会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 3. 发明授权
    • Method and system for detecting windows rootkit that modifies the kernel mode system service dispatch table
    • 用于检测修改内核模式系统服务调度表的Windows rootkit的方法和系统
    • US08281393B2
    • 2012-10-02
    • US11594095
    • 2006-11-08
    • Ahmed Sallam
    • Ahmed Sallam
    • G06F21/00
    • G06F21/52
    • A method, system, and computer program product for detecting a kernel-mode rootkit that hooks the System Service Dispatch Table (SSDT) is secure, avoids false positives, and does not disable security applications. A method for detecting a rootkit comprises the steps of calling a function that accesses a system service directly, receiving results from calling the function that accesses the system service directly, calling a function that accesses the system service indirectly, receiving results from calling the function that accesses the system service indirectly, and comparing the received results from calling the function that accesses the system service directly and the received results from calling the function that accesses the system service indirectly to determine presence of a rootkit.
    • 用于检测挂起系统服务调度表(SSDT)的内核模式rootkit的方法,系统和计算机程序产品是安全的,避免了错误的肯定,并且不会禁用安全应用程序。 用于检测rootkit的方法包括以下步骤:直接调用访问系统服务的功能,从直接调用访问系统服务的功能接收结果,调用间接访问系统服务的功能,从调用功能中接收结果 间接访问系统服务,并且通过直接调用访问系统服务的功能和接收的结果间接地调用访问系统服务的功能来比较接收的结果,以确定rootkit的存在。
    • 4. 发明授权
    • Using behavior blocking mobility tokens to facilitate distributed worm detection
    • 使用行为阻止移动性令牌来促进分布式蠕虫检测
    • US07690034B1
    • 2010-03-30
    • US10938047
    • 2004-09-10
    • Ahmed Sallam
    • Ahmed Sallam
    • H04L29/00
    • H04L63/145G06F21/552G06F21/566H04L63/1416
    • Behavior blocking mobility token managers track movement of suspicious files within a network. A behavior blocking mobility token manager on a source computer detects an attempt by a process on the source computer to write a file to a target computer. The behavior blocking mobility token manager determines a suspicion level associated with the process, and writes a behavior blocking mobility token containing at least the suspicion level associated with the process to the target computer. A behavior blocking mobility token manager on the target computer detects that a behavior blocking mobility token is being written to the target computer. The behavior blocking mobility token manager reads the behavior blocking mobility token, and determines a suspicion level of the file associated with the behavior blocking mobility token, responsive to contents of the behavior blocking mobility token.
    • 行为阻止移动性令牌管理器跟踪网络中可疑文件的移动。 源计算机上的行为阻止移动性令牌管理器检测源计算机上的进程尝试将文件写入目标计算机。 行为阻止移动性令牌管理器确定与进程相关联的怀疑级别,并将至少包含与进程相关联的怀疑级别的行为阻止移动性令牌写入目标计算机。 目标计算机上的行为阻止移动性令牌管理器检测到阻止移动性令牌的行为正被写入目标计算机。 行为阻止移动性令牌管理器读取行为阻止移动性令牌,并且响应于行为阻止移动性令牌的内容,确定与行为阻止移动性令牌相关联的文件的怀疑级别。
    • 5. 发明申请
    • Method and system for the detection of file system filter driver based rootkits
    • 用于检测基于文件系统过滤驱动程序的rootkit的方法和系统
    • US20080109906A1
    • 2008-05-08
    • US11594096
    • 2006-11-08
    • Ahmed Sallam
    • Ahmed Sallam
    • G06F12/14
    • G06F21/566
    • A method, system, and computer program product for detecting hidden files and folders that may be installed by or as part of a rootkit provides the capability to identify the method that is used to hide the files and folders, will continue working even if the operating system is modified, and is suitable for real-time detection of hidden files and folders. A method for detecting a rootkit comprises the steps of generating a plurality of query input/output request packets, each query input/output request packet requesting information relating to a file system directory folder, transmitting a generated query input/output request packet to each file system driver object, receiving a result including the requested information relating to a file system directory folder from each file system driver object, and determining differences among each result, to determine information relating to a file system directory folder that is removed by at least one file system driver object.
    • 用于检测可能由rootkit安装或作为rootkit的一部分的隐藏文件和文件夹的方法,系统和计算机程序产品提供了识别用于隐藏文件和文件夹的方法的能力,即使操作 系统被修改,适用于隐藏文件和文件夹的实时检测。 用于检测rootkit的方法包括以下步骤:生成多个查询输入/输出请求分组,每个查询输入/输出请求分组请求与文件系统目录文件夹相关的信息,向每个文件发送生成的查询输入/输出请求分组 系统驱动程序对象,从每个文件系统驱动程序对象接收包括与文件系统目录文件夹相关的所请求的信息的结果,并且确定每个结果之间的差异,以确定与由至少一个文件去除的文件系统目录文件夹有关的信息 系统驱动对象。
    • 6. 发明授权
    • Method and system for the detection of file system filter driver based rootkits
    • 用于检测基于文件系统过滤驱动程序的rootkit的方法和系统
    • US07647308B2
    • 2010-01-12
    • US11594096
    • 2006-11-08
    • Ahmed Sallam
    • Ahmed Sallam
    • G06F17/30
    • G06F21/566
    • A method, system, and computer program product for detecting hidden files and folders that may be installed by or as part of a rootkit provides the capability to identify the method that is used to hide the files and folders, will continue working even if the operating system is modified, and is suitable for real-time detection of hidden files and folders. A method for detecting a rootkit comprises the steps of generating a plurality of query input/output request packets, each query input/output request packet requesting information relating to a file system directory folder, transmitting a generated query input/output request packet to each file system driver object, receiving a result including the requested information relating to a file system directory folder from each file system driver object, and determining differences among each result, to determine information relating to a file system directory folder that is removed by at least one file system driver object.
    • 用于检测可能由rootkit安装或作为rootkit的一部分的隐藏文件和文件夹的方法,系统和计算机程序产品提供了识别用于隐藏文件和文件夹的方法的能力,即使操作 系统被修改,适用于隐藏文件和文件夹的实时检测。 用于检测rootkit的方法包括以下步骤:生成多个查询输入/输出请求分组,每个查询输入/输出请求分组请求与文件系统目录文件夹相关的信息,向每个文件发送生成的查询输入/输出请求分组 系统驱动程序对象,从每个文件系统驱动程序对象接收包括与文件系统目录文件夹相关的所请求的信息的结果,并且确定每个结果之间的差异,以确定与由至少一个文件去除的文件系统目录文件夹有关的信息 系统驱动对象。
    • 7. 发明申请
    • Method and system for detecting windows rootkit that modifies the kernel mode system service dispatch table
    • 用于检测修改内核模式系统服务调度表的Windows rootkit的方法和系统
    • US20080127344A1
    • 2008-05-29
    • US11594095
    • 2006-11-08
    • Ahmed Sallam
    • Ahmed Sallam
    • G06F21/00
    • G06F21/52
    • A method, system, and computer program product for detecting a kernel-mode rootkit that hooks the System Service Dispatch Table (SSDT) is secure, avoids false positives, and does not disable security applications. A method for detecting a rootkit comprises the steps of calling a function that accesses a system service directly, receiving results from calling the function that accesses the system service directly, calling a function that accesses the system service indirectly, receiving results from calling the function that accesses the system service indirectly, and comparing the received results from calling the function that accesses the system service directly and the received results from calling the function that accesses the system service indirectly to determine presence of a rootkit.
    • 用于检测挂起系统服务调度表(SSDT)的内核模式rootkit的方法,系统和计算机程序产品是安全的,避免了错误的肯定,并且不会禁用安全应用程序。 用于检测rootkit的方法包括以下步骤:直接调用访问系统服务的功能,从直接调用访问系统服务的功能接收结果,调用间接访问系统服务的功能,从调用功能中接收结果 间接访问系统服务,并且通过直接调用访问系统服务的功能和接收的结果间接地调用访问系统服务的功能来比较接收到的结果,以确定rootkit的存在。
    • 9. 发明申请
    • Using Mobility Tokens To Observe Malicious Mobile Code
    • 使用移动令牌来观察恶意移动代码
    • US20080104130A1
    • 2008-05-01
    • US11966527
    • 2007-12-28
    • Ahmed Sallam
    • Ahmed Sallam
    • G06F17/00
    • H04L63/145G06F21/554G06F21/56G06F2221/0737G06F2221/2151
    • One or more mobility token managers (101) track movement of files (105) within a network. A mobility token manager (101) on a source computer (113) detects an attempt to write a file (105) to a target computer (117). Responsive to the detection, the mobility token manager (101) writes a mobility token (103) containing data concerning at least the file (105) and the write operation to the target computer (117). A mobility token manager (101) on the target computer (117) detects that the mobility token (103) is being written to the target computer (117). The mobility token manager (101) on the target computer (117) reads the mobility token (103), and determines relevant information concerning the file (105) associated with the mobility token (103).
    • 一个或多个移动性令牌管理器(101)跟踪网络内的文件(105)的移动。 源计算机(113)上的移动性令牌管理器(101)检测将文件(105)写入目标计算机(117)的尝试。 响应于检测,移动性令牌管理器(101)将包含关于至少文件(105)和写入操作的数据的移动性令牌(103)写入目标计算机(117)。 目标计算机(117)上的移动性令牌管理器(101)检测到移动令牌(103)正被写入目标计算机(117)。 目标计算机(117)上的移动性令牌管理器(101)读取移动性令牌(103),并且确定与移动性令牌(103)相关联的文件(105)的相关信息。
    • 10. 发明授权
    • Duplicating handles of target processes without having debug privileges
    • 复制目标进程的句柄,而不具有调试权限
    • US07334163B1
    • 2008-02-19
    • US10870785
    • 2004-06-16
    • Ahmed Sallam
    • Ahmed Sallam
    • G06F11/00
    • G06F11/362
    • A source process duplicates handles owned by a target process, without the source process having debug privileges. A handle duplication manager running in kernel space receives requests from source processes for duplicates of handles owned by remote target processes. In response to a request, the handle duplication manager accesses address space of a target process, and calls a system object duplication function with a request to duplicate the requested handle(s) of the target process. The handle duplication manager running in kernel space calls the system function so as to simulate the origin of the call as being the target process running in user space. The duplication manager receives the requested duplicate handle(s) from the system function, and returns them to the requesting source process.
    • 源进程重复由目标进程拥有的句柄,而源进程具有调试权限。 在内核空间中运行的句柄复制管理器从源进程接收对远程目标进程拥有的句柄的重复的请求。 响应于请求,手柄复制管理器访问目标进程的地址空间,并且通过请求复制所请求的目标进程的句柄来调用系统对象复制功能。 在内核空间中运行的句柄复制管理器调用系统函数,以便将调用的起源模拟为在用户空间中运行的目标进程。 复制管理器从系统函数接收所请求的重复句柄,并将它们返回到请求的源进程。