会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 1. 发明授权
    • Methods and systems for detecting infected files
    • 用于检测感染文件的方法和系统
    • US08621625B1
    • 2013-12-31
    • US12342607
    • 2008-12-23
    • Walter BogoradVadim Antonov
    • Walter BogoradVadim Antonov
    • G06F21/00
    • G06F21/562
    • A computer-implemented method for detecting infected files may include identifying a set of known-clean files. The method may also include identifying a set of characteristics of an unchecked file. The method may further include determine that the unchecked file is related to a clean file in the set of known-clean files. The determination may be based on the set of characteristics of the unchecked file. The method may additionally include determining whether the unchecked file is functionally equivalent to the clean file. This determination may be based on the set of characteristics of the unchecked file. Various other methods, systems, and computer-readable media are also disclosed.
    • 用于检测感染文件的计算机实现的方法可以包括识别一组已知干净的文件。 该方法还可以包括识别未检查文件的一组特征。 该方法还可以包括确定未经检查的文件与一组已知干净文件中的干净文件相关。 该确定可以基于未检查文件的特征集合。 该方法还可以包括确定未被检查的文件是否在功能上等同于干净的文件。 该确定可以基于未经检查的文件的特征集合。 还公开了各种其它方法,系统和计算机可读介质。
    • 2. 发明授权
    • Real-time website safety reputation system
    • 实时网站安全声誉系统
    • US08185956B1
    • 2012-05-22
    • US12059471
    • 2008-03-31
    • Walter BogoradVadim Antonov
    • Walter BogoradVadim Antonov
    • H04L29/06G06F15/173G06F11/00
    • H04L63/105
    • A mechanism is provided for determining a safety reputation for a network site in a manner that provides both wide coverage of potentially malicious sites as well as improves the freshness of information from which the safety reputation is derived. Community-based information, such as reports from users related to recently-visited network sites, malware detected by reporting network nodes, non-specific information such as unusual CPU usage and network activity of visiting nodes, and information received from other types of external feeds is used in determining the safety reputation and updating the safety reputation. Such information is analyzed in order to determine network sites that are potential sources of malware, which can then be subjected to more detailed analysis. Historical information as to a site's reputation and other factors such as commercial importance can also be reviewed to make a determination as to whether information being currently gathered by a community of users is sufficient to trigger additional analysis of the network site. Thus, resources used for detailed analysis of suspect network sites is conserved.
    • 提供了一种用于以提供潜在恶意站点的广泛覆盖的方式来确定网络站点的安全信誉的机制,以及提高从其导出安全信誉的信息的新鲜度。 基于社区的信息,例如与最近访问的网站相关的用户的报告,由报告网络节点检测到的恶意软件,诸如异常CPU使用率和访问节点的网络活动之类的非特定信息以及从其他类型的外部馈送接收到的信息 用于确定安全声誉和更新安全声誉。 分析这些信息以便确定作为恶意软件潜在来源的网络站点,然后可以进行更详细的分析。 关于网站声誉和商业重要性等其他因素的历史信息也可以进行审查,以确定目前由用户社区收集的信息是否足以触发网站的额外分析。 因此,用于详细分析可疑网站的资源是保守的。
    • 4. 发明授权
    • Systems and methods for managing malware signatures
    • 用于管理恶意软件签名的系统和方法
    • US08875292B1
    • 2014-10-28
    • US12754586
    • 2010-04-05
    • Walter BogoradVadim Antonov
    • Walter BogoradVadim Antonov
    • G06F21/00G06F21/56
    • G06F21/564G06F2221/2115H04L63/1416
    • A computer-implemented method for managing malware signatures. The method may include maintaining a set of active malware signatures and maintaining a set of dormant malware signatures. The method may also include providing the set of active malware signatures for use in malware detection more frequently than the set of dormant malware signatures and determining that a first malware signature from the set of dormant malware signatures triggers one or more positive malware detection responses. The method may further include, in response to the determination, moving the first malware signature from the set of dormant malware signatures to the set of active malware signatures. Various other methods, systems, and computer-readable media are also disclosed.
    • 用于管理恶意软件签名的计算机实现的方法。 该方法可以包括维护一组主动恶意软件签名并维护一组休眠的恶意软件签名。 该方法还可以包括提供用于恶意软件检测的一组主动恶意软件签名,比一组休眠恶意软件签名更频繁,并且确定来自该组休眠恶意软件签名的第一恶意软件签名触发一个或多个正恶意软件检测响应。 该方法还可以包括响应于该确定,将第一恶意软件签名从该组休眠恶意软件签名移动到该组活动恶意软件签名。 还公开了各种其它方法,系统和计算机可读介质。
    • 5. 发明授权
    • Real-time website safety reputation system
    • 实时网站安全声誉系统
    • US08667587B1
    • 2014-03-04
    • US13474973
    • 2012-05-18
    • Walter BogoradVadim Antonov
    • Walter BogoradVadim Antonov
    • G06F11/00G06F12/14G06F12/16G06F15/173
    • H04L63/105
    • A mechanism is provided for determining a safety reputation for a network site in a manner that provides both wide coverage of potentially malicious sites as well as improves the freshness of information from which the safety reputation is derived. Community-based information, such as reports from users related to recently-visited network sites, malware detected by reporting network nodes, non-specific information such as unusual CPU usage and network activity of visiting nodes, and information received from other types of external feeds is used in determining the safety reputation and updating the safety reputation. Such information is analyzed in order to determine network sites that are potential sources of malware, which can then be subjected to more detailed analysis. Historical information as to a site's reputation and other factors such as commercial importance can also be reviewed to make a determination as to whether information being currently gathered by a community of users is sufficient to trigger additional analysis of the network site. Thus, resources used for detailed analysis of suspect network sites is conserved.
    • 提供了一种用于以提供潜在恶意站点的广泛覆盖的方式来确定网络站点的安全信誉的机制,以及提高从其导出安全信誉的信息的新鲜度。 基于社区的信息,例如与最近访问的网站相关的用户的报告,由报告网络节点检测到的恶意软件,诸如异常CPU使用率和访问节点的网络活动之类的非特定信息以及从其他类型的外部馈送接收到的信息 用于确定安全声誉和更新安全声誉。 分析这些信息以便确定作为恶意软件潜在来源的网络站点,然后可以进行更详细的分析。 关于网站声誉和商业重要性等其他因素的历史信息也可以进行审查,以确定目前由用户社区收集的信息是否足以触发网站的额外分析。 因此,用于详细分析可疑网站的资源是保守的。
    • 6. 发明授权
    • Protection from telephone phishing
    • 防止电话诈骗
    • US08463235B1
    • 2013-06-11
    • US12881915
    • 2010-09-14
    • Vadim AntonovKirill Levichev
    • Vadim AntonovKirill Levichev
    • H04M1/66
    • H04M3/436H04M1/663H04M2203/6027
    • Attempts to communicate telephonically by a mobile phone are detected. When an attempt is detected, an associated phone number is identified and transmitted to a server in order to glean corresponding security information. On the server, a database is maintained containing 1) phone numbers known to present potential security concerns and 2) descriptive security information concerning each of these phone numbers. The server receives phone numbers from mobile phones to check for security information, searches the database for received phone numbers, and transmits corresponding security information to the originating mobile phones. Security information concerning identified telephone numbers is received from the server by mobile phones. Responsive to the contents of the received security information, detected attempts to communicate telephonically are allowed to processed, blocked or otherwise processed.
    • 检测到通过手机进行电话通信的尝试。 当检测到尝试时,识别相关联的电话号码并将其发送到服务器,以便收集相应的安全信息。 在服务器上,维护一个数据库,其中包含1)已知的潜在安全问题的电话号码,以及2)有关这些电话号码的描述性安全信息。 服务器从手机接收电话号码以检查安全信息,在数据库中搜索接收到的电话号码,并将相应的安全信息发送给发起的手机。 通过移动电话从服务器接收到关于识别的电话号码的安全信息。 响应于接收的安全信息的内容,检测到的通话电话的尝试被允许处理,阻止或以其他方式处理。
    • 9. 发明授权
    • Apparatus and method for sharing data and routing messages between a
plurality of workstations in a local area network
    • US5884046A
    • 1999-03-16
    • US735556
    • 1996-10-23
    • Vadim Antonov
    • Vadim Antonov
    • G06F17/30H04L12/56G06F13/00G06F15/173
    • H04L49/351G06F17/30067H04L49/15H04L49/25
    • A parallel local area network server is capable of sharing data and routing messages between workstations in a local area network. An apparatus according to the invention includes a plurality of processing nodes, each constituted by at least a single data processor, and an interconnect by which the processing nodes communicate. A plurality of mass storage devices are associated with the processing nodes, and a plurality of workstation computers are connected to the processing nodes. Each processing node includes is adapted to route messages to workstation computers associated with other processing nodes and to access data located both locally and at data storage devices associated with other processing nodes. A method according to the invention includes receiving a message at a first processing node and determining if the message is directed to a workstation computer at a second processing node and sending the message to the second processing node for subsequent delivery to the workstation computer. If the message includes a request for a specific data, a second determination is made if the specific data is in the local cache memory of the first processing node. If the specific data is not in the local cache memory, determination is made if the specific data is in a mass storage device at the first processing node, and if so the mass storage device is accessed to obtain the specific data. If the specific data is not in the local mass storage device, a message is forwarded to a remote processing node to request the specific data. Once this data is obtained, it is sent to the requesting workstation computer. The network server system according to the invention thus provides the functions of a file server and a local area network switch, thereby eliminating performance limitations associated with overloaded connections between file servers and LAN switches in conventional local area networks.