专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US09436826B2 Discovering malicious input files and performing automatic and distributed remediation 有权
标题翻译：发现恶意输入文件并执行自动和分布式修复
公开(公告)号：US09436826B2
公开(公告)日：2016-09-06
申请号：US13161950
申请日：2011-06-16
申请人： Vishal Kapoor , Jonathan Mark Keller , Ajith Kumar , Adrian M. Marinescu , Marc E. Seinfeld , Anil Francis Thomas , Michael Sean Jarrett , Joseph J. Johnson , Joseph L. Faulhaber
发明人： Vishal Kapoor , Jonathan Mark Keller , Ajith Kumar , Adrian M. Marinescu , Marc E. Seinfeld , Anil Francis Thomas , Michael Sean Jarrett , Joseph J. Johnson , Joseph L. Faulhaber
IPC分类号： G06F21/56 , G06F21/52 , G06F21/55 , H04L29/06
CPC分类号： G06F21/566 , G06F21/52 , G06F21/552 , G06F21/554 , G06F21/56 , G06F21/568 , G06F2221/2101 , H04L63/145
摘要： The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.
摘要翻译：本发明涉及通过允许打开输入文件以及通过监视与可能指示恶意软件的打开文件相对应的一个或多个行为来检测输入文件中的恶意软件或可能的恶意软件。可以监视由此引起的某些可执行文件和/或文件类型，当观察到不当的行为时，各种收集的事件数据用于反恶意软件目的。示例行为包括将文件写入存储，生成网络流量，注入进程，运行脚本和/或编写系统注册表数据。遥测数据和/或文件样本可以被发送到反恶意软件服务，并且可以执行恶意软件修复。数据（例如，收集的事件）可以被分发到其他节点以用于反恶意软件检测，例如阻止类似文件的执行。

2. 发明申请

US20120297488A1 Discovering Malicious Input Files and Performing Automatic and Distributed Remediation 有权
标题翻译：发现恶意输入文件并执行自动和分布式修复
公开(公告)号：US20120297488A1
公开(公告)日：2012-11-22
申请号：US13161950
申请日：2011-06-16
申请人： Vishal Kapoor , Jonathan Mark Keller , Ajith Kumar , Adrian M. Marinescu , Marc E. Seinfeld , Anil Francis Thomas , Michael Sean Jarrett , Joseph J. Johnson , Joseph L. Faulhaber
发明人： Vishal Kapoor , Jonathan Mark Keller , Ajith Kumar , Adrian M. Marinescu , Marc E. Seinfeld , Anil Francis Thomas , Michael Sean Jarrett , Joseph J. Johnson , Joseph L. Faulhaber
IPC分类号： G06F11/00
CPC分类号： G06F21/566 , G06F21/52 , G06F21/552 , G06F21/554 , G06F21/56 , G06F21/568 , G06F2221/2101 , H04L63/145
摘要： The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.
摘要翻译：本发明涉及通过允许打开输入文件以及通过监视与可能指示恶意软件的打开文件相对应的一个或多个行为来检测输入文件中的恶意软件或可能的恶意软件。可以监视由此引起的某些可执行文件和/或文件类型，当观察到不当的行为时，各种收集的事件数据用于反恶意软件目的。示例行为包括将文件写入存储，生成网络流量，注入进程，运行脚本和/或编写系统注册表数据。遥测数据和/或文件样本可以被发送到反恶意软件服务，并且可以执行恶意软件修复。数据（例如，收集的事件）可以被分发到其他节点以用于反恶意软件检测，例如阻止类似文件的执行。

3. 发明授权

US08955133B2 Applying antimalware logic without revealing the antimalware logic to adversaries 有权
标题翻译：应用反恶意软件逻辑，而不会向对手揭示反恶意软件逻辑
公开(公告)号：US08955133B2
公开(公告)日：2015-02-10
申请号：US13156726
申请日：2011-06-09
申请人： Ajith Kumar , Timothy Jon Fraser , Adrian M. Marinescu , Marc E. Seinfeld , Jack Wilson Stokes, III , Anil Francis Thomas
发明人： Ajith Kumar , Timothy Jon Fraser , Adrian M. Marinescu , Marc E. Seinfeld , Jack Wilson Stokes, III , Anil Francis Thomas
IPC分类号： G06F21/00 , G06F21/55 , G06F21/56
CPC分类号： G06F21/552 , G06F21/566
摘要： The subject disclosure is directed towards a technology by which antimalware detection logic is maintained and operated at a backend service, with which a customer frontend machine communicates (queries) for purposes of malware detection. In this way, some antimalware techniques are maintained at the backend service rather than revealed to antimalware authors. The backend antimalware detection logic may be based upon feature selection, and may be updated rapidly, in a manner that is faster than malware authors can track. Noise may be added to the results to make it difficult for malware authors to deduce the logic behind the results. The backend may return results indicating malware or not malware, or return inconclusive results. The backend service may also detect probing-related queries that are part of an attempt to deduce the unrevealed antimalware detection logic, with noisy results returned in response and/or other actions taken to foil the attempt.
摘要翻译：主题公开涉及一种技术，通过该技术，反恶意软件检测逻辑在后端服务中被维护和操作，客户前端机器为此进行通信（查询）以用于恶意软件检测。这样一来，后端服务就会保留一些反恶意软件技术，而不是反恶意软件作者。后端反恶意软件检测逻辑可以基于特征选择，并且可以以比作者可追踪的恶意软件更快的方式快速更新。噪声可能会添加到结果中，使恶意软件作者难以推断出结果背后的逻辑。后端可能返回指示恶意软件或不是恶意软件的结果，或返回不确定的结果。后端服务还可以检测作为尝试推断出未显示的反恶意软件检测逻辑的一部分的探测相关查询，其中响应返回噪声结果和/或为了抵制该尝试而采取的其他动作。

4. 发明申请

US20120317644A1 Applying Antimalware Logic without Revealing the Antimalware Logic to Adversaries 有权
标题翻译：应用反恶意软件逻辑，而不会向对手揭示反恶意软件逻辑
公开(公告)号：US20120317644A1
公开(公告)日：2012-12-13
申请号：US13156726
申请日：2011-06-09
申请人： Ajith Kumar , Timothy Jon Fraser , Adrian M. Marinescu , Marc E. Seinfeld , Jack Wilson Stokes, III , Anil Francis Thomas
发明人： Ajith Kumar , Timothy Jon Fraser , Adrian M. Marinescu , Marc E. Seinfeld , Jack Wilson Stokes, III , Anil Francis Thomas
IPC分类号： G06F21/00
CPC分类号： G06F21/552 , G06F21/566
摘要： The subject disclosure is directed towards a technology by which antimalware detection logic is maintained and operated at a backend service, with which a customer frontend machine communicates (queries) for purposes of malware detection. In this way, some antimalware techniques are maintained at the backend service rather than revealed to antimalware authors. The backend antimalware detection logic may be based upon feature selection, and may be updated rapidly, in a manner that is faster than malware authors can track. Noise may be added to the results to make it difficult for malware authors to deduce the logic behind the results. The backend may return results indicating malware or not malware, or return inconclusive results. The backend service may also detect probing-related queries that are part of an attempt to deduce the unrevealed antimalware detection logic, with noisy results returned in response and/or other actions taken to foil the attempt.
摘要翻译：主题公开涉及一种技术，通过该技术，反恶意软件检测逻辑在后端服务中被维护和操作，客户前端机器为此进行通信（查询）以用于恶意软件检测。这样一来，后端服务就会保留一些反恶意软件技术，而不是反恶意软件作者。后端反恶意软件检测逻辑可以基于特征选择，并且可以以比作者可追踪的恶意软件更快的方式快速更新。噪声可能会添加到结果中，使恶意软件作者难以推断出结果背后的逻辑。后端可能返回指示恶意软件或不是恶意软件的结果，或返回不确定的结果。后端服务还可以检测作为尝试推断出未显示的反恶意软件检测逻辑的一部分的探测相关查询，其响应返回的噪声结果和/或为了抵制尝试而采取的其他动作。

5. 发明申请

US20130160126A1 MALWARE REMEDIATION SYSTEM AND METHOD FOR MODERN APPLICATIONS 审中-公开
标题翻译：恶意修复系统及现代应用方法
公开(公告)号：US20130160126A1
公开(公告)日：2013-06-20
申请号：US13327223
申请日：2011-12-15
申请人： Vishal Kapoor , Jason J. Joyce , Gregory W. Nichols , Joshua W. Dunn , Michael S. Jarrett , Adrian M. Marinescu , Marc E. Seinfeld , Axel Andrejs , Jayaraman Kalyana Sundaram
发明人： Vishal Kapoor , Jason J. Joyce , Gregory W. Nichols , Joshua W. Dunn , Michael S. Jarrett , Adrian M. Marinescu , Marc E. Seinfeld , Axel Andrejs , Jayaraman Kalyana Sundaram
IPC分类号： G06F21/00 , G06F15/16
CPC分类号： G06F21/568 , G06F2221/2115
摘要： A system is described for remediating a malicious modern application installed on an end user device. In an embodiment, the system includes an antimalware program executing on the end user device that can detect and attempt to remediate the malicious modern application, an operating system executing on the end user device that is configured to interact with the antimalware program for the purpose of facilitating the establishment of a connection between the end user device and an application support system in response to determining that the antimalware program has detected and attempted to remediate the malicious modern application, and the application support system that can perform remediation operations beyond those that can be performed by the antimalware program.
摘要翻译：描述了一种用于修复安装在最终用户设备上的恶意现代应用程序的系统。在一个实施例中，系统包括在最终用户设备上执行的可以检测并尝试修复恶意现代应用的反恶意软件程序，该终端用户设备上执行的被配置为与反恶意软件程序交互的操作系统，响应于确定反恶意软件程序已经检测并尝试修复恶意现代应用程序，以及能够执行补救操作的应用程序支持系统，超出可以执行的修复操作，便于建立最终用户设备和应用程序支持系统之间的连接由反恶意程序执行。

6. 发明申请

US20100192222A1 MALWARE DETECTION USING MULTIPLE CLASSIFIERS 审中-公开
标题翻译：使用多个分类器的恶意软件检测
公开(公告)号：US20100192222A1
公开(公告)日：2010-07-29
申请号：US12358246
申请日：2009-01-23
申请人： Jack W. Stokes , John C. Platt , Jonathan M. Keller , Joseph L. Faulhaber , Anil Francis Thomas , Adrian M. Marinescu , Marius G. Gheorghescu , George Chicioreanu
发明人： Jack W. Stokes , John C. Platt , Jonathan M. Keller , Joseph L. Faulhaber , Anil Francis Thomas , Adrian M. Marinescu , Marius G. Gheorghescu , George Chicioreanu
IPC分类号： G06F21/00 , G06G7/62 , G06F17/30 , G06F9/455
CPC分类号： G06F21/563
摘要： A method of identifying a malware file using multiple classifiers is disclosed. The method includes receiving a file at a client computer. The file includes static metadata. A set of metadata classifier weights are applied to the static metadata to generate a first classifier output. A dynamic classifier is initiated to evaluate the file and to generate a second classifier output. The method includes automatically identifying the file as potential malware based on at least the first classifier output and the second classifier output.
摘要翻译：公开了使用多个分类器识别恶意软件文件的方法。该方法包括在客户端计算机上接收文件。该文件包括静态元数据。将一组元数据分类器权重应用于静态元数据以生成第一个分类器输出。启动动态分类器来评估文件并生成第二个分类器输出。该方法包括至少基于第一分类器输出和第二分类器输出将文件自动识别为潜在的恶意软件。

7. 发明申请

US20130086683A1 SELECTIVELY SCANNING OBJECTS FOR INFECTION BY MALWARE 有权
标题翻译：恶意软件感染的选择性扫描对象
公开(公告)号：US20130086683A1
公开(公告)日：2013-04-04
申请号：US13248867
申请日：2011-09-29
申请人： Anil Francis Thomas , Adrian M. Marinescu , Ajith Kumar , Jonathan M. Keller , Omer Ben Bassat
发明人： Anil Francis Thomas , Adrian M. Marinescu , Ajith Kumar , Jonathan M. Keller , Omer Ben Bassat
IPC分类号： G06F21/00
CPC分类号： G06F21/00 , G06F21/564 , G06F21/568
摘要： Techniques are described herein that are capable of selectively scanning objects for infection by malware (i.e., to determine whether one or more of the objects are infected by malware). For instance, metadata that is associated with the objects may be reviewed to determine whether update(s) have been made with regard to the objects since a determination was made that the objects were not infected by malware. An update may involve increasing a number of the objects, modifying one of the objects, etc. Objects that have been updated (e.g., added and/or modified) since the determination may be scanned. Objects that have not been updated since the determination need not necessarily be scanned. For instance, an allowance may be made to perform operations with respect to the objects that have not been updated since the determination without first scanning the objects for infection by malware.
摘要翻译：本文描述了能够选择性地扫描物体以感染恶意软件（即，确定一个或多个对象是否被恶意软件感染）的技术。例如，可以检查与对象相关联的元数据，以确定是否已经对对象进行了更新，因为确定对象未被恶意软件感染。更新可以涉及增加对象的数量，修改对象之一等。可以扫描自确定以来已被更新（例如，添加和/或修改）的对象。自确定以来尚未更新的对象不必一定被扫描。例如，可以在不首先扫描物体以感染恶意软件的情况下，进行从确定以来未进行更新的对象的操作。

8. 发明授权

US08973135B2 Selectively scanning objects for infection by malware 有权
标题翻译：选择性扫描物体感染恶意软件
公开(公告)号：US08973135B2
公开(公告)日：2015-03-03
申请号：US13248867
申请日：2011-09-29
申请人： Anil Francis Thomas , Adrian M. Marinescu , Ajith Kumar , Jonathan M. Keller , Omer Ben Bassat
发明人： Anil Francis Thomas , Adrian M. Marinescu , Ajith Kumar , Jonathan M. Keller , Omer Ben Bassat
IPC分类号： G06F12/14 , G06F21/00
CPC分类号： G06F21/00 , G06F21/564 , G06F21/568
摘要： Techniques are described herein that are capable of selectively scanning objects for infection by malware (i.e., to determine whether one or more of the objects are infected by malware). For instance, metadata that is associated with the objects may be reviewed to determine whether update(s) have been made with regard to the objects since a determination was made that the objects were not infected by malware. An update may involve increasing a number of the objects, modifying one of the objects, etc. Objects that have been updated (e.g., added and/or modified) since the determination may be scanned. Objects that have not been updated since the determination need not necessarily be scanned. For instance, an allowance may be made to perform operations with respect to the objects that have not been updated since the determination without first scanning the objects for infection by malware.
摘要翻译：本文描述了能够选择性地扫描物体以感染恶意软件（即，确定一个或多个对象是否被恶意软件感染）的技术。例如，可以检查与对象相关联的元数据，以确定是否已经对对象进行了更新，因为确定对象未被恶意软件感染。更新可以涉及增加对象的数量，修改对象之一等。可以扫描自确定以来已被更新（例如，添加和/或修改）的对象。自确定以来尚未更新的对象不必一定被扫描。例如，可以在不首先扫描物体以感染恶意软件的情况下，进行从确定以来未进行更新的对象的操作。

9. 发明授权

US07624443B2 Method and system for a self-heating device 有权
标题翻译：自加热装置的方法和系统
公开(公告)号：US07624443B2
公开(公告)日：2009-11-24
申请号：US11018412
申请日：2004-12-21
申请人： Michael Kramer , Scott A. Field , Marc E. Seinfeld , Carl Carter-Schwendler , Paul Luber , Adrian M. Marinescu
发明人： Michael Kramer , Scott A. Field , Marc E. Seinfeld , Carl Carter-Schwendler , Paul Luber , Adrian M. Marinescu
IPC分类号： G06F11/00 , G06F17/30 , G06F15/177 , G06F1/24 , H04L29/06 , G06F11/30 , G06F15/173 , G06F12/00
CPC分类号： G06F21/568 , G06F21/554 , Y10S707/99953
摘要： A self-healing device is provided in which changes made between the time that an infection resulting from an attack on the device was detected and an earlier point in time to which the device is capable of being restored may be recovered based, at least in part, on what kinds of changes were made, whether the changes were bona fide or malware induced, whether the changes were made after the time that the infection likely occurred, and whether new software was installed.
摘要翻译：提供了一种自愈设备，其中，可以在至少部分地恢复在检测到由设备的攻击引起的感染的时间与设备能够恢复到的较早时间点之间进行的改变关于什么样的变化，这些变化是真正的还是恶意软件引起的，这些变化是否在感染可能发生的时间之后进行，以及是否安装了新的软件。

10. 发明授权

US07673341B2 System and method of efficiently identifying and removing active malware from a computer 有权
标题翻译：从计算机有效识别和删除活动恶意软件的系统和方法
公开(公告)号：US07673341B2
公开(公告)日：2010-03-02
申请号：US11012892
申请日：2004-12-15
申请人： Michael Kramer , Matthew Braverman , Marc E. Seinfeld , Jason Garms , Adrian M. Marinescu , George Cristian Chicioreanu , Scott A. Field
发明人： Michael Kramer , Matthew Braverman , Marc E. Seinfeld , Jason Garms , Adrian M. Marinescu , George Cristian Chicioreanu , Scott A. Field
IPC分类号： G06F12/14
CPC分类号： H04L63/1408 , G06F21/562
摘要： The present invention provides a system, method, and computer-readable medium for identifying and removing active malware from a computer. Aspects of the present invention are included in a cleaner tool that may be obtained automatically with an update service or may be downloaded manually from a Web site or similar distribution system. The cleaner tool includes a specialized scanning engine that searches a computer for active malware. Since the scanning engine only searches for active malware, the amount of data downloaded and resource requirements of the cleaner tool are less than traditional antivirus software. The scanning engine searches specific locations on a computer, such as data mapped in memory, configuration files, and file metadata for data characteristic of malware. If malware is detected, the cleaner tool removes the malware from the computer.
摘要翻译：本发明提供一种用于从计算机识别和去除活动恶意软件的系统，方法和计算机可读介质。本发明的方面包括在可以使用更新服务自动获得的清洁工具中，或者可以从网站或类似的分发系统手动下载。更清洁的工具包括专门的扫描引擎，可在计算机上搜索主动恶意软件。由于扫描引擎仅搜索活动的恶意软件，所以下载的数据量和清洁工具的资源需求比传统的防病毒软件要少。扫描引擎在计算机上搜索特定位置，例如映射到内存中的数据，配置文件和文件元数据，以便恶意软件的特征。如果检测到恶意软件，则清洁工具会从计算机中删除恶意软件。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式