专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US09275229B2 System to bypass a compromised mass storage device driver stack and method thereof 有权
标题翻译：绕过受损的大容量存储设备驱动程序堆栈的系统及其方法
公开(公告)号：US09275229B2
公开(公告)日：2016-03-01
申请号：US13421843
申请日：2012-03-15
申请人： Aaron LeMasters
发明人： Aaron LeMasters
IPC分类号： G06F11/00 , G06F21/57
CPC分类号： G06F21/572 , G06F21/568 , G06F21/85 , G06F2221/033
摘要： A method to circumvent malicious software via a system configured to bypass a device driver stack and, consequently, also bypass the malicious software that may be adversely affecting the device driver stack by using an alternative stack such as a crash dump I/O stack. The crash dump I/O stack is poorly documented relative to the device driver stack and functions independently from the device driver stack.
摘要翻译：通过配置为绕过设备驱动程序堆栈的系统来绕过恶意软件的方法，并因此也绕过可能通过使用替代堆栈（如崩溃转储I / O堆栈）而对设备驱动程序堆栈产生不利影响的恶意软件。崩溃转储I / O堆栈相对于设备驱动程序堆栈的记录不良，并且独立于设备驱动程序堆栈。

2. 发明授权

US08881271B2 System and method for forensic identification of elements within a computer system 有权
标题翻译：计算机系统中元素的法医识别系统和方法
公开(公告)号：US08881271B2
公开(公告)日：2014-11-04
申请号：US12184898
申请日：2008-08-01
申请人： James Robert Butler, II
发明人： James Robert Butler, II
IPC分类号： G06F12/14 , H04L29/06 , H04L9/32 , G06F9/44 , G06F21/57
CPC分类号： G06F21/577
摘要： A system and method for employing memory forensic techniques to determine operating system type, memory management configuration, and virtual machine status on a running computer system. The techniques apply advanced techniques in a fashion to make them usable and accessible by Information Technology professionals that may not necessarily be versed in the specifics of memory forensic methodologies and theory.
摘要翻译：一种使用存储器取证技术来确定运行的计算机系统上的操作系统类型，存储器管理配置和虚拟机状态的系统和方法。这些技术以一种方式应用先进技术，使其可以被信息技术专业人员使用和访问，这些专业人士可能不一定熟悉记忆法证方法和理论的细节。

3. 发明授权

US09268936B2 Physical memory forensics system and method 有权
标题翻译：物理内存取证系统及方法
公开(公告)号：US09268936B2
公开(公告)日：2016-02-23
申请号：US13560415
申请日：2012-07-27
申请人： James Butler
发明人： James Butler
IPC分类号： G06F12/10 , G06F21/55 , G06F21/64
CPC分类号： G06F21/554 , G06F12/10 , G06F21/64
摘要： The method of the present inventive concept is configured to utilize Operating System data structures related to memory-mapped binaries to reconstruct processes. These structures provide a system configured to facilitate the acquisition of data that traditional memory analysis tools fail to identify, including by providing a system configured to traverse a virtual address descriptor, determine a pointer to a control area, traverse a PPTE array, copy binary data identified in the PPTE array, generate markers to determine whether the binary data is compromised, and utilize the binary data to reconstruct a process.
摘要翻译：本发明构思的方法被配置为利用与存储器映射二进制文件相关的操作系统数据结构来重构进程。这些结构提供了一种系统，其被配置为便于采集传统存储器分析工具无法识别的数据，包括通过提供被配置为遍历虚拟地址描述符的系统，确定到控制区域的指针，遍历PPTE阵列，复制二进制数据在PPTE数组中识别，生成标记以确定二进制数据是否受到损害，并利用二进制数据来重构进程。

4. 发明授权

US08949257B2 Method and system for collecting and organizing data corresponding to an event 有权
标题翻译：用于收集和组织与事件对应的数据的方法和系统
公开(公告)号：US08949257B2
公开(公告)日：2015-02-03
申请号：US12024852
申请日：2008-02-01
申请人： Jason Shiffer , Matthew Frazier , Sean Cunningham , Scott Hogsten , Eric Helvey , James Butler , Peter Villadsen
发明人： Jason Shiffer , Matthew Frazier , Sean Cunningham , Scott Hogsten , Eric Helvey , James Butler , Peter Villadsen
IPC分类号： G06F7/00 , G06F17/30
CPC分类号： G06F17/30312 , G06F17/30321 , G06F17/30424 , G06F17/30675
摘要： A system and method for analyzing data from a plurality of computer environments. The computer environments are authenticated and data is imported to a memory location. The data is converted into a uniform format to enable expedited searching by one or more authenticated users. The data may be marked so that a user may determine which computer environment provided the data. The system may also create one or more indexes of the data to assist one or more users in searching the data.
摘要翻译：一种用于分析来自多个计算机环境的数据的系统和方法。计算机环境经过身份验证，数据导入到内存位置。将数据转换为统一格式，以便一个或多个经过身份验证的用户进行快速搜索。可以标记数据，使得用户可以确定提供数据的哪个计算机环境。系统还可以创建数据的一个或多个索引以帮助一个或多个用户搜索数据。

5. 发明授权

US08713681B2 System and method for detecting executable machine instructions in a data stream 有权
标题翻译：用于检测数据流中的可执行机器指令的系统和方法
公开(公告)号：US08713681B2
公开(公告)日：2014-04-29
申请号：US12607055
申请日：2009-10-27
申请人： Peter J. Silberman , James R. Butler, II , Nick J. Harbour
发明人： Peter J. Silberman , James R. Butler, II , Nick J. Harbour
IPC分类号： G06F12/14 , H04L29/06 , H04L9/32
CPC分类号： G06F21/562 , G06F21/56 , G06F2221/033
摘要： Detecting executable machine instructions in a data is accomplished by accessing a plurality of values representing data contained within a memory of a computer system and performing pre-processing on the plurality of values to produce a candidate data subset. The pre-processing may include determining whether the plurality of values meets (a) a randomness condition, (b) a length condition, and/or (c) a string ratio condition. The candidate data subset is inspected for computer instructions, characteristics of the computer instructions are determined, and a predetermined action taken based on the characteristics of the computer instructions.
摘要翻译：检测数据中的可执行机器指令是通过访问表示计算机系统的存储器内的数据的多个值来完成的，并且对多个值执行预处理以产生候选数据子集。预处理可以包括确定多个值是否满足（a）随机条件，（b）长度条件和/或（c）字符串比率条件。对候选数据子集进行计算机指令的检查，确定计算机指令的特性，并根据计算机指令的特性进行预定的动作。

6. 发明授权

US08713051B2 System and method for data preservation and retrieval 有权
公开(公告)号：US08713051B2
公开(公告)日：2014-04-29
申请号：US13073357
申请日：2011-03-28
申请人： Matthew Frazier , Jason Shiffer , David Merkel , Kevin Mandia , Matthew Pepe
发明人： Matthew Frazier , Jason Shiffer , David Merkel , Kevin Mandia , Matthew Pepe
IPC分类号： G06F17/30
摘要： A system and method for searching for computer environments, authenticating the computer environments, and copying data from the authenticated computer environments to a memory location. The data is marked or bound to the computer system it was copied from which provides a user with assurance that the data was obtained from a specific, authenticated source. The computer environments and the memory location may be coupled over a network.

7. 发明授权

US09106630B2 Method and system for collaboration during an event 有权
标题翻译：活动期间协作的方法和系统
公开(公告)号：US09106630B2
公开(公告)日：2015-08-11
申请号：US12024834
申请日：2008-02-01
申请人： Matthew Frazier , Jason Shiffer , David Merkel , Kevin Mandia , Lois Cozzi , Matthew Pepe
发明人： Matthew Frazier , Jason Shiffer , David Merkel , Kevin Mandia , Lois Cozzi , Matthew Pepe
IPC分类号： G06F12/14 , H04L29/06 , G06F21/62
CPC分类号： H04L63/08 , G06F21/6218 , H04L63/101 , H04L63/14
摘要： A system and method for gathering data from a plurality of computer environments. The computer environments are authenticated, data is copied from the plurality of authenticated computer environments to a memory location, and access to the memory location is provided to a plurality of authenticated users. The data may be marked so that a user may determine which computer environment provided the data.
摘要翻译：一种用于从多个计算机环境收集数据的系统和方法。计算机环境被认证，将数据从多个经认证的计算机环境复制到存储器位置，并且向多个认证用户提供对存储器位置的访问。可以标记数据，使得用户可以确定提供数据的哪个计算机环境。

8. 发明授权

US08793278B2 System and method for data preservation and retrieval 有权
标题翻译：数据保存和检索的系统和方法
公开(公告)号：US08793278B2
公开(公告)日：2014-07-29
申请号：US13073357
申请日：2011-03-28
申请人： Matthew Frazier , Jason Shiffer , David Merkel , Kevin Mandia , Matthew Pepe
发明人： Matthew Frazier , Jason Shiffer , David Merkel , Kevin Mandia , Matthew Pepe
IPC分类号： G06F17/30 , G06F21/64
CPC分类号： G06F17/30091 , G06F17/301 , G06F21/645 , G06F2221/2101
摘要： A system and method for searching for computer environments, authenticating the computer environments, and copying data from the authenticated computer environments to a memory location. The data is marked or bound to the computer system it was copied from which provides a user with assurance that the data was obtained from a specific, authenticated source. The computer environments and the memory location may be coupled over a network.
摘要翻译：用于搜索计算机环境，认证计算机环境以及将数据从认证的计算机环境复制到存储器位置的系统和方法。数据被标记或绑定到从其复制的计算机系统，该计算机系统向用户保证数据是从特定的，经过身份验证的源获得的。计算机环境和存储器位置可以通过网络耦合。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式