专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08087061B2 Resource-reordered remediation of malware threats 有权
标题翻译：资源重新排除恶意软件威胁的修复
公开(公告)号：US08087061B2
公开(公告)日：2011-12-27
申请号：US12111371
申请日：2008-04-29
申请人： Michael Sean Jarrett
发明人： Michael Sean Jarrett
IPC分类号： H04L29/06 , G06F11/07
CPC分类号： G06F21/568
摘要： Systems and methods that mitigate affects of malware and facilitate remediation processes. An analysis engine generates a list of actions for resources associated with the malware, and prioritizes/sorts the actions for execution. Such list of actions can be generated automatically via an action list generation component associated with the analysis engine. Likewise, a sorting component as part of the analysis engine can prioritize operations between detected malware to typically ensure a smooth operation during remediation processes (e.g., avoid conflicts).
摘要翻译：减轻恶意软件影响并促进修复过程的系统和方法。分析引擎生成与恶意软件相关联的资源的操作列表，并对执行的操作进行优先排序/排序。可以通过与分析引擎相关联的动作列表生成部件自动生成动作列表。类似地，作为分析引擎的一部分的排序组件可以优先检测检测到的恶意软件之间的操作，以通常确保在修复过程期间的平滑操作（例如，避免冲突）。

2. 发明授权

US09767282B2 Offline scan, clean and telemetry using installed antimalware protection components 有权
公开(公告)号：US09767282B2
公开(公告)日：2017-09-19
申请号：US12967596
申请日：2010-12-14
申请人： Sterling M. Reasor , Kumi N. Hilwa , Eddy S. Hsia , Santanu Chakraborty , Joseph Leo Faulhaber , Vishal Kapoor , Michael Sean Jarrett , Charles Turner , Jeremy D. Croy
发明人： Sterling M. Reasor , Kumi N. Hilwa , Eddy S. Hsia , Santanu Chakraborty , Joseph Leo Faulhaber , Vishal Kapoor , Michael Sean Jarrett , Charles Turner , Jeremy D. Croy
IPC分类号： G06F21/56
CPC分类号： G06F21/564 , G06F21/565 , G06F21/568
摘要： The subject disclosure relates to antimalware scanning, and more particularly to offline antimalware scanning of a host environment via an alternate, known safe operating system. An offline scanning product obtains data previously written by the host environment online antimalware scanning tool, e.g., configuration data and antimalware signatures in shared data stores accessible to the offline and online products, and uses that data to perform the offline antimalware scan. The offline scanning product writes results information and any quarantined files to other shared data stores, whereby the online environment, when rebooted, has access to the information, such as for review and to upload telemetry information to an online service for analysis. Also described is offline replacement of operating system files that cannot be cleaned or removed when online.

3. 发明申请

US20120151582A1 Offline Scan, Clean and Telemetry Using Installed Antimalware Protection Components 有权
标题翻译：使用安装的反恶意软件保护组件进行离线扫描，清洁和遥测
公开(公告)号：US20120151582A1
公开(公告)日：2012-06-14
申请号：US12967596
申请日：2010-12-14
申请人： Sterling M. Reasor , Kumi N. Hilwa , Eddy S. Hsia , Santanu Chakraborty , Joseph Leo Faulhaber , Vishal Kapoor , Michael Sean Jarrett , Charles Turner , Jeremy D. Croy
发明人： Sterling M. Reasor , Kumi N. Hilwa , Eddy S. Hsia , Santanu Chakraborty , Joseph Leo Faulhaber , Vishal Kapoor , Michael Sean Jarrett , Charles Turner , Jeremy D. Croy
IPC分类号： G06F21/00
CPC分类号： G06F21/564 , G06F21/565 , G06F21/568
摘要： The subject disclosure relates to antimalware scanning, and more particularly to offline antimalware scanning of a host environment via an alternate, known safe operating system. An offline scanning product obtains data previously written by the host environment online antimalware scanning tool, e.g., configuration data and antimalware signatures in shared data stores accessible to the offline and online products, and uses that data to perform the offline antimalware scan. The offline scanning product writes results information and any quarantined files to other shared data stores, whereby the online environment, when rebooted, has access to the information, such as for review and to upload telemetry information to an online service for analysis. Also described is offline replacement of operating system files that cannot be cleaned or removed when online.
摘要翻译：主题公开涉及反恶意软件扫描，更具体地涉及经由替代的已知安全操作系统的主机环境的离线反恶意软件扫描。脱机扫描产品获得先前由主机环境在线反恶意软件扫描工具写入的数据，例如在脱机和在线产品可访问的共享数据存储器中的配置数据和反恶意软件签名，并使用该数据执行脱机反恶意软件扫描。离线扫描产品将结果信息和任何隔离文件写入其他共享数据存储，从而在重新启动时，在线环境可以访问信息，例如查看信息，并将遥测信息上传到在线服务进行分析。还描述了在线时不能清理或删除的操作系统文件的离线替换。

4. 发明申请

US20090044272A1 RESOURCE-REORDERED REMEDIATION OF MALWARE THREATS 有权
标题翻译：资源重新纠正恶意威胁
公开(公告)号：US20090044272A1
公开(公告)日：2009-02-12
申请号：US12111371
申请日：2008-04-29
申请人： Michael Sean Jarrett
发明人： Michael Sean Jarrett
IPC分类号： G06F21/00
CPC分类号： G06F21/568
摘要： Systems and methods that mitigate affects of malware and facilitate remediation processes. An analysis engine generates a list of actions for resources associated with the malware, and prioritizes/sorts the actions for execution. Such list of actions can be generated automatically via an action list generation component associated with the analysis engine. Likewise, a sorting component as part of the analysis engine can prioritize operations between detected malware to typically ensure a smooth operation during remediation processes (e.g., avoid conflicts).
摘要翻译：减轻恶意软件影响并促进修复过程的系统和方法。分析引擎生成与恶意软件相关联的资源的操作列表，并对执行的操作进行优先排序/排序。可以通过与分析引擎相关联的动作列表生成部件自动生成动作列表。类似地，作为分析引擎的一部分的排序组件可以优先检测检测到的恶意软件之间的操作，以通常确保在修复过程期间的平滑操作（例如，避免冲突）。

5. 发明授权

US09436826B2 Discovering malicious input files and performing automatic and distributed remediation 有权
标题翻译：发现恶意输入文件并执行自动和分布式修复
公开(公告)号：US09436826B2
公开(公告)日：2016-09-06
申请号：US13161950
申请日：2011-06-16
申请人： Vishal Kapoor , Jonathan Mark Keller , Ajith Kumar , Adrian M. Marinescu , Marc E. Seinfeld , Anil Francis Thomas , Michael Sean Jarrett , Joseph J. Johnson , Joseph L. Faulhaber
发明人： Vishal Kapoor , Jonathan Mark Keller , Ajith Kumar , Adrian M. Marinescu , Marc E. Seinfeld , Anil Francis Thomas , Michael Sean Jarrett , Joseph J. Johnson , Joseph L. Faulhaber
IPC分类号： G06F21/56 , G06F21/52 , G06F21/55 , H04L29/06
CPC分类号： G06F21/566 , G06F21/52 , G06F21/552 , G06F21/554 , G06F21/56 , G06F21/568 , G06F2221/2101 , H04L63/145
摘要： The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.
摘要翻译：本发明涉及通过允许打开输入文件以及通过监视与可能指示恶意软件的打开文件相对应的一个或多个行为来检测输入文件中的恶意软件或可能的恶意软件。可以监视由此引起的某些可执行文件和/或文件类型，当观察到不当的行为时，各种收集的事件数据用于反恶意软件目的。示例行为包括将文件写入存储，生成网络流量，注入进程，运行脚本和/或编写系统注册表数据。遥测数据和/或文件样本可以被发送到反恶意软件服务，并且可以执行恶意软件修复。数据（例如，收集的事件）可以被分发到其他节点以用于反恶意软件检测，例如阻止类似文件的执行。

6. 发明申请

US20120144489A1 Antimalware Protection of Virtual Machines 审中-公开
标题翻译：虚拟机的反恶意软件保护
公开(公告)号：US20120144489A1
公开(公告)日：2012-06-07
申请号：US12961854
申请日：2010-12-07
申请人： Michael Sean Jarrett , Joseph Jared Johnson , Vishal Kapoor , Anil Francis Thomas , Eugene John Neystadt , Dennis Scott Batchelder
发明人： Michael Sean Jarrett , Joseph Jared Johnson , Vishal Kapoor , Anil Francis Thomas , Eugene John Neystadt , Dennis Scott Batchelder
IPC分类号： G06F21/00
CPC分类号： G06F21/566 , G06F9/45558 , G06F21/568 , G06F2009/45587
摘要： The subject disclosure is directed towards protecting virtual machines on guest partitions from malware in a resource-efficient manner. Antimalware software is divided into lightweight agents that run on each malware-protected guest partition, a shared scanning and signature update mechanism, and a management component. Each agent provides the scanning mechanism with files to scan for malware, such as by running a script, and receives results from the scanning mechanism including possible remediation actions to perform. The management component provides the scanning mechanism with access to virtual machine services, such as to pause, resume, snapshot and rollback guest partitions as requested by the scanning mechanism.
摘要翻译：主题公开旨在以资源有效的方式保护来宾分区上的虚拟机与恶意软件。反恶意软件分为在每个受恶意软件保护的客户机分区，共享扫描和签名更新机制以及管理组件上运行的轻量级代理。每个代理为扫描机构提供扫描恶意软件的文件，例如通过运行脚本，并从扫描机制接收结果，包括可执行的修复操作。管理组件为扫描机制提供了访问虚拟机服务的扫描机制，例如按照扫描机制的要求暂停，恢复，快照和回滚客户机分区。

7. 发明申请

US20120297488A1 Discovering Malicious Input Files and Performing Automatic and Distributed Remediation 有权
标题翻译：发现恶意输入文件并执行自动和分布式修复
公开(公告)号：US20120297488A1
公开(公告)日：2012-11-22
申请号：US13161950
申请日：2011-06-16
申请人： Vishal Kapoor , Jonathan Mark Keller , Ajith Kumar , Adrian M. Marinescu , Marc E. Seinfeld , Anil Francis Thomas , Michael Sean Jarrett , Joseph J. Johnson , Joseph L. Faulhaber
发明人： Vishal Kapoor , Jonathan Mark Keller , Ajith Kumar , Adrian M. Marinescu , Marc E. Seinfeld , Anil Francis Thomas , Michael Sean Jarrett , Joseph J. Johnson , Joseph L. Faulhaber
IPC分类号： G06F11/00
CPC分类号： G06F21/566 , G06F21/52 , G06F21/552 , G06F21/554 , G06F21/56 , G06F21/568 , G06F2221/2101 , H04L63/145
摘要： The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.
摘要翻译：本发明涉及通过允许打开输入文件以及通过监视与可能指示恶意软件的打开文件相对应的一个或多个行为来检测输入文件中的恶意软件或可能的恶意软件。可以监视由此引起的某些可执行文件和/或文件类型，当观察到不当的行为时，各种收集的事件数据用于反恶意软件目的。示例行为包括将文件写入存储，生成网络流量，注入进程，运行脚本和/或编写系统注册表数据。遥测数据和/或文件样本可以被发送到反恶意软件服务，并且可以执行恶意软件修复。数据（例如，收集的事件）可以被分发到其他节点以用于反恶意软件检测，例如阻止类似文件的执行。

8. 发明申请

US20090217378A1 Boot Time Remediation of Malware 审中-公开
标题翻译：启动时间修复恶意软件
公开(公告)号：US20090217378A1
公开(公告)日：2009-08-27
申请号：US12038792
申请日：2008-02-27
申请人： Joseph Jared Johnson , Catalin Daniel Sandu , Michael Sean Jarrett
发明人： Joseph Jared Johnson , Catalin Daniel Sandu , Michael Sean Jarrett
IPC分类号： G06F21/00
CPC分类号： G06F21/568 , G06F21/56
摘要： Aspects of the subject matter described herein relate to removing malware from a computer system. In aspects, an anti-malware engine detects malware and writes a tool onto a storage device. The anti-malware engine disguises the tool to make it more difficult for malware to detect that the tool is on the storage device. In addition, the anti-malware engine encrypts and writes remediation actions to be taken by the tool to the storage device and requests that the computer reboot. After rebooting, the computer executes the tool which takes the remediation actions including removing the malware.
摘要翻译：本文描述的主题的方面涉及从计算机系统去除恶意软件。在这方面，反恶意软件引擎可以检测恶意软件并将工具写入存储设备。反恶意软件引擎伪装该工具，使恶意软件更难以检测到该工具位于存储设备上。此外，反恶意软件引擎加密并将工具采取的修复操作写入存储设备，并请求计算机重新启动。重新启动后，计算机将执行修复操作的工具，包括删除恶意软件。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式