会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 6. 发明申请
    • Method and Apparatus for Determination of the Non-Replicative Behavior of a Malicious Program
    • 用于确定恶意程序的非复制行为的方法和装置
    • US20080256633A1
    • 2008-10-16
    • US12141165
    • 2008-06-18
    • William C. ARNOLDDavid M. ChessJohn F. MorarAlla SegalIan N. WhalleySteve R. White
    • William C. ARNOLDDavid M. ChessJohn F. MorarAlla SegalIan N. WhalleySteve R. White
    • G06F12/14
    • G06F21/566
    • Disclosed is a method, a computer system and a computer readable media product that contains a set of computer executable software instructions for directing the computer system to execute a process for determining a non-replicative behavior of a program that is suspected of containing an undesirable software entity. The process causes execution of the program in at least one known environment and automatically examines the at least one known environment to detect if a change has occurred in the environment as a result of the execution of the program. If a change is detected, the process automatically analyzes the detected change (i.e., the process performs a side effects analysis) to determine if the change resulted from execution of the program or from execution of the undesirable software entity. The process then uses the result of the analysis at least for undoing a detected change that results from execution of the undesirable software entity. The result of the analysis can also be used for informing a user of an anti-virus system of the non-replicative changes made to the environment.
    • 公开了一种方法,计算机系统和计算机可读介质产品,其包含一组计算机可执行软件指令,用于指导计算机系统执行用于确定怀疑含有不期望的软件的程序的非复制行为的过程 实体。 该过程导致在至少一个已知环境中执行该程序,并且自动检查该至少一个已知环境以检测由于该程序的执行而在该环境中是否发生了改变。 如果检测到改变,则该过程自动分析检测到的变化(即,过程执行副作用分析),以确定改变是由执行程序还是由不期望的软件实体的执行引起。 该过程然后使用分析结果至少用于撤销由不期望的软件实体的执行导致的检测到的改变。 分析的结果也可以用于向用户通知反病毒系统对环境的非复制变化。
    • 8. 发明授权
    • Method and apparatus for increasing virus detection speed using a database
    • 使用数据库增加病毒检测速度的方法和装置
    • US06952776B1
    • 2005-10-04
    • US09401596
    • 1999-09-22
    • David M. Chess
    • David M. Chess
    • G06F12/14G06F21/00
    • G06F21/564Y10S707/99944
    • A virus detection method for use in a computer system that contains at least one object that may potentially become infected with a computer virus. The method has steps of providing a database for storing information that is descriptive of a state of the object as it existed at a point in the past. For an object that is indicated as having a current state that is described by the stored information, another step programmatically examines the object for a presence of a computer virus while assuming that the current state of the object is the same as the state of the object as it existed at the point in the past. The the database stores additional information, beyond what is necessary to determine simply whether or not a particular object, such as a file, has changed. The additional information is employed to achieve a more rapid virus scan, even when the list of viruses being scanned for has changed since a previous scan.
    • 一种用于计算机系统中的病毒检测方法,其包含至少一个可能被计算机病毒感染的对象。 该方法具有提供用于存储描述当前存在的对象的状态的信息的数据库的步骤。 对于被指示为具有由所存储的信息描述的当前状态的对象,另一步骤以编程方式检查对象以存在计算机病毒,同时假定对象的当前状态与对象的状态相同 因为它在过去的存在。 数据库存储附加信息,超出了确定简单的特定对象(如文件)是否已更改所必需的信息。 即使当扫描的病毒列表自从以前的扫描以来已经改变时,使用附加信息来实现更快速的病毒扫描。
    • 9. 发明授权
    • Method and apparatus for determination of the non-replicative behavior of a malicious program
    • 用于确定恶意程序的非复制行为的方法和装置
    • US07861300B2
    • 2010-12-28
    • US12141165
    • 2008-06-18
    • William C. ArnoldDavid M. ChessJohn F. MorarAlla SegalIan N. WhalleySteve R. White
    • William C. ArnoldDavid M. ChessJohn F. MorarAlla SegalIan N. WhalleySteve R. White
    • G06F11/00
    • G06F21/566
    • Disclosed is a method, a computer system and a computer readable media product that contains a set of computer executable software instructions for directing the computer system to execute a process for determining a non-replicative behavior of a program that is suspected of containing an undesirable software entity. The process causes execution of the program in at least one known environment and automatically examines the at least one known environment to detect if a change has occurred in the environment as a result of the execution of the program. If a change is detected, the process automatically analyzes the detected change (i.e., the process performs a side effects analysis) to determine if the change resulted from execution of the program or from execution of the undesirable software entity. The process then uses the result of the analysis at least for undoing a detected change that results from execution of the undesirable software entity. The result of the analysis can also be used for informing a user of an anti-virus system of the non-replicative changes made to the environment.
    • 公开了一种方法,计算机系统和计算机可读介质产品,其包含一组计算机可执行软件指令,用于指导计算机系统执行用于确定怀疑含有不期望的软件的程序的非复制行为的过程 实体。 该过程导致在至少一个已知环境中执行该程序,并且自动检查该至少一个已知环境以检测由于该程序的执行而在该环境中是否发生了改变。 如果检测到改变,则该过程自动分析检测到的变化(即,过程执行副作用分析),以确定改变是由执行程序还是由不期望的软件实体的执行引起。 该过程然后使用分析结果至少用于撤销由不期望的软件实体的执行导致的检测到的改变。 分析的结果也可以用于向用户通知反病毒系统对环境的非复制变化。