会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 4. 发明授权
    • Method and system for indicating an executable as trojan horse
    • 用于将可执行文件指示为特洛伊木马的方法和系统
    • US07603614B2
    • 2009-10-13
    • US10436047
    • 2003-05-13
    • Oded CohenYanki MargalitDany Margalit
    • Oded CohenYanki MargalitDany Margalit
    • G11C29/00
    • G06F11/1004G11C2029/0411
    • A method and system for indicating an executable as Trojan Horse, based on the CRC values of the routines of an executable. The method comprising a preliminary stage in which the CRC values of the routines of known Trojan Horses are gathered in a database, and a stage in which indicating an executable as Trojan Horse is carried out by the correspondence of the CRC values of the routines of said executable to the CRC values of the known Trojan Horses, as gathered in said database. The system comprising means for calculating the CRC values of routines; means for identifying the borders of the routines of an executable; a database system, for storing the CRC values of routines of known Trojan Horses; and means for determining the correspondence between two groups of CRC values, thereby enabling detection of the correspondence of an executable to at least one known Trojan Horse.
    • 基于可执行程序的例程的CRC值来指示作为特洛伊木马的可执行程序的方法和系统。 所述方法包括初步阶段,其中已知特洛伊木马的例程的CRC值被收集在数据库中,并且其中指示作为特洛伊木马的可执行文件的阶段通过所述的所述程序的CRC值的对应来执行 可执行到已知的特洛伊木马的CRC值,如在所述数据库中收集的。 该系统包括用于计算例程的CRC值的装置; 用于识别可执行程序的例程的边界的装置; 数据库系统,用于存储已知特洛伊木马的例程的CRC值; 以及用于确定两组CRC值之间的对应关系的装置,由此能够检测可执行程序与至少一个已知特洛伊木马的对应关系。
    • 5. 发明授权
    • Method for preventing activation of malicious objects
    • 防止恶意物体激活的方法
    • US07386884B2
    • 2008-06-10
    • US10826503
    • 2004-04-19
    • Oded CohenYanki MargalitDany Margalit
    • Oded CohenYanki MargalitDany Margalit
    • G06F12/14
    • H04L63/0227H04L63/123H04L63/145
    • A method for preventing activating a malicious object passing through a checkpoint, and decreasing the overall inspection delay thereof, the method comprising the steps of: (a) at the checkpoint, creating an envelope file, being an executable file comprising: the object; code for extracting the object from the envelope file; and an indicator for indicating the integrity of the object; (b) forwarding the envelope file instead of the object toward its destination, while holding at least a part of the envelope file which comprises the indicator; (c) inspecting the object; and (d) setting the indicator on the envelope file to indicate the inspection result thereof, and releasing the rest of the envelope file.
    • 一种用于防止激活通过检查点的恶意对象并减少其整体检查延迟的方法,所述方法包括以下步骤:(a)在所述检查点处,创建作为可执行文件的包络文件,包括:所述对象; 从信封文件中提取对象的代码; 以及用于指示对象的完整性的指示符; (b)将所述信封文件代替所述对象转发到其目的地,同时保持包括所述指示符的信封文件的至少一部分; (c)检查物体; 和(d)在信封文件上设置指示符以指示其检查结果,并释放信封文件的其余部分。
    • 7. 发明申请
    • Method for protecting a computer from suspicious objects
    • 保护计算机免受可疑对象的方法
    • US20060010495A1
    • 2006-01-12
    • US10883676
    • 2004-07-06
    • Oded CohenYanki MargalitDany Margalit
    • Oded CohenYanki MargalitDany Margalit
    • G06F11/00
    • H04L63/1441G06F21/56
    • In an inspection facility (e.g. at a gateway server, at a proxy server, at a firewall to a network, at an entrance to a local area network or even at the user's computer) connected to an anti-virus center for updates, a method for protecting a computer from suspicious objects (e.g. a file, an executable, a Web page, an email message, etc.), the method comprising the steps of: inspecting an object; upon determining the object as suspicious, holding the object in quarantine (e.g. preventing from the object to be forwarded to its destination) for a time period, thereby enabling the inspection facility to be updated during the time period by the anti-virus center; upon ending of the time period, re-inspecting the object, thereby inspecting the object by updated inspection tests; and upon determining the object as malicious by the re-inspection, blocking the object, otherwise forwarding the object toward its destination.
    • 在连接到防病毒中心进行更新的检查设施(例如,在网关服务器,代理服务器,防火墙到网络,在局域网的入口处,甚至在用户的计算机上),方法 用于保护计算机免受可疑对象(例如文件,可执行文件,网页,电子邮件消息等)的影响,该方法包括以下步骤:检查对象; 在将对象确定为可疑的情况下,将对象保持隔离(例如,防止从对象转发到其目的地)一段时间,从而使检测设施在该时间段期间被防病毒中心更新; 在结束时间段,重新检查物体,从而通过更新的检验检验来检查物体; 并且在通过重新检查将对象确定为恶意时,阻止对象,否则将对象转发到其目的地。
    • 10. 发明授权
    • Method for emulating an executable code in order to detect maliciousness
    • 用于模拟可执行代码以检测恶意的方法
    • US07013483B2
    • 2006-03-14
    • US10335871
    • 2003-01-03
    • Oded CohenInbal MeirYanki MargalitDany Margalit
    • Oded CohenInbal MeirYanki MargalitDany Margalit
    • H04L713/20
    • G06F21/566
    • The present invention is directed to a method for emulating an executable code, whether it is a human-readable code (e.g., macro and script) or a compiled code (e.g. Windows executable). At the design time, one or more content attributes are defined for the variables of the code. A content attribute indicates a property with relevance to maliciousness, e.g. Windows directory, a random value, “.EXE” at the right of a string, etc. A content attribute may be implemented, for example, by a flag. Also defined at the design time, is a list of malicious states, where a malicious state comprises at least the combination of a call to a certain system function with certain content, as the calling parameter(s). When emulating an assignment instruction, the attributes of the assigned variable are set according to the assigned content. When emulating a mathematical operator, a content mathematics is also applied. When emulating a function call, the current state (i.e. the function identity and the calling content and values) is compared with the pre-defined malicious states, and if at least one malicious state corresponds, then the maliciousness of the code is determined.
    • 本发明涉及一种用于模拟可执行代码的方法,无论是人类可读代码(例如,宏和脚本)还是编译代码(例如Windows可执行文件)。 在设计时,为代码的变量定义一个或多个内容属性。 内容属性表示与恶意相关的属性,例如 Windows目录,随机值,字符串右侧的“.EXE”等。内容属性可以例如通过标志来实现。 还在设计时定义的是恶意状态的列表,其中恶意状态至少包括对具有特定内容的特定系统功能的呼叫的组合作为呼叫参数。 当模拟分配指令时,根据分配的内容设置分配变量的属性。 在模拟数学运算符时,也应用内容数学。 当模拟函数调用时,将当前状态(即函数标识和调用内容和值)与预定义的恶意状态进行比较,如果至少一个恶意状态对应,则确定代码的恶意。