METHOD AND APPARATUS FOR THE AUTOMATIC DETERMINATION OF POTENTIALLY WORM-LIKE BEHAVIOUR OF A PROGRAM
摘要
A method and system for the automatic determination of the behavioural profile of a program suspected of having worm-like characteristics includes analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like characteristics, running the program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behaviour of the program in the non-network environment. A logged record of the observed behaviour is analyzed to determine if the behaviour is indicative of the program having worm-like characteristics. The non-network environment may simulate the appearance of a network to the program, without emulating the operation of the network.
申请公布号
WO2004010269(A3)
申请公布日期
2004.03.11
申请号
WO2003GB03112
申请日期
2003.07.17
申请人
INTERNATIONAL BUSINESS MACHINES CORPORATION;IBM UNITED KINGDOM LIMITED