公开(公告)号：DE60311666D1

公开(公告)日：2007-03-22

申请号：DE60311666

申请日：2003-07-17

Applicant: IBM

Inventor： ARNOLD CARLISLE ,  CHESS MICHAEL ,  MORAR FREDERICK ,  SEGAL ALLA ,  WHALLEY NICHOLAS ,  WHITE RICHARD

IPC: G06F1/00 ,  G06F21/22 ,  G06F21/00

Abstract: A method and system for the automatic determination of the behavioral profile of a program suspected of having worm-like characteristics includes analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like characteristics, running the program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the program in the non-network environment. A logged record of the observed behavior is analyzed to determine if the behavior is indicative of the program having worm-like characteristics. The non-network environment may simulate the appearance of a network to the program, without emulating the operation of the network.