专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08561198B2 Detection of malicious system calls 有权
标题翻译：检测恶意系统调用
公开(公告)号：US08561198B2
公开(公告)日：2013-10-15
申请号：US12775773
申请日：2010-05-07
申请人： Baibhav Singh , Rahul Kashyap
发明人： Baibhav Singh , Rahul Kashyap
IPC分类号： G06F21/00
CPC分类号： G06F21/52
摘要： Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for detecting malicious system calls. In one aspect, a method includes monitoring a function vulnerable to a buffer overflow attack; receiving a call to the function, the call associated with a call stack, the call stack including one or more base pointers, and a destination buffer associated with the function; identifying a first critical memory address vulnerable to the buffer overflow attack comprising: determining the first critical memory address based on a base pointer of the one or more base pointers, wherein the base pointer address is greater than an address of the destination buffer; identifying a first address based on the base pointer of the one or more base pointers; and determining that the first address is a critical memory address in response to the first memory address is greater than the address of the destination buffer.
摘要翻译：方法，系统和装置，包括在计算机存储介质上编码的用于检测恶意系统呼叫的计算机程序。一方面，一种方法包括监视易受缓冲器溢出攻击的功能; 接收对该功能的呼叫，与呼叫栈相关联的呼叫，该呼叫栈包括一个或多个基本指针以及与该功能相关联的目的地缓冲器; 识别易受到缓冲器溢出攻击的第一关键存储器地址，包括：基于所述一个或多个基本指针的基本指针来确定所述第一关键存储器地址，其中所述基准指针地址大于所述目的地缓冲器的地址; 基于所述一个或多个基本指针的基本指针来识别第一地址; 以及响应于所述第一存储器地址确定所述第一地址是关键存储器地址大于所述目的地缓冲器的地址。

2. 发明授权

US08667594B1 Securing file trust with file format conversions 有权
标题翻译：使用文件格式转换保护文件信任
公开(公告)号：US08667594B1
公开(公告)日：2014-03-04
申请号：US13419356
申请日：2012-03-13
申请人： Gaurav Banga , Rahul Kashyap , Andrew Southgate
发明人： Gaurav Banga , Rahul Kashyap , Andrew Southgate
IPC分类号： G06F21/00
CPC分类号： G06F21/568 , G06F21/56
摘要： Approaches for ensuring a digital file does not contain malicious code. A digital file in an original format may or may not contain malicious code. An intermediate copy of the digital file in an intermediate format is created from the digital file in the original format. The intermediate format preserves a visual or audio presentation of the digital file without supporting metadata or file format data structures of the original format. A sterilized copy of the digital file is created from the intermediate copy. The sterilized copy is in the original format. The sterilized copy comprises a digital signature indicating that the sterilized copy has been converted from the intermediate format to the original format. Advantageously, the sterilized copy is guaranteed to not possess any malicious code.
摘要翻译：确保数字文件的方法不包含恶意代码。原始格式的数字文件可能包含或不包含恶意代码。以原始格式从数字文件创建中间格式的数字文件的中间拷贝。中间格式保留数字文件的视觉或音频呈现，而不支持原始格式的元数据或文件格式数据结构。从中间拷贝创建数字文件的无菌拷贝。灭菌副本是原始格式。灭菌副本包括指示灭菌副本已经从中间格式转换为原始格式的数字签名。有利地，保证无菌拷贝不具有任何恶意代码。

3. 发明申请

US20110277035A1 Detection of Malicious System Calls 有权
标题翻译：检测恶意系统调用
公开(公告)号：US20110277035A1
公开(公告)日：2011-11-10
申请号：US12775773
申请日：2010-05-07
申请人： Baibhav Singh , Rahul Kashyap
发明人： Baibhav Singh , Rahul Kashyap
IPC分类号： G06F12/14 , G06F12/00 , G06F3/00
CPC分类号： G06F21/52
摘要： Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for detecting malicious system calls. In one aspect, a method includes monitoring a function vulnerable to a buffer overflow attack; receiving a call to the function, the call associated with a call stack, the call stack including one or more base pointers, and a destination buffer associated with the function; identifying a first critical memory address vulnerable to the buffer overflow attack comprising: determining the first critical memory address based on a base pointer of the one or more base pointers, wherein the base pointer address is greater than an address of the destination buffer; identifying a first address based on the base pointer of the one or more base pointers; and determining that the first address is a critical memory address in response to the first memory address is greater than the address of the destination buffer.
摘要翻译：方法，系统和装置，包括在计算机存储介质上编码的用于检测恶意系统呼叫的计算机程序。一方面，一种方法包括监视易受缓冲器溢出攻击的功能; 接收对该功能的呼叫，与呼叫栈相关联的呼叫，该呼叫栈包括一个或多个基本指针以及与该功能相关联的目的地缓冲器; 识别易受到缓冲器溢出攻击的第一关键存储器地址，包括：基于所述一个或多个基本指针的基本指针来确定所述第一关键存储器地址，其中所述基准指针地址大于所述目的地缓冲器的地址; 基于所述一个或多个基本指针的基本指针来识别第一地址; 以及响应于所述第一存储器地址确定所述第一地址是关键存储器地址大于所述目的地缓冲器的地址。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式