会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 99. 发明申请
    • Methods for identifying malicious software
    • 识别恶意软件的方法
    • US20050223238A1
    • 2005-10-06
    • US10948147
    • 2004-09-24
    • Matthew SchmidAdam YoungMichael Weber
    • Matthew SchmidAdam YoungMichael Weber
    • G06F21/00H04L9/00H04L9/06H04L9/32
    • G06F21/563H04L9/0625H04L2209/20
    • Malicious software is identified in an executable file by identifying malicious structural features, decryption code, and cryptographic functions. A malicious structural feature is identified by comparing a known malicious structural feature to one or more instructions of the executable file. A malicious structural feature is also identified by graphically and statistically comparing windows of bytes or instructions in a section of the executable file. Cryptography is an indicator of malicious software. Decryption code is identified in an executable file by identifying a tight loop around a reversible instruction that writes to random access memory. Cryptographic functions are identified in an executable file be obtaining a known cryptographic function and performing a string comparison of the numeric constants of the known cryptographic function with the executable file.
    • 通过识别恶意结构特征,解密代码和加密功能,在可执行文件中识别恶意软件。 通过将已知的恶意结构特征与可执行文件的一个或多个指令进行比较来识别恶意结构特征。 通过图形和统计比较可执行文件的一部分中的字节或指令的窗口也可以识别恶意结构特征。 密码学是恶意软件的指标。 通过识别写入随机存取存储器的可逆指令周围的紧密循环,在可执行文件中识别解密码。 在可执行文件中识别加密功能,以获得已知的加密功能,并且将已知加密功能的数字常数与可执行文件进行字符串比较。