06981279 is referenced by 187 patents and cites 8 patents.

A system and a method are disclosed for dynamically analyzing software, some of whose potentially-important behaviors (such as worm-like behavior) may only be displayed when the software is executed in an environment where it has, or appears to have, access to a production network and/or to the global Internet. The software can be executed in a real or an emulated network environment that includes a monitoring component and an emulation component. The monitoring component serves to capture and/or record the behaviors displayed by the software and/or other components of the system, and the emulation component gives the software being analyzed the impression that it is executing with access to a production network and/or to the global Internet. The software being analyzed is effectively confined to the analysis network environment, and cannot in fact read information from, or alter any information on, any production network or the global Internet.

Title
Method and apparatus for replicating and analyzing worm programs
Application Number
9/640453
Publication Number
6981279 (B1)
Application Date
August 17, 2000
Publication Date
December 27, 2005
Inventor
Steve R White
New York
NY, US
Ian N Whalley
Pawling
NY, US
Morton G Swimmer
New York
NY, US
Alla Segal
Mount Kisco
NY, US
John F Morar
Mahopac
NY, US
David M Chess
Mohegan Lake
NY, US
William C Arnold
Mahopac
NY, US
Agent
Harrington & Smith
Rafael Perez Pineiro
Assignee
International Business Machines Corporation
NY, US
IPC
G06F 009/44
G06F 009/455
G06F 011/00
G06F 007/04
View Original Source