System and Method for Detection of Malicious Code by Iterative Emulation of Microcode

摘要

Examples of systems, methods and media are shown for iteratively emulating potentially malicious code involving, for each offset of a microarchitecture for the code, emulating a first ring of an operating system, executing a segment of code in the emulated first ring, checking the behavior of the executing code for suspect behavior, and identifying the executing code as malicious code if suspect behavior is detected. Some examples include emulating a second ring of the operating system having a higher level of privilege than the first ring, such that the second ring emulation returns results to the executing code segment, but does not actually perform the functionality in a host platform.

主权项

1. A method for iteratively emulating potentially malicious code, the method comprising the steps of:
for each offset of a microarchitecture for the code:
emulating a first ring of an operating system;executing a segment of code in the emulated first ring;checking the behavior of the executing code for suspect behavior; andidentifying the executing code as malicious code if suspect behavior is detected.