专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

WO2019147847A1 SYSTEMS AND METHODS FOR DEFINING AND SECURELY SHARING OBJECTS IN PREVENTING DATA BREACH OR EXFILTRATION 审中-公开
公开(公告)号：WO2019147847A1
公开(公告)日：2019-08-01
申请号：PCT/US2019/015001
申请日：2019-01-24
申请人： DIGITAL GUARDIAN, INC.
发明人： ATREYA, Shreemathi , KODURI, Niranjan , YIM, Wai Tung , DARYOUSH, Emanoel
IPC分类号： G06F21/53 , G06F21/55 , G06F21/56 , G06F21/60 , G06F21/62
摘要： Provided herein are systems and methods for defining and securely sharing objects for use in preventing data breach or exfiltration. Memory may be configured to store a plurality of objects for use in preventing data breach or exfiltration. A validation engine can validate the objects, incorporate into each object an object identifier and a signature, and generate a subset of the objects for use by a first user. The validation engine can store, in the memory, the plurality of objects as a superset of objects corresponding to the generated subset. An evaluation engine may, responsive to identifying that one or more object identifiers and signatures in a received set of objects belong to the subset corresponding to the stored superset, verify whether any object in the received set has been tampered with.

2. 发明申请

WO2017023775A1 SYSTEMS AND METHODS OF PROTECTING DATA FROM MALWARE PROCESSES 审中-公开
标题翻译：从恶意程序保护数据的系统和方法
公开(公告)号：WO2017023775A1
公开(公告)日：2017-02-09
申请号：PCT/US2016/044768
申请日：2016-07-29
申请人： DIGITAL GUARDIAN, INC.
发明人： CARSON, Dwayne, A.
IPC分类号： G06F7/04
CPC分类号： G06F21/567 , G06F21/52 , G06F21/56 , G06F21/6218 , G06F2221/034
摘要： The present disclosure pertains to methods and systems for protecting data or other resources from malware. A driver executing in kernel mode of an operating system on a computing device may monitor one or more processes allowed to execute on the computing device. The one or more processes may include a first executing process. The driver may detect an attempt by a first thread of execution of the first executing process to access a protected file. The driver, responsive to the detection may identify a file type of the protected file. The driver, responsive to the identification of the file type, may determine whether the process is in a list of processes allowed for the file type. The drive may, responsive to determination, determine whether to deny or allow the first thread to access the protected file while allowing another thread of the executing process to execute on the computing device.
摘要翻译：本公开涉及用于保护数据或其他资源免受恶意软件的方法和系统。在计算设备上的操作系统的内核模式下执行的驱动程序可以监视允许在计算设备上执行的一个或多个进程。一个或多个处理可以包括第一执行过程。驱动程序可以检测第一执行进程的第一执行线程访问受保护文件的尝试。响应于检测的驱动程序可以识别受保护文件的文件类型。驱动程序响应于文件类型的识别，可以确定进程是否在文件类型允许的进程列表中。响应于确定，驱动器可以确定是否拒绝或允许第一线程访问受保护的文件，同时允许执行过程的另一线程在计算设备上执行。

3. 发明申请

WO2017023773A1 SYSTEMS AND METHODS OF PROTECTING DATA FROM INJECTED MALWARE 审中-公开
标题翻译：从注射的恶意软件中保护数据的系统和方法
公开(公告)号：WO2017023773A1
公开(公告)日：2017-02-09
申请号：PCT/US2016/044765
申请日：2016-07-29
申请人： DIGITAL GUARDIAN, INC.
发明人： CARSON, Dwayne, A.
IPC分类号： G06F11/00
CPC分类号： G06F21/52 , G06F21/566
摘要： Provided herein are systems and methods for protecting data from injected malware. In some embodiments, a virtual memory validator may execute in user mode memory space on a computing device. The virtual memory validator may monitor an execution stack of an executing thread of a process. The virtual memory validator may identify a memory address referenced in the execution stack, responsive to the process attempting to access a protected resource. The virtual memory validator may determine that the memory address refers to a memory region that is designated as executable. The virtual memory validator may determine that the memory address is outside memory regions identified in a memory range map. The virtual memory validator may, responsive to the determination, identify the process as a potential malware process.
摘要翻译：本文提供了用于保护数据免受注入的恶意软件的系统和方法。在一些实施例中，虚拟存储器验证器可以在计算设备上的用户模式存储器空间中执行。虚拟内存验证器可以监视进程的执行线程的执行堆栈。响应于尝试访问受保护资源的进程，虚拟内存验证器可以标识在执行堆栈中引用的存储器地址。虚拟内存验证器可以确定存储器地址是指被指定为可执行的存储器区域。虚拟内存验证器可以确定存储器地址在存储器范围图中标识的存储器区域之外。虚拟内存验证器可以响应于该确定将该进程识别为潜在的恶意软件进程。

4. 发明申请

WO2017062313A1 SYSTEMS AND METHODS FOR GENERATING POLICIES FOR AN APPLICATION USING A VIRTUALIZED ENVIRONMENT 审中-公开
标题翻译：使用虚拟化环境生成应用策略的系统和方法
公开(公告)号：WO2017062313A1
公开(公告)日：2017-04-13
申请号：PCT/US2016/055188
申请日：2016-10-03
申请人： DIGITAL GUARDIAN, INC.
发明人： FOX, John C.
IPC分类号： G06F21/53
CPC分类号： G06F21/53 , G06F21/566 , G06F2221/033 , H04L63/1433 , H04L63/20
摘要： Provided herein are systems and methods for generating policies for a new application using a virtualized environment. Prior to allowing a new application to operate on a host system, the new application may be installed in a virtual environment. A first program execution restrictor of the virtualized environment may determine a set of policies for the new application. The set of policies may allow the new application to add specific program elements during installation and execution in the virtualized environment. The first program execution restrictor may verify an absence of malicious behavior from the new application while the new application executes in the virtualized environment. The new application may be executed on the host system responsive to the verification. The host system may have a second program execution restrictor that applies the set of policies when the new application is allowed to execute on the host system.
摘要翻译：本文提供的是使用虚拟化环境为新应用程序生成策略的系统和方法。在允许新应用程序在主机系统上运行之前，新应用程序可能会安装在虚拟环境中。虚拟化环境的第一程序执行限制器可以确定新应用程序的一组策略。该策略集可能允许新应用程序在虚拟化环境中的安装和执行期间添加特定的程序元素。当新应用程序在虚拟化环境中执行时，第一个程序执行限制器可以验证新应用程序中是否存在恶意行为。响应于验证，可以在主机系统上执行新的应用。主机系统可以具有第二程序执行限制器，其在允许新应用被允许在主机系统上执行时应用该组策略。

5. 发明授权

US10929537B2 Systems and methods of protecting data from malware processes 有权
公开(公告)号：US10929537B2
公开(公告)日：2021-02-23
申请号：US15223947
申请日：2016-07-29
申请人： Digital Guardian, Inc.
发明人： Dwayne A. Carson
IPC分类号： G06F21/56 , G06F21/62 , G06F21/52
摘要： The present disclosure pertains to methods and systems for protecting data or other resources from malware. A driver executing in kernel mode of an operating system on a computing device may monitor one or more processes allowed to execute on the computing device. The one or more processes may include a first executing process. The driver may detect an attempt by a first thread of execution of the first executing process to access a protected file. The driver, responsive to the detection may identify a file type of the protected file. The driver, responsive to the identification of the file type, may determine whether the process is in a list of processes allowed for the file type. The drive may, responsive to determination, determine whether to deny or allow the first thread to access the protected file while allowing another thread of the executing process to execute on the computing device.

6. 发明申请

US20170032118A1 SYSTEMS AND METHODS OF PROTECTING DATA FROM INJECTED MALWARE 审中-公开
标题翻译：从注射的恶意软件中保护数据的系统和方法
公开(公告)号：US20170032118A1
公开(公告)日：2017-02-02
申请号：US15223944
申请日：2016-07-29
申请人： Digital Guardian, Inc.
发明人： Dwayne A. Carson
IPC分类号： G06F21/52
CPC分类号： G06F21/52 , G06F21/566
摘要： Provided herein are systems and methods for protecting data from injected malware. In some embodiments, a virtual memory validator may execute in user mode memory space on a computing device. The virtual memory validator may monitor an execution stack of an executing thread of a process. The virtual memory validator may identify a memory address referenced in the execution stack, responsive to the process attempting to access a protected resource. The virtual memory validator may determine that the memory address refers to a memory region that is designated as executable. The virtual memory validator may determine that the memory address is outside memory regions identified in a memory range map. The virtual memory validator may, responsive to the determination, identify the process as a potential malware process.
摘要翻译：本文提供了用于保护数据免受注入的恶意软件的系统和方法。在一些实施例中，虚拟存储器验证器可以在计算设备上的用户模式存储器空间中执行。虚拟内存验证器可以监视进程的执行线程的执行堆栈。响应于尝试访问受保护资源的进程，虚拟内存验证器可以标识在执行堆栈中引用的存储器地址。虚拟内存验证器可以确定存储器地址是指被指定为可执行的存储器区域。虚拟内存验证器可以确定存储器地址在存储器范围图中标识的存储器区域之外。虚拟内存验证器可以响应于该确定将该进程识别为潜在的恶意软件进程。

7. 发明授权

US10803204B2 Systems and methods for defining and securely sharing objects in preventing data breach or exfiltration 有权
公开(公告)号：US10803204B2
公开(公告)日：2020-10-13
申请号：US15879588
申请日：2018-01-25
申请人： Digital Guardian, Inc.
发明人： Shreemathi Atreya , Niranjan Koduri , Wai Tung Yim , Emanoel Daryoush
IPC分类号： G06F7/04 , G06F21/64 , G06F21/10 , H04L29/06 , G06F21/62 , G06F21/55
摘要： Provided herein are systems and methods for defining and securely sharing objects for use in preventing data breach or exfiltration. Memory may be configured to store a plurality of objects for use in preventing data breach or exfiltration. A validation engine can validate the objects, incorporate into each object an object identifier and a signature, and generate a subset of the objects for use by a first user. The validation engine can store, in the memory, the plurality of objects as a superset of objects corresponding to the generated subset. An evaluation engine may, responsive to identifying that one or more object identifiers and signatures in a received set of objects belong to the subset corresponding to the stored superset, verify whether any object in the received set has been tampered with.

8. 发明授权

US10614210B2 Systems and methods of protecting data from injected malware 有权
公开(公告)号：US10614210B2
公开(公告)日：2020-04-07
申请号：US15223944
申请日：2016-07-29
申请人： Digital Guardian, Inc.
发明人： Dwayne A. Carson
IPC分类号： G06F21/52 , G06F21/56
CPC分类号： G06F21/52 , G06F21/566
摘要： Provided herein are systems and methods for protecting data from injected malware. In some embodiments, a virtual memory validator may execute in user mode memory space on a computing device. The virtual memory validator may monitor an execution stack of an executing thread of a process. The virtual memory validator may identify a memory address referenced in the execution stack, responsive to the process attempting to access a protected resource. The virtual memory validator may determine that the memory address refers to a memory region that is designated as executable. The virtual memory validator may determine that the memory address is outside memory regions identified in a memory range map. The virtual memory validator may, responsive to the determination, identify the process as a potential malware process.

9. 发明申请

US20190251251A1 SYSTEMS AND METHODS FOR DETERMINING A LIKELIHOOD OF AN EXISTENCE OF MALWARE ON AN EXECUTABLE 审中-公开
公开(公告)号：US20190251251A1
公开(公告)日：2019-08-15
申请号：US15896333
申请日：2018-02-14
申请人： Digital Guardian, Inc.
发明人： Dwayne A. Carson
IPC分类号： G06F21/51 , H04L29/06 , G06F15/18
CPC分类号： G06F21/51 , G06N20/00 , H04L63/1433 , H04L63/1441
摘要： Provided herein are systems and methods for determining a likelihood that an executable comprises malware. A learning engine may determine a plurality of attributes of an executable identified in a computing environment, and a corresponding weight to assign to each of the plurality of attributes. Each of the plurality of attributes may be indicative of a level of risk for the computing environment. The learning engine may generate, according to the determined plurality of attributes and the corresponding weights, one or more scores indicative of a likelihood that the executable comprises malware. A rule engine may perform an action to manage operation of the executable, according to the generated one or more scores.

10. 发明申请

US20170103201A1 SYSTEMS AND METHODS FOR GENERATING POLICIES FOR AN APPLICATION USING A VIRTUALIZED ENVIRONMENT 有权
公开(公告)号：US20170103201A1
公开(公告)日：2017-04-13
申请号：US14878415
申请日：2015-10-08
申请人： Digital Guardian, Inc.
发明人： John C. Fox
IPC分类号： G06F21/53 , G06F21/56 , H04L29/06
CPC分类号： G06F21/53 , G06F21/566 , G06F2221/033 , H04L63/1433 , H04L63/20
摘要： Provided herein are systems and methods for generating policies for a new application using a virtualized environment. Prior to allowing a new application to operate on a host system, the new application may be installed in a virtual environment. A first program execution restrictor of the virtualized environment may determine a set of policies for the new application. The set of policies may allow the new application to add specific program elements during installation and execution in the virtualized environment. The first program execution restrictor may verify an absence of malicious behavior from the new application while the new application executes in the virtualized environment. The new application may be executed on the host system responsive to the verification. The host system may have a second program execution restrictor that applies the set of policies when the new application is allowed to execute on the host system.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式