专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

WO2009094544A1 EXTENDED FINITE STATE AUTOMATA AND SYSTEMS AND METHODS FOR RECOGNIZING PATTERNS 审中-公开
标题翻译：扩展的有限状态自动化和系统以及识别模式的方法
公开(公告)号：WO2009094544A1
公开(公告)日：2009-07-30
申请号：PCT/US2009/031842
申请日：2009-01-23
申请人： WISCONSIN ALUMNI RESEARCH FOUNDATION , ESTAN, Cristian , SMITH, Randy, D. , JHA, Somesh
发明人： ESTAN, Cristian , SMITH, Randy, D. , JHA, Somesh
IPC分类号： G10L15/06
CPC分类号： H04L63/1416 , H04L63/0245
摘要： Deterministic finite automata (DFAs) are popular solutions to deep packet inspection because they are fast and DFAs corresponding to multiple signatures are combinable into a single DFA. Combining such DFAs causes an explosive increase in memory usage. Extended finite automata (XFAs) are an alternative to DFAs that avoids state-space explosion problems. XFAs extend DFAs with a few bytes of 'scratch memory' used to store bits and other data structures that record progress. Simple programs associated with automaton states and/or transitions manipulate this scratch memory. XFAs are deterministic in their operation, are equivalent to DFAs in expressiveness, and require no custom hardware support. Fully functional prototype XFA implementations show that, for most signature sets, XFAs are at least 10,000 times smaller than the DFA matching all signatures. XFAs are 10 times smaller and 5 times faster or 5 times smaller and 20 times faster than systems using multiple DFAs.
摘要翻译：确定性有限自动机（DFA）是深度分组检测的流行解决方案，因为它们是快速的，并且与多个签名相对应的DFA可以组合成单个DFA。结合这样的DFA导致内存使用的爆炸性增加。扩展有限自动机（XFAs）是避免状态空间爆炸问题的替代方案。 XFAs使用几个字节的“临时存储器”来扩展DFA，用于存储记录进度的位和其他数据结构。与自动机状态和/或转换相关联的简单程序操纵该临时存储器。 XFAs在运营中是确定性的，相当于表现力的DFA，并且不需要定制硬件支持。全功能原型XFA实现表明，对于大多数签名集，XFA至少比匹配所有签名的DFA小10,000倍。 XFA比使用多个DFA的系统小10倍，5倍，5倍，20倍。

2. 发明申请

WO2009035902A2 MALWARE PREVENTION SYSTEM MONITORING KERNEL EVENTS 审中-公开
标题翻译：监控内核事件的恶意软件防护系统
公开(公告)号：WO2009035902A2
公开(公告)日：2009-03-19
申请号：PCT/US2008/075243
申请日：2008-09-04
申请人： WISCONSIN ALUMNI RESEARCH FOUNDATION , HAO, Wang , JHA, Somesh
发明人： HAO, Wang , JHA, Somesh
IPC分类号： G06F12/16 , G06F21/00
CPC分类号： G06F21/554 , G06F21/52
摘要： A malware prevention system (40', 44, 48) monitors kernel level events (42) of the operating system (30) and applies user programmable or preprepared policies (50) to those events to detect and block malware.
摘要翻译：恶意软件预防系统（40'，44,48）监视操作系统（30）的内核级事件（42），并将用户可编程或预制策略（50）应用于这些事件以检测阻止恶意软件。

3. 发明申请

WO2009014779A2 SYSTEM FOR MALWARE NORMALIZATION AND DETECTION 审中-公开
标题翻译：用于恶意软件正常化和检测的系统
公开(公告)号：WO2009014779A2
公开(公告)日：2009-01-29
申请号：PCT/US2008/061480
申请日：2008-04-25
申请人： WISCONSIN ALUMNI RESEARCH FOUNDATION , CHRISTODORESCU, Mahai , JHA, Somesh , KATZENBEISSER, Stefan , KINDER, Johannes , VEITH, Helmut
发明人： CHRISTODORESCU, Mahai , JHA, Somesh , KATZENBEISSER, Stefan , KINDER, Johannes , VEITH, Helmut
CPC分类号： G06F21/56 , G06F21/53 , G06F2221/2101 , G06F2221/2149
摘要： Computer programs (12) are preprocessed (20) to produce normalized or standard versions to remove obfuscation that might prevent the detection of embedded malware through comparison with standard malware signatures. The normalization process can provide an unpacking (28) of compressed or encrypted malware, a reordering (31) of the malware into a standard form, and the detection and removal (34) of semantically identified nonfunctional code added to disguise the malware.
摘要翻译：计算机程序（12）进行预处理（20）以生成标准化或标准版本，以消除可能通过与标准恶意软件签名进行比较来防止嵌入式恶意软件检测的混淆。归一化过程可以提供压缩或加密的恶意软件的打包（28），将恶意软件重新排序（31）到标准形式，以及添加伪装恶意软件的语义识别的非功能代码的检测和删除（34）。

4. 发明申请

WO2008067371A2 SYSTEM FOR AUTOMATIC DETECTION OF SPYWARE 审中-公开
标题翻译：自动检测间谍软件的系统
公开(公告)号：WO2008067371A2
公开(公告)日：2008-06-05
申请号：PCT/US2007/085752
申请日：2007-11-28
申请人： WISCONSIN ALUMNI RESEARCH FOUNDATION , HAO, Wang , JHA, Somesh , GANAPATHY, Vinod
发明人： HAO, Wang , JHA, Somesh , GANAPATHY, Vinod
CPC分类号： H04L63/145 , G06F21/552 , G06F21/564 , G06F21/566 , H04L63/0236
摘要： An automatic system (26) for spyware detection and signature generation compares packets of output (51) from a computer (20) in response to standard user inputs (53), to packets of a standard output set (51) derived from a known clean machine (20). Differences between these two packet sets are analyzed with respect to whether they relate to unknown web servers (56) and whether they incorporate user-derived information (74). This analysis is used to provide an automatic detection of and signature generation for spyware infecting the machine (20).
摘要翻译：用于间谍软件检测和签名生成的自动系统（26）将来自计算机（20）的响应于标准用户输入（53）的输出（51）的分组与标准输出集合（51）来源于已知的清洁机器（20）。分析这两个数据包集之间的差异，分析它们是否涉及未知的Web服务器（56）以及它们是否包含用户派生信息（74）。该分析用于为感染机器的间谍软件提供自动检测和签名生成（20）。

5. 发明申请

WO2022236031A1 COMPUTER IMPLEMENTED PROGRAM SPECIALIZATION 审中-公开
公开(公告)号：WO2022236031A1
公开(公告)日：2022-11-10
申请号：PCT/US2022/028040
申请日：2022-05-06
申请人： WISCONSIN ALUMNI RESEARCH FOUNDATION
发明人： ALHANAHNAH, Mohannad , RASTOGI, Vaibhav , JHA, Somesh , REPS, Thomas
IPC分类号： G06F8/41 , G06F8/71
摘要： A computerized, technique for program simplification and specialization combines a partial interpretati on of the program based on a subset of program functions to obtain variabl e states with concrete values at a program "neck." These concrete values are then propagated as part of an optimization transformation that simplifies the program based on these constant values, for example, by eliminating branches that are never taken based on the constant values.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式