Importance

Loading Importance Indicators...

Abstract

A computer application program subsystem (100) includes a program interpreter (120) and an application program interface (API 110) through which an external program requests an execution of a program of interest, such as a macro, in a specified simulated environment. The external program that requests the execution of the program of interest may further specify a simulated application state. The program of interest is written in a program language that the interpreter can interpret. The subsystem further includes an output path for returning to the external program at least one indication of what action or actions the program of interest would have taken if the program of interest had been run in a real environment that corresponds to the specified simulated environment. The output path may be implemented using a callback function that is triggered upon the occurrence of an instruction of the program of interest satisfying at least one notification criterion, and/or upon the occurrence of the program of interest satisfying at least one termination criterion. The methods and apparatus can be useful in detecting an occurrence of viral behavior in a macro by interpreting the macro in the specified virtual environment and virtual application state, and then notifying the external program when the macro performs some predetermined activity, such as writing data to some predetermined region of system memory.

Loading the Abstract Image...

First Claim