会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 2. 发明授权
    • Method and apparatus for determination of the non-replicative behavior of a malicious program
    • 用于确定恶意程序的非复制行为的方法和装置
    • US07861300B2
    • 2010-12-28
    • US12141165
    • 2008-06-18
    • William C. ArnoldDavid M. ChessJohn F. MorarAlla SegalIan N. WhalleySteve R. White
    • William C. ArnoldDavid M. ChessJohn F. MorarAlla SegalIan N. WhalleySteve R. White
    • G06F11/00
    • G06F21/566
    • Disclosed is a method, a computer system and a computer readable media product that contains a set of computer executable software instructions for directing the computer system to execute a process for determining a non-replicative behavior of a program that is suspected of containing an undesirable software entity. The process causes execution of the program in at least one known environment and automatically examines the at least one known environment to detect if a change has occurred in the environment as a result of the execution of the program. If a change is detected, the process automatically analyzes the detected change (i.e., the process performs a side effects analysis) to determine if the change resulted from execution of the program or from execution of the undesirable software entity. The process then uses the result of the analysis at least for undoing a detected change that results from execution of the undesirable software entity. The result of the analysis can also be used for informing a user of an anti-virus system of the non-replicative changes made to the environment.
    • 公开了一种方法,计算机系统和计算机可读介质产品,其包含一组计算机可执行软件指令,用于指导计算机系统执行用于确定怀疑含有不期望的软件的程序的非复制行为的过程 实体。 该过程导致在至少一个已知环境中执行该程序,并且自动检查该至少一个已知环境以检测由于该程序的执行而在该环境中是否发生了改变。 如果检测到改变,则该过程自动分析检测到的变化(即,过程执行副作用分析),以确定改变是由执行程序还是由不期望的软件实体的执行引起。 该过程然后使用分析结果至少用于撤销由不期望的软件实体的执行导致的检测到的改变。 分析的结果也可以用于向用户通知反病毒系统对环境的非复制变化。
    • 3. 发明申请
    • DEPLOYMENT PATTERN REALIZATION WITH MODELS OF COMPUTING ENVIRONMENTS
    • 与计算环境模型的部署模式实现
    • US20100070449A1
    • 2010-03-18
    • US12210139
    • 2008-09-12
    • William C. ArnoldTamar EilamMichael H. KalantarAlexander V. KonstantinouAlexander A. Totok
    • William C. ArnoldTamar EilamMichael H. KalantarAlexander V. KonstantinouAlexander A. Totok
    • G06N5/02
    • G06N5/02
    • Deployment pattern matching is implemented by accessing a target computing environment model that captures environment modeling parameters relating to resources and resource-resource relationships of a corresponding computing environment and expressing the target computing environment model as a model graph defined by target resource elements and resource-to-resource relationship links. Deployment pattern matching is further implemented by accessing a realization pattern that captures deployment parameters relating to resources and resource-resource relationships of a deployment of interest and expressing the realization pattern as a pattern graph defined by conceptual resource elements and constraints arranged by resource-to-resource relationship links and constraint links. The realization pattern is then evaluated against the target computing environment model by executing at least one pattern matching algorithm that attempts to match the pattern graph to the model graph and information corresponding to results of the evaluation are conveyed.
    • 通过访问捕获与相应计算环境的资源和资源 - 资源关系相关的环境建模参数的目标计算环境模型来实现部署模式匹配,并将目标计算环境模型表示为由目标资源元素和资源到 资源关系链接。 通过访问捕获与资源相关的部署参数和感兴趣的部署的资源 - 资源关系的实现模式进一步实现部署模式匹配,并且将实现模式表示为由概念资源元素定义的模式图,并且由资源 - 资源关系链接和约束链接。 然后通过执行尝试将模式图与模型图匹配的至少一个模式匹配算法来针对目标计算环境模型来评估实现模式,并且传达与评估结果相对应的信息。
    • 5. 发明授权
    • Automatic immune system for computers and computer networks
    • 用于计算机和计算机网络的自动免疫系统
    • US5440723A
    • 1995-08-08
    • US4872
    • 1993-01-19
    • William C. ArnoldDavid M. ChessJeffrey O. KephartSteven R. White
    • William C. ArnoldDavid M. ChessJeffrey O. KephartSteven R. White
    • G06F1/00G06F21/56H04L29/06G06F11/00
    • H04L63/1441G06F21/564G06F21/566
    • A method includes the following component steps, or some functional subset of these steps: (A) periodic monitoring of a data processing system (10) for anomalous behavior that may indicate the presence of an undesirable software entity such as a computer virus, worm, or Trojan Horse; (B) automatic scanning for occurrences of known types of undesirable software entities and taking remedial action if they are discovered; (C) deploying decoy programs to capture samples of unknown types of computer viruses; (D) identifying machine code portions of the captured samples which are unlikely to vary from one instance of the virus to another; (E) extracting an identifying signature from the executable code portion and adding the signature to a signature database; (F) informing neighboring data processing systems on a network of an occurrence of the undesirable software entity; and (G) generating a distress signal, if appropriate, so as to call upon an expert to resolve difficult cases. A feature of this invention is the automatic execution of the foregoing steps in response to a detection of an undesired software entity, such as a virus or a worm, within a data processing system. The automatic extraction of the identifying signature, the addition of the signature to a signature data base, and the immediate use of the signature by a scanner provides protection from subsequent infections of the system, and also a network of systems, by the same or an altered form of the undesirable software entity.
    • 一种方法包括以下组件步骤或这些步骤的一些功能子集:(A)针对异常行为的数据处理系统(10)的周期性监视,其可以指示存在不期望的软件实体,例如计算机病毒,蠕虫, 或特洛伊木马; (B)自动扫描已知类型的不合需要的软件实体,并发现补救措施; (C)部署诱饵计划以捕获未知类型的计算机病毒样本; (D)识别捕获的样本的机器代码部分,其不可能从病毒的一个实例变化到另一个; (E)从可执行代码部分提取识别签名并将签名添加到签名数据库; (F)通知网络上的相邻数据处理系统出现不期望的软件实体; 和(G)如果适当,产生遇险信号,以呼吁专家解决困难的情况。 本发明的一个特征是响应于在数据处理系统内检测不期望的软件实体(例如病毒或蠕虫)来自动执行上述步骤。 识别签名的自动提取,签名数据库的签名添加以及扫描仪的签名的即时使用提供了保护,防止系统的随后的感染以及系统的相同或不同的系统的网络 改变形式的不良软件实体。