发明名称 |
Method and apparatus for the automatic determination of potentially worm-like behavior of a program |
摘要 |
A method and system for the automatic determination of the behavioral profile of a program suspected of having worm-like characteristics includes analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like characteristics, running the program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the program in the non-network environment. A logged record of the observed behavior is analyzed to determine if the behavior is indicative of the program having worm-like characteristics. The non-network environment may simulate the appearance of a network to the program, without emulating the operation of the network.
|
申请公布号 |
US2004019832(A1) |
申请公布日期 |
2004.01.29 |
申请号 |
US20020202517 |
申请日期 |
2002.07.23 |
申请人 |
INTERNATIONAL BUSINESS MACHINES CORPORATION |
发明人 |
ARNOLD WILLIAM C.;CHESS DAVID M.;MORAR JOHN F.;SEGAL ALLA;WHALLEY IAN N.;WHITE STEVE R. |
分类号 |
G06F21/22;G06F21/00;(IPC1-7):H04B1/74 |
主分类号 |
G06F21/22 |
代理机构 |
|
代理人 |
|
主权项 |
|
地址 |
|