Emulation for malware detection

1. A method of determining if a program is potentially malware, comprising:

executing said program on a real computer system including accessing data stored in a computer system memory;

interrupting the execution of the program at a point of interest;

in response to interrupting the execution of the program at the point of interest, performing an emulation of at least part of the program using an emulated computer system implemented on the real computer system;

during execution of the program within the emulated computer system, when the program attempts to access a unit of data stored in said computer system memory, copying the unit of data from the computer system memory into an emulated memory, and allowing the program to access the unit of data within the emulated computer system, and furthermore

during the emulation of the program, monitoring the behavior of the program in order to detect any suspicious behavior; and

if any suspicious behavior is detected, determining that the program is potentially malware.

2. The method as claimed in claim 1 , wherein the unit of data is a memory page.

3. The method as claimed in claim 2 , wherein the emulated memory is initially configured to contain no data such that when the program attempts to access the memory page, the emulated computer system establishes a page fault.

4. The method as claimed in claim 2 , wherein, when the program attempts to access the memory page using an address at which the memory page is located, the emulated computer system performs address translation to obtain a corresponding address within the emulated memory.

5. The method as claimed in claim 4 , wherein the step of copying the unit of data from the computer system memory into the emulated memory comprises: copying the memory page located at the address in the computer system memory into the corresponding address within the emulated memory.

6. The method as claimed in claim 5 , wherein the step of allowing the program to access the unit of data within the emulated memory comprises: allowing the program to access the corresponding address within the emulated memory.

7. The method as claimed in claim 1 , wherein the step of interrupting the execution of the program at a point of interest comprises any of: using a hook to intercept a call to a function; and stopping the execution when the program reaches a breakpoint.

8. The method as claimed in claim 7 , and further comprising: prior to executing the program, inserting the hook or breakpoint within any functions that are accessed by malware.

9. A non-transitory computer readable storage medium comprising computer program instructions for determining whether a program is malware and, when run on a computer, causes the computer to perform

interruption of said program executing on a real computer system at a point of interest, where the execution includes accessing data stored in a computer system memory;

in response to interruption of said program executing on a real computer system at the point of interest, emulation of at least part of the program using an emulated computer system implemented on said real computer system, the emulation comprising:

during execution of the program within the emulated computer system, when the program attempts to access a unit of data, copying the unit of data from the computer system memory into an emulated memory, and allowing the program to access the unit of data within the emulated computer system, and

during the emulation of the program, monitoring the behavior of the program in order to detect any suspicious behavior; and

if any suspicious behavior is detected, determining that the program is potentially malware.