专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08578080B2 Secure handling of interrupted events utilizing a virtual interrupt definition table 有权
标题翻译：使用虚拟中断定义表安全处理中断的事件
公开(公告)号：US08578080B2
公开(公告)日：2013-11-05
申请号：US13175544
申请日：2011-07-01
申请人： Ravi L. Sahita , Xiaoning Li , Manohar R. Castelino
发明人： Ravi L. Sahita , Xiaoning Li , Manohar R. Castelino
IPC分类号： G06F13/32 , G06F13/24
CPC分类号： G06F13/24 , G06F9/45558 , G06F21/53 , G06F2009/45579
摘要： Various embodiments of this disclosure may describe method, apparatus and system for reducing system latency caused by switching memory page permission views between programs while still protecting critical regions of the memory from attacks of malwares. Other embodiments may be disclosed and claimed.
摘要翻译：本公开的各种实施例可以描述用于减少由程序之间切换存储器页面许可视图而引起的系统延迟的方法，装置和系统，同时仍保护存储器的关键区域免受恶意软件的攻击。可以公开和要求保护其他实施例。

2. 发明申请

US20130007325A1 SECURE HANDLING OF INTERRUPTED EVENTS 有权
标题翻译：安全处理中断事件
公开(公告)号：US20130007325A1
公开(公告)日：2013-01-03
申请号：US13175544
申请日：2011-07-01
申请人： Ravi L. Sahita , Xiaoning Li , Manohar R. Castelino
发明人： Ravi L. Sahita , Xiaoning Li , Manohar R. Castelino
IPC分类号： G06F13/24
CPC分类号： G06F13/24 , G06F9/45558 , G06F21/53 , G06F2009/45579
摘要： Various embodiments of this disclosure may describe method, apparatus and system for reducing system latency caused by switching memory page permission views between programs while still protecting critical regions of the memory from attacks of malwares. Other embodiments may be disclosed and claimed.
摘要翻译：本公开的各种实施例可以描述用于减少由程序之间切换存储器页面许可视图而引起的系统延迟的方法，装置和系统，同时仍保护存储器的关键区域免受恶意软件的攻击。可以公开和要求保护其他实施例。

3. 发明授权

US08479295B2 Method and apparatus for transparently instrumenting an application program 有权
标题翻译：用于透明地调试应用程序的方法和装置
公开(公告)号：US08479295B2
公开(公告)日：2013-07-02
申请号：US13076378
申请日：2011-03-30
申请人： Ravi L. Sahita , David M. Durham , Prashant Dewan , Manohar R. Castelino
发明人： Ravi L. Sahita , David M. Durham , Prashant Dewan , Manohar R. Castelino
IPC分类号： G06F12/14 , G06F9/44
CPC分类号： G06F21/54 , G06F11/3644 , G06F21/566
摘要： Generally, this disclosure describes systems and methods for transparently instrumenting a computer process. The systems and methods are configured to allow instrumenting executable code while permitting legacy memory scanning tools to monitor corresponding uninstrumented executable code stored in memory.
摘要翻译：通常，本公开描述了用于透明地测试计算机进程的系统和方法。这些系统和方法被配置为允许检测可执行代码，同时允许旧的存储器扫描工具来监视存储在存储器中的相应的未被记录的可执行代码。

4. 发明申请

US20150379263A1 TECHNOLOGIES FOR PREVENTING HOOK-SKIPPING ATTACKS USING PROCESSOR VIRTUALIZATION FEATURES 有权
标题翻译：使用处理器虚拟化功能防止跳槽攻击的技术
公开(公告)号：US20150379263A1
公开(公告)日：2015-12-31
申请号：US14318215
申请日：2014-06-27
申请人： Harshawardhan Vipat , Manohar R. Castelino , Ravi L. Sahita , Sergio Rodriguez , Vikas Gupta
发明人： Harshawardhan Vipat , Manohar R. Castelino , Ravi L. Sahita , Sergio Rodriguez , Vikas Gupta
IPC分类号： G06F21/56
CPC分类号： G06F21/79 , G06F21/62
摘要： Technologies for monitoring system API calls include a computing device with hardware virtualization support. The computing device establishes a default memory view and a security memory view to define physical memory maps and permissions. The computing device executes an application in the default memory view and executes a default inline hook in response to a call to an API function. The default inline hook switches to the security memory view using hardware support without causing a virtual machine exit. The security inline hook calls a security callback function to validate the API function call in the security memory view. Hook-skipping attacks may be prevented by padding the default inline hook with no-operation instructions, by designating memory pages of the API function as non-executable in the default memory view, or by designating memory pages of the application as non-executable in the security memory view. Other embodiments are described and claimed.
摘要翻译：用于监视系统API调用的技术包括具有硬件虚拟化支持的计算设备。计算设备建立默认内存视图和安全内存视图来定义物理内存映射和权限。计算设备在默认存储器视图中执行应用程序，并响应于对API函数的调用执行默认内联钩子。默认内联挂钩将使用硬件支持切换到安全内存视图，而不会导致虚拟机退出。安全内联钩调用安全回调函数来验证安全内存视图中的API函数调用。通过将默认内存视图中的不可执行的API函数的内存页指定为不可执行的内存页，或者通过将应用程序的内存页指定为不可执行的方式，可以通过使用无操作指令填充默认内联钩来防止跳钩攻击安全内存视图。描述和要求保护其他实施例。

5. 发明申请

US20120255015A1 METHOD AND APPARATUS FOR TRANSPARENTLY INSTRUMENTING AN APPLICATION PROGRAM 有权
标题翻译：透明度测量应用程序的方法和设备
公开(公告)号：US20120255015A1
公开(公告)日：2012-10-04
申请号：US13076378
申请日：2011-03-30
申请人： Ravi L. Sahita , David M. Durham , Prashant Dewan , Manohar R. Castelino
发明人： Ravi L. Sahita , David M. Durham , Prashant Dewan , Manohar R. Castelino
IPC分类号： G06F11/00 , G06F9/44
CPC分类号： G06F21/54 , G06F11/3644 , G06F21/566
摘要： Generally, this disclosure describes systems and methods for transparently instrumenting a computer process. The systems and methods are configured to allow instrumenting executable code while permitting legacy memory scanning tools to monitor corresponding uninstrumented executable code stored in memory.
摘要翻译：通常，本公开描述了用于透明地测试计算机进程的系统和方法。这些系统和方法被配置为允许检测可执行代码，同时允许旧的存储器扫描工具来监视存储在存储器中的相应的未被记录的可执行代码。

6. 发明申请

US20180189489A1 MALICIOUS OBJECT DETECTION IN A RUNTIME ENVIRONMENT 审中-公开
公开(公告)号：US20180189489A1
公开(公告)日：2018-07-05
申请号：US15395053
申请日：2016-12-30
申请人： Mingwei Zhang , Xiaoning Li , Ravi L. Sahita , Aravind Subramanian , Abhay S. Kanhere , Chih-Yuan Yang , Yi Gai
发明人： Mingwei Zhang , Xiaoning Li , Ravi L. Sahita , Aravind Subramanian , Abhay S. Kanhere , Chih-Yuan Yang , Yi Gai
IPC分类号： G06F21/56 , H04L29/06 , G06N99/00
摘要： A malicious object detection system for use in managed runtime environments includes a check circuit to receive call information generated by an application, such as an Android application. A machine learning circuit coupled to the check circuit applies a machine learning model to assess the information and/or data included in the call and detect the presence of a malicious object, such as malware or a virus, in the application generating the call. The machine learning model may include a global machine learning model distributed across a number of devices, a local machine learning model based on use patterns of a particular device, or combinations thereof. A graphical user interface management circuit halts execution of applications containing malicious objects and generates a user perceptible output.

7. 发明申请

US20180046803A1 TECHNOLOGIES FOR HARDWARE ASSISTED NATIVE MALWARE DETECTION 审中-公开
公开(公告)号：US20180046803A1
公开(公告)日：2018-02-15
申请号：US15235806
申请日：2016-08-12
申请人： Xiaoning Li , Ravi L. Sahita , David M. Durham
发明人： Xiaoning Li , Ravi L. Sahita , David M. Durham
IPC分类号： G06F21/56 , G06F21/52 , G06F11/14
CPC分类号： G06F21/566 , G06F11/1417 , G06F11/302 , G06F11/3089 , G06F21/54 , G06F2201/84
摘要： Technologies for hardware assisted native malware detection include a computing device. The computing device includes one or more processors with hook logic to monitor for execution of branch instructions of an application, compare the monitored branch instructions to filter criteria, and determine whether a monitored branch instruction satisfies the filter criteria. Additionally, the computing device includes a malware detector to provide the filter criteria to the hook logic, provide an address of a callback function to the hook logic to be executed in response to a determination that a monitored branch instruction satisfies the filter criteria, and analyze, in response to execution of the callback function, the monitored branch instruction to determine whether the monitored branch instruction is indicative of malware. Other embodiments are also described and claimed.

8. 发明申请

US20160180079A1 Execution Profiling Mechanism 有权
标题翻译：执行分析机制
公开(公告)号：US20160180079A1
公开(公告)日：2016-06-23
申请号：US14576665
申请日：2014-12-19
申请人： Ravi L. Sahita , Xiaoning Li , Barry E. Huntley , Ofer Levy , Vedvyas Shanbhogue , Yuriy Bulygin , Ido Ouziel , Michael Lemay , John M. Esper
发明人： Ravi L. Sahita , Xiaoning Li , Barry E. Huntley , Ofer Levy , Vedvyas Shanbhogue , Yuriy Bulygin , Ido Ouziel , Michael Lemay , John M. Esper
IPC分类号： G06F21/52
CPC分类号： G06F21/52 , G06F9/45558 , G06F11/30 , G06F21/554 , G06F2009/45591 , G06F2221/033
摘要： A method comprises filtering branch trap events at a branch event filter, monitoring a branch event filter to capture indirect branch trap events that cause a control flow trap exception, receiving the indirect branch trap events at a handler and the handler processing the indirect branch trap events
摘要翻译：一种方法包括在分支事件过滤器处过滤分支陷阱事件，监视分支事件过滤器以捕获导致控制流陷阱异常的间接分支陷阱事件，在处理器处接收间接分支陷阱事件，并处理处理间接分支陷阱事件

9. 发明申请

US20160283714A1 TECHNOLOGIES FOR CONTROL FLOW EXPLOIT MITIGATION USING PROCESSOR TRACE 有权
标题翻译：使用处理器跟踪控制流量开采减少的技术
公开(公告)号：US20160283714A1
公开(公告)日：2016-09-29
申请号：US14670988
申请日：2015-03-27
申请人： Michael LeMay , Ravi L. Sahita , Beeman C. Strong , Thilo Schmitt , Yuriy Bulygin , Markus T. Metzger
发明人： Michael LeMay , Ravi L. Sahita , Beeman C. Strong , Thilo Schmitt , Yuriy Bulygin , Markus T. Metzger
IPC分类号： G06F21/56 , G06F21/44
CPC分类号： G06F21/56 , G06F21/44 , G06F21/52
摘要： Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.
摘要翻译：用于控制流利用减轻的技术包括具有具有实时指令跟踪支持的处理器的计算设备。在处理过程中，处理器产生指示过程控制流的跟踪数据。计算设备分析跟踪数据以识别可疑的控制流攻击。计算设备可以使用启发式算法来识别返回导向的编程漏洞。计算设备可以基于跟踪数据来维护阴影栈。计算设备可以基于跟踪数据来识别对未授权地址的间接分支，以识别面向跳跃的编程漏洞。每当进程被抢占时，计算设备可以检查跟踪数据。处理器可以实时地检测错误的返回指令，并且在该过程的过程空间中调用软件处理程序以验证和维护该影子栈。描述和要求保护其他实施例。

10. 发明授权

US09286245B2 Hardware enforced memory access permissions 有权
标题翻译：硬件强制执行内存访问权限
公开(公告)号：US09286245B2
公开(公告)日：2016-03-15
申请号：US13995360
申请日：2011-12-30
申请人： David M. Durham , Ravi L. Sahita , Prashant Dewan
发明人： David M. Durham , Ravi L. Sahita , Prashant Dewan
IPC分类号： G06F21/00 , G06F12/14 , G06F21/50 , G06F21/12 , G06F21/79
CPC分类号： G06F12/1458 , G06F21/121 , G06F21/50 , G06F21/79
摘要： Embodiments of apparatuses and methods for hardware enforced memory access permissions are disclosed. In one embodiment, a processor includes address translation hardware and memory access hardware. The address translation hardware is to support translation of a first address, used by software to access a memory, to a second address, used by the processor to access the memory. The memory access hardware is to detect an access permission violation.
摘要翻译：公开了用于硬件强制存储器访问许可的装置和方法的实施例。在一个实施例中，处理器包括地址转换硬件和存储器访问硬件。地址转换硬件是支持由软件使用的访问存储器的第一地址到由处理器使用以访问存储器的第二地址的翻译。内存访问硬件是检测访问权限冲突。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式