Scott D Mcrae

US Patent:

8640233, Jan 28, 2014

Filed:

Jun 11, 2013

Appl. No.:

13/915261

Inventors:

Scott M. McRae - Atlanta GA, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

H04L 29/06

US Classification:

726 22, 726 23, 726 24

Abstract:

A method and system for detecting whether a computer program, sent to a first computer having an operating environment including a plurality of files, includes malware is provided. A second computer lists in a file a plurality of environment details of the operating environment of the first computer. The second computer simulates in the second computer the presence of the plurality of files in the operating environment by exhibiting the plurality of environment details without installing the plurality of files in the second computer. The second computer executes the computer program in the second computer with the simulation and determines whether the computer program attempts to access or utilize the plurality of files in a manner indicative of malware. If not, the second computer records and generates a notification that the computer program is not malware.

US Patent:

20110119669, May 19, 2011

Filed:

Nov 17, 2009

Appl. No.:

12/620090

Inventors:

Scott M. McRae - Atlanta GA, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F 9/455
G06F 9/54

US Classification:

718 1, 719327, 719328, 707E1701

Abstract:

In general, the present invention provides a computer-implemented hypervisor file system (HVFS) comprising (among other things): a HVFS Manager, a Source File System Implementation, Hypervisor API, and HVFS Driver implemented in conjunction with a set (e.g., one or more) of virtual machines. Running a virtual machine on top of complex software systems like hypervisors allows the virtual machine to be presented with virtual storage devices which operate in the file system abstraction layer, instead of the block device layer traditionally presented by hardware. Doing so allows the file system abstraction to be implemented in the hypervisor, and not in the individual virtual machines, giving the hypervisor much greater access and control over the file system elements used by virtual machines, as well as giving it new capabilities such as sharing file system elements across virtual machines.

US Patent:

20110209218, Aug 25, 2011

Filed:

Feb 19, 2010

Appl. No.:

12/708575

Inventors:

Scott M. McRAE - Atlanta GA, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

G06F 11/00

US Classification:

726 23, 714 33

Abstract:

A method and system for detecting whether a computer program, sent to a first computer having an operating environment including a plurality of files, includes malware is provided. A second computer obtains a plurality of environment details of the operating environment of the first computer. The second computer simulates in the second computer the presence of the plurality of files in the operating environment by exhibiting the plurality of environment details without installing the plurality of files in the second computer. The second computer executes the computer program in the second computer with the simulation and determines whether the computer program attempts to access or utilize the plurality of files in a manner indicative of malware. If not, the second computer records and generates a notification that the computer program is not malware.