Virtual Machine Emulator Ambiguous-State Branching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual machine emulators face challenges in balancing performance and effectiveness, often leading to significant degradation in system performance due to the need to emulate multiple versions and variations of computer system components, which results in gaps in protection against viruses adapted to specific system configurations.
Innovation Solution
The method employs a core emulation model to capture non-variable behaviors common across versions and variations, branching only at points of version-specific behavior detection to run separate emulations, thereby minimizing resource usage and time while providing comprehensive protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a virtual machine emulator emulates multiple versions and variations of computer system components to provide comprehensive protection, then the reliability of virus detection is improved, but the system performance degradation increases
Solution Approach 1:
The patent segments the emulation process into multiple stages: first executing suspect applications in a first virtual machine emulator with a first set of component versions, then selectively executing in additional emulators with different versions only when ambiguous behaviors are detected. This segmentation allows comprehensive multi-version testing while avoiding redundant emulation of all applications across all versions, thus maintaining virus detection reliability while reducing system performance degradation.
Solution Approach 2:
The patent applies partial action by performing complete multi-version emulation only when necessary (when ambiguous-state instructions are detected), rather than emulating all applications in all possible configurations. For most applications, a single emulation suffices, and additional emulations are triggered only partially when version-specific ambiguous behaviors occur, optimizing the balance between detection coverage and performance impact.
2Adaptability or versatility
If a virtual machine emulator is designed to be complex enough to simulate multiple computer system configurations, then the adaptability to different native systems is improved, but the device complexity increases
Solution Approach 1:
The patent implements universality by creating a family of virtual machine emulator instances that can each handle multiple component versions, rather than requiring a single highly complex emulator. Each emulator instance is designed to be adaptable to different configurations, allowing the system to achieve broad compatibility across native systems while keeping individual emulator complexity manageable through standardized design patterns.
3Measurement precision
If the virtual machine emulator runs to completion for each suspect application, then the measurement precision of application behavior is improved, but the loss of time increases
Solution Approach 1:
The patent applies preliminary action by executing suspect applications in a controlled virtual environment before allowing them to run on the native system. This preliminary execution in the first virtual machine emulator enables behavior analysis and virus detection to occur in advance, ensuring measurement precision is maintained while the selective multi-emulator approach prevents excessive time loss by avoiding redundant complete executions across all possible configurations.
Data Source
AI summary
A method and apparatus for ambiguous-state support in virtual machine emulators executes a suspect application in a core emulation model for all versions, variations, or generations of a given computer system component and then branches at the point where ambiguous behavior is detected, i.e., at the occurrence/request/trigger of a version variable behavior by the suspect application. The state of the emulation up to the version variable behavior branch point is then copied, and each variable behavior branch is further emulated using variable specific emulation models and only from the point of ambiguity, i.e., from the point of variable behavior, forward.