会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 15. 发明授权
    • Discrimination of malicious changes to digital information using
multiple signatures
    • 使用多个签名对数字信息的恶意更改进行歧视
    • US5572590A
    • 1996-11-05
    • US226610
    • 1994-04-12
    • David M. Chess
    • David M. Chess
    • G06F1/00G06F21/00G11B20/00G11B3/28H04K1/00H04L9/00
    • G06F21/565G06F21/64G06F2211/007G11B20/00086
    • The present system and method uses information about digital information (objects) to determine whether or not changes to the objects were caused by a normal system operation or by a malicious program. The invention uses a reference separation algorithm to separate, at a reference time, one or more digital objects into a plurality of reference subsets of information that describe the object contents. A plurality of these reference subsets are then selected by a selection algorithm and information associated with each selected reference subset is stored. At some later time, called the test time, a test separation algorithm is used to separate the digital signatures of the object into a plurality of test subsets of information that describe the object contents at test time. A plurality of these test subsets are then selected by the test selection algorithm. A test information algorithm that is associated with each selected test subset then develops test subset information about the respective a test subset. The test subset information and the reference subset information is then compared to develop a set of differences. Rules are applied to the set of differences to determine whether the digital information at test time was changed (maliciously) from the digital information at reference time.
    • 本系统和方法使用关于数字信息(对象)的信息来确定对象的改变是否由正常系统操作或恶意程序引起。 本发明使用参考分离算法将参考时间将一个或多个数字对象分成描述对象内容的多个参考信息子集。 然后通过选择算法选择多个这些参考子集,并且存储与每个所选择的参考子集相关联的信息。 在稍后的一段时间,称为测试时间,测试分离算法被用于将对象的数字签名分离成多个在测试时刻描述对象内容的测试信息子集。 然后通过测试选择算法选择多个这些测试子集。 与每个选择的测试子集相关联的测试信息算法然后开发关于相应测试子集的测试子集信息。 然后比较测试子集信息和参考子集信息以形成一组差异。 规则适用于一组差异,以确定在参考时间,数字信息在测试时间是否从恶意地改变(恶意)。
    • 16. 发明授权
    • Automatic immune system for computers and computer networks
    • 用于计算机和计算机网络的自动免疫系统
    • US5440723A
    • 1995-08-08
    • US4872
    • 1993-01-19
    • William C. ArnoldDavid M. ChessJeffrey O. KephartSteven R. White
    • William C. ArnoldDavid M. ChessJeffrey O. KephartSteven R. White
    • G06F1/00G06F21/56H04L29/06G06F11/00
    • H04L63/1441G06F21/564G06F21/566
    • A method includes the following component steps, or some functional subset of these steps: (A) periodic monitoring of a data processing system (10) for anomalous behavior that may indicate the presence of an undesirable software entity such as a computer virus, worm, or Trojan Horse; (B) automatic scanning for occurrences of known types of undesirable software entities and taking remedial action if they are discovered; (C) deploying decoy programs to capture samples of unknown types of computer viruses; (D) identifying machine code portions of the captured samples which are unlikely to vary from one instance of the virus to another; (E) extracting an identifying signature from the executable code portion and adding the signature to a signature database; (F) informing neighboring data processing systems on a network of an occurrence of the undesirable software entity; and (G) generating a distress signal, if appropriate, so as to call upon an expert to resolve difficult cases. A feature of this invention is the automatic execution of the foregoing steps in response to a detection of an undesired software entity, such as a virus or a worm, within a data processing system. The automatic extraction of the identifying signature, the addition of the signature to a signature data base, and the immediate use of the signature by a scanner provides protection from subsequent infections of the system, and also a network of systems, by the same or an altered form of the undesirable software entity.
    • 一种方法包括以下组件步骤或这些步骤的一些功能子集:(A)针对异常行为的数据处理系统(10)的周期性监视,其可以指示存在不期望的软件实体,例如计算机病毒,蠕虫, 或特洛伊木马; (B)自动扫描已知类型的不合需要的软件实体,并发现补救措施; (C)部署诱饵计划以捕获未知类型的计算机病毒样本; (D)识别捕获的样本的机器代码部分,其不可能从病毒的一个实例变化到另一个; (E)从可执行代码部分提取识别签名并将签名添加到签名数据库; (F)通知网络上的相邻数据处理系统出现不期望的软件实体; 和(G)如果适当,产生遇险信号,以呼吁专家解决困难的情况。 本发明的一个特征是响应于在数据处理系统内检测不期望的软件实体(例如病毒或蠕虫)来自动执行上述步骤。 识别签名的自动提取,签名数据库的签名添加以及扫描仪的签名的即时使用提供了保护,防止系统的随后的感染以及系统的相同或不同的系统的网络 改变形式的不良软件实体。
    • 20. 发明申请
    • POLICY-BASED MANAGEMENT SYSTEM WITH AUTOMATIC POLICY SELECTION AND CREATION CAPABILITIES BY USING SINGULAR VALUE DECOMPOSITION TECHNIQUE
    • 基于政策的管理系统,采用单值分解技术,具有自动选择和创建能力
    • US20080235168A1
    • 2008-09-25
    • US12131424
    • 2008-06-02
    • Hoi Y. ChanDavid M. ChessThomas Y. KwokSteve R. White
    • Hoi Y. ChanDavid M. ChessThomas Y. KwokSteve R. White
    • G06F15/18
    • G06N5/02H04L43/02H04L43/08H04L43/16
    • A statistical approach implementing Singular Value Decomposition (SVD) to a policy-based management system for autonomic and on-demand computing applications. The statistical approach empowers a class of applications that require policies to handle ambiguous conditions and allow the system to “evolve” in response to changing operation and environment conditions. In the system and method providing the statistical approach, observed event-policy associated data, which is represented by an event-policy matrix, is treated as a statistical problem with the assumption that there are some underlying or implicit higher order correlations among events and policies. The SVD approach enables such correlations to be modeled, extracted and modified. From these correlations, recommended policies can be selected or created without exact match of policy conditions. With a feedback mechanism, new knowledge can be acquired as new situations occur and the corresponding policies to manage them are recorded and used to generate new event and policy correlations. Consequently, based on these new correlations, new recommended policies can be derived.
    • 一种统计方法,将自适应和按需计算应用程序的单一值分解(SVD)实现到基于策略的管理系统。 统计方法赋予一类应用程序,这些应用程序需要策略来处理模糊的条件,并允许系统根据不断变化的操作和环境条件“演变”。 在提供统计方法的系统和方法中,由事件 - 策略矩阵表示的观察到的事件 - 策略关联数据被视为统计问题,假设在事件和策略之间存在一些潜在或隐含的高阶相关性 。 SVD方法可以对这些相关性进行建模,提取和修改。 根据这些相关性,可以选择或创建推荐的策略,而不会完全匹配策略条件。 通过反馈机制,可以获得新的知识,因为新的情况发生,相应的管理策略被记录并用于生成新的事件和策略相关性。 因此,基于这些新的相关性,可以推导出新的推荐政策。