Simulation of an application

Patent metadata

Field	Value
Publication number	US-9846774-B2
Application number	US-201514752911-A
Country	US
Kind code	B2
Filing date	Jun 27, 2015
Priority date	Jun 27, 2015
Publication date	Dec 19, 2017
Grant date	Dec 19, 2017

Abstract

Particular embodiments described herein provide for an electronic device that can be configured to identify an application, run the application, log the parameters for each function call of the application, and store the logged parameters in an emulation table. The logged parameters can include a function call, input parameters, and output parameters. The emulation table can be used to simulate execution of an application without having to actually run the application.

First claim

What is claimed is:

1. At least one non-transitory machine-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:
run an application in a sandbox environment, wherein the application includes a plurality of function calls;
log parameters for each function call of the application during run time in the sandbox environment, wherein the logged parameters include each function call, input parameters for each function call, and output parameters for each function call;
store the logged parameters in an emulation table; and
use the logged parameters in a simulation environment to simulate execution of a function call of the plurality of function calls, wherein simulating execution of the function call comprises simulating the function call without having to run the function call by:
determining from the emulation table whether a current simulation environment parameter set for the function call matches logged input parameters for the function call; and
in response to determining the current simulation environment parameter set matches logged input parameters, returning the logged output parameters for the function call.

2. The at least one non-transitory machine-readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:
assess overall logging data and determine prevalent combinations of input to output parameter mappings for each function call.

3. The at least one non-transitory machine-readable medium of claim 2 , further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:
remove at least one parameter that does not influence an output of at least one of the function calls.

4. The at least one non-transitory machine-readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:
communicate the emulation table to an electronic device.

5. An apparatus comprising:
a network emulation module configured to:
run an application in a sandbox environment, wherein the application includes a plurality of function calls;
log parameters for each function call of the application during run time in the sandbox environment, wherein the logged parameters include each function call, input parameters for each function call, and output parameters for each function call;
store the logged parameters in an emulation table; and

use the logged parameters in a simulation environment to simulate execution of a function call of the plurality of function calls, wherein simulating execution of the function call comprises simulating the function call without having to run the function call by:
determining from the emulation table whether a current simulation environment parameter set for the function call matches logged input parameters for the function call; and
in response to determining the current simulation environment parameter set matches logged input parameters, returning the logged output parameters for the function call.

6. The apparatus of claim 5 , wherein the network emulation module is further configured to:
assess overall logging data and determine prevalent combinations of input to output parameter mappings for each function call.

7. The apparatus of claim 5 , wherein the network emulation module is further configured to:
prune out parameters that do not influence an output of each function call.

8. The apparatus of claim 7 , wherein the network emulation module is further configured to:
communicate the emulation table to an electronic device.

9. A method comprising:
identifying an application on an electronic device, wherein the application includes a plurality of function calls;
running the application in a sandbox environment;
logging parameters for each function call of the application during run time in the sandbox environment, wherein the logged parameters include each function call, input parameters for each function call, and output parameters for each function call;
storing the logged parameters in an emulation table; and
simulating an execution of the application using the emulation table, wherein simulating execution of the application comprises simulating a function call of the plurality of function calls without having to run the function call by:
determining from the emulation table whether a current simulation environment parameter set for the function call matches logged input parameters for the function call; and
in response to determining the current simulation environment parameter set matches logged input parameters, returning the logged output parameters for the function call.

10. The method of claim 9 , further comprising:
analyzing the simulation of the execution of the application for the presence of malware.

11. The method of claim 9 , wherein simulating the execution of the application using the emulation table is performed on the electronic device.

12. A system for the simulation of an application, the system comprising:
a network emulation module configured to:
run an application in a sandbox environment, wherein the application includes a plurality of function calls;
log parameters for each function call of the application during run time in the sandbox environment, wherein the logged parameters include each function call, input parameters for each function call, and output parameters for each function call;
store the logged parameters in an emulation table; and

use the logged parameters in a simulation environment to simulate execution of a function call of the plurality of function calls, wherein simulating execution of the function call comprises simulating the function call without having to run the function call by:
determining from the emulation table whether a current simulation environment parameter set for the function call matches logged input parameters for the function call; and
in response to determining the current simulation environment parameter set matches logged input parameters, returning the logged output parameters for the function call.

Assignees

• Mcafee Llc

Inventors

• Alme Christoph
• Hahn Slawa
• Finke Stefan

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title