point.
17. A computer code embodied on a computer readable medium, comprising:
a computer segment for searching for known elements of computer code among a plurality of computer code elements including a first computer code element and a second computer code element subsequent to the first computer code element, the computer code elements including parts of the computer code and the known elements of the computer code including elements of the computer code that are both known before emulation and are capable of being located in the computer code;
a computer segment for, upon the detection of the second computer code element including at least one known element of computer code,
stepping back in the computer code by moving from the second computer code element to the first computer code element, and
emulating the computer code as a function of the stepping back;
a computer segment for detecting malware based on the emulation and the stepping;
a computer segment for comparing results of the emulation with data in a database;
wherein the results include parameters associated with execution of the computer code.
18. A system, comprising:
a processor coupled to memory,
the processor adapted for searching for known elements of computer code among a plurality of computer code elements including a first computer code element and a second computer code element subsequent to the first computer code element, the computer code elements including parts of the computer code and the known elements of the computer code including elements of the computer code that are both known before emulation and are capable of being located in the computer code;
the processor adapted for stepping back in the computer code by moving from the second computer code element to the first computer code element, and emulating the computer code as a function of the stepping back, upon the detection of the second computer code element including at least one known element of computer code;
the processor adapted for detecting malware based on the emulation and the stepping; and
the processor adapted for comparing results of the emulation with data in a database;
wherein the results include parameters associated with execution of the computer code.
19. The method of claim 1 , wherein the known elements of computer code include one or more of application programming interface (API) calls, dynamic link libraries (DLLs), static link libraries, and computer instructions.
20. The method of claim 1 , wherein the stepping back involves moving to a previous computer code element.
21. The method of claim 7 , wherein the parameters with which the execution of the computer code arrives at the key point include parameters on a stack and pointers to memory and associated contents.