Method and apparatus for the automatic determination of potentially worm-like behavior of a program
US7996905B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Apr 3, 2008 |
| Grant date | Aug 9, 2011 |
| Priority date | — |
| Expiry date | Jan 7, 2029 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/51
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A method and system for the automatic determination of the behavioral profile of a program suspected of having worm-like characteristics includes analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like characteristics, running the program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the program in the non-network environment. A logged record of the observed behavior is analyzed to determine if the behavior is indicative of the program having worm-like characteristics. The non-network environment may simulate the appearance of a network to the program, without emulating the operation of the network.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.