Virus detection by executing electronic message code in a virtual machine
US9652613B1 · kind B1 · utility
Assignee
Inventors
Key dates
| Filing date | Apr 30, 2008 |
| Grant date | May 16, 2017 |
| Priority date | — |
| Expiry date | Mar 26, 2032 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/2149
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
An intermediary isolation server receives electronic messages and isolates any viral behavior from harming its intended destination. After the intermediary receives an electronic message, it determines that the electronic message has associated executable code, and then identifies the environment in which the electronic message code would be executed if delivered. The intermediary then executes the code by emulating how it would be executed in its ultimate environment. If a viral-like behavior is detected, appropriate action is taken to prevent the execution of the code at its intended destination. The attachment is executed in a contained environment that allows for the contained environment to be easily restarted in a clean state.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.