专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US07950059B2 Universal worm catcher 有权
标题翻译：万能虫捕手
公开(公告)号：US07950059B2
公开(公告)日：2011-05-24
申请号：US10577860
申请日：2004-11-18
申请人： Leeor Aharon , Cfir Cohen
发明人： Leeor Aharon , Cfir Cohen
IPC分类号： G08B23/00
CPC分类号： G06F21/566 , G06F21/55 , G06F21/56 , H04L63/1408 , H04L63/1416 , H04L63/145
摘要： A method for detecting malicious code in a stream of data traffic input (400) to a gateway in a data network by monitoring for suspicious data in the stream of data traffic (407). Upon detecting the suspicious data, an attempt is made to disassemble the suspicious data (403) and a treat weight is assigned for each instruction. The attempt to disassemble is initiated at initial instructions each with a different offset within the suspicious portion of data. The threat weights are accumulated respectively for each branch option in the disassembled code (403), producing respectively an accumulated threat weight for each branch option. When the accumulated threat weight exceeds a previously defined threshold level, an alert is generated and/or traffic is blocked from the source of the malicious code.
摘要翻译：一种通过监视数据业务流中的可疑数据（407）来检测在数据网络中的网关输入（400）的数据业务流中的恶意代码的方法。在检测到可疑数据时，尝试拆卸可疑数据（403），并为每个指令分配处理权重。在初始指令中启动拆卸尝试，每个指令在数据的可疑部分内具有不同的偏移量。分解代码（403）中的每个分支选项分别累积威胁权重，分别产生每个分支选项的累积威胁权重。当累积威胁重量超过先前定义的阈值水平时，会产生警报和/或阻止来自恶意代码的流量。

2. 发明申请

US20070089171A1 Universal worm catcher 有权
标题翻译：万能虫捕手
公开(公告)号：US20070089171A1
公开(公告)日：2007-04-19
申请号：US10577860
申请日：2006-04-28
申请人： Leeor Aharon , Cfir Cohen
发明人： Leeor Aharon , Cfir Cohen
IPC分类号： G06F12/14
CPC分类号： G06F21/566 , G06F21/55 , G06F21/56 , H04L63/1408 , H04L63/1416 , H04L63/145
摘要： A method for detecting malicious code in a stream of data traffic input (400) to a gateway in a data network by monitoring for suspicious data in the stream of data traffic (407). Upon detecting the suspicious data, an attempt is made to disas- semble the suspicious data (403) and a treat weight is assigned for each instruction. The attempt to disassemble is initiated at initial instructions each with a different offset within the suspicious portion of data. The threat weights are accumulated respectively for each branch option in the disassembled code (403), producing respectively an accumulated threat weight for each branch option. When the accumulated threat weight exceeds a previously defined threshold level, an alert is generated and/or traffic is blocked from the source of the malicious code.
摘要翻译：一种通过监视数据业务流中的可疑数据（407）来检测在数据网络中的网关输入（400）的数据业务流中的恶意代码的方法。在检测到可疑数据时，尝试对可疑数据进行解析（403），并为每个指令分配处理权重。在初始指令中启动拆卸尝试，每个指令在数据的可疑部分内具有不同的偏移量。分解代码（403）中的每个分支选项分别累积威胁权重，分别产生每个分支选项的累积威胁权重。当累积威胁重量超过先前定义的阈值水平时，会产生警报和/或阻止来自恶意代码的流量。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式