专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08528091B2 Methods, systems, and media for detecting covert malware 有权
标题翻译：用于检测隐蔽恶意软件的方法，系统和媒体
公开(公告)号：US08528091B2
公开(公告)日：2013-09-03
申请号：US12982984
申请日：2010-12-31
申请人： Brian M. Bowen , Pratap V. Prabhu , Vasileios P. Kemerlis , Stylianos Sidiroglou , Salvatore J. Stolfo , Angelos D. Keromytis
发明人： Brian M. Bowen , Pratap V. Prabhu , Vasileios P. Kemerlis , Stylianos Sidiroglou , Salvatore J. Stolfo , Angelos D. Keromytis
IPC分类号： G06F11/00 , H04L9/32
CPC分类号： G06F21/56 , G06F21/566 , G06F21/577 , H04L63/1441 , H04L63/1491
摘要： Methods, systems, and media for detecting covert malware are provided. In accordance with some embodiments, a method for detecting covert malware in a computing environment is provided, the method comprising: generating simulated user activity outside of the computing environment; conveying the simulated user activity to an application inside the computing environment; and determining whether a decoy corresponding to the simulated user activity has been accessed by an unauthorized entity.
摘要翻译：提供了用于检测隐蔽恶意软件的方法，系统和媒体。根据一些实施例，提供了一种用于在计算环境中检测隐匿恶意软件的方法，所述方法包括：在所述计算环境之外生成模拟用户活动; 将所述模拟用户活动传达到所述计算环境内的应用; 以及确定是否已经被未经授权的实体访问与所述模拟用户活动相对应的诱饵。

2. 发明申请

US20090222922A1 SYSTEMS, METHODS, AND MEDIA PROTECTING A DIGITAL DATA PROCESSING DEVICE FROM ATTACK 有权
标题翻译：系统，方法和媒体从攻击保护数字数据处理设备
公开(公告)号：US20090222922A1
公开(公告)日：2009-09-03
申请号：US12063733
申请日：2006-08-18
申请人： Stylianos Sidiroglou , Angelos D. Keromytis , Salvatore J. Stolfo
发明人： Stylianos Sidiroglou , Angelos D. Keromytis , Salvatore J. Stolfo
IPC分类号： G06F21/00
CPC分类号： H04L63/1425 , H04L51/08 , H04L51/12 , H04L63/1416 , H04L63/1466
摘要： In accordance with some embodiments of the disclosed subject matter, systems, methods, and media for protecting a digital data processing device from attack are provided. For example, in some embodiments, a method for protecting a digital data processing device from attack is provided, that includes, within a virtual environment: receiving at least one attachment to an electronic mail; and executing the at least one attachment; and based on the execution of the at least one attachment, determining whether anomalous behavior occurs.
摘要翻译：根据所公开的主题的一些实施例，提供了用于保护数字数据处理装置免受攻击的系统，方法和媒体。例如，在一些实施例中，提供了一种用于保护数字数据处理设备免受攻击的方法，其包括在虚拟环境内：接收至少一个附件到电子邮件; 以及执行所述至少一个附件; 并且基于所述至少一个附件的执行，确定是否发生异常行为。

3. 发明授权

US08407785B2 Systems, methods, and media protecting a digital data processing device from attack 有权
标题翻译：保护数字数据处理设备免受攻击的系统，方法和媒体
公开(公告)号：US08407785B2
公开(公告)日：2013-03-26
申请号：US12063733
申请日：2006-08-18
申请人： Stylianos Sidiroglou , Angelos D. Keromytis , Salvatore J. Stolfo
发明人： Stylianos Sidiroglou , Angelos D. Keromytis , Salvatore J. Stolfo
IPC分类号： G06F11/00
CPC分类号： H04L63/1425 , H04L51/08 , H04L51/12 , H04L63/1416 , H04L63/1466
摘要： In accordance with some embodiments of the disclosed subject matter, systems, methods, and media for protecting a digital data processing device from attack are provided. For example, in some embodiments, a method for protecting a digital data processing device from attack is provided, that includes, within a virtual environment: receiving at least one attachment to an electronic mail; and executing the at least one attachment; and based on the execution of the at least one attachment, determining whether anomalous behavior occurs.
摘要翻译：根据所公开的主题的一些实施例，提供了用于保护数字数据处理装置免受攻击的系统，方法和媒体。例如，在一些实施例中，提供了一种用于保护数字数据处理设备免受攻击的方法，其包括在虚拟环境内：接收至少一个附件到电子邮件; 以及执行所述至少一个附件; 并且基于所述至少一个附件的执行，确定是否发生异常行为。

4. 发明授权

US08601322B2 Methods, media, and systems for detecting anomalous program executions 有权
标题翻译：用于检测异常程序执行的方法，介质和系统
公开(公告)号：US08601322B2
公开(公告)日：2013-12-03
申请号：US13301741
申请日：2011-11-21
申请人： Salvatore J. Stolfo , Angelos D. Keromytis , Stylianos Sidiroglou
发明人： Salvatore J. Stolfo , Angelos D. Keromytis , Stylianos Sidiroglou
IPC分类号： G06F11/00
CPC分类号： G06F11/0772 , G06F11/0718 , G06F11/0751 , G06F11/079 , G06F11/3652
摘要： Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.
摘要翻译：提供了用于检测异常程序执行的方法，介质和系统。在一些实施例中，提供了用于检测异常程序执行的方法，包括：在仿真器中执行程序的至少一部分; 将在仿真器中产生的函数调用与所述程序的至少一部分的函数调用模型进行比较; 并根据比较将功能调用识别为异常。在一些实施例中，提供了用于检测异常程序执行的方法，包括：修改程序以包括程序执行期间进行的程序级函数调用的指示; 将在仿真器中进行的程序级功能调用的至少一个指标与所述程序的至少一部分的函数调用模型进行比较; 以及基于所述比较，将与所述至少一个所述指示符相对应的功能调用识别为异常。

5. 发明申请

US20120151270A1 METHODS, MEDIA, AND SYSTEMS FOR DETECTING ANOMALOUS PROGRAM EXECUTIONS 有权
标题翻译：检测异常程序执行的方法，媒体和系统
公开(公告)号：US20120151270A1
公开(公告)日：2012-06-14
申请号：US13301741
申请日：2011-11-21
申请人： Salvatore J. Stolfo , Angelos D. Keromytis , Stylianos Sidiroglou
发明人： Salvatore J. Stolfo , Angelos D. Keromytis , Stylianos Sidiroglou
IPC分类号： G06F11/00
CPC分类号： G06F11/0772 , G06F11/0718 , G06F11/0751 , G06F11/079 , G06F11/3652
摘要： Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.
摘要翻译：提供了用于检测异常程序执行的方法，介质和系统。在一些实施例中，提供了用于检测异常程序执行的方法，包括：在仿真器中执行程序的至少一部分; 将在仿真器中产生的函数调用与所述程序的至少一部分的函数调用模型进行比较; 并根据比较将功能调用识别为异常。在一些实施例中，提供了用于检测异常程序执行的方法，包括：修改程序以包括程序执行期间进行的程序级函数调用的指示; 将在仿真器中进行的程序级功能调用的至少一个指标与所述程序的至少一部分的函数调用模型进行比较; 以及基于所述比较，将与所述至少一个所述指示符相对应的功能调用识别为异常。

6. 发明申请

US20110167494A1 METHODS, SYSTEMS, AND MEDIA FOR DETECTING COVERT MALWARE 有权
标题翻译：检测覆盖恶意软件的方法，系统和媒体
公开(公告)号：US20110167494A1
公开(公告)日：2011-07-07
申请号：US12982984
申请日：2010-12-31
申请人： Brian M. Bowen , Pratap V. Prabhu , Vasileios P. Kemerlis , Stylianos Sidiroglou , Salvatore J. Stolfo , Angelos D. Keromytis
发明人： Brian M. Bowen , Pratap V. Prabhu , Vasileios P. Kemerlis , Stylianos Sidiroglou , Salvatore J. Stolfo , Angelos D. Keromytis
IPC分类号： G06F21/00
CPC分类号： G06F21/56 , G06F21/566 , G06F21/577 , H04L63/1441 , H04L63/1491
摘要： Methods, systems, and media for detecting covert malware are provided. In accordance with some embodiments, a method for detecting covert malware in a computing environment is provided, the method comprising: generating simulated user activity outside of the computing environment; conveying the simulated user activity to an application inside the computing environment; and determining whether a decoy corresponding to the simulated user activity has been accessed by an unauthorized entity.
摘要翻译：提供了用于检测隐蔽恶意软件的方法，系统和媒体。根据一些实施例，提供了一种用于在计算环境中检测隐匿恶意软件的方法，所述方法包括：在所述计算环境之外生成模拟用户活动; 将所述模拟用户活动传达到所述计算环境内的应用; 以及确定是否已经被未经授权的实体访问与所述模拟用户活动相对应的诱饵。

7. 发明授权

US07962798B2 Methods, systems and media for software self-healing 有权
标题翻译：用于软件自愈的方法，系统和媒体
公开(公告)号：US07962798B2
公开(公告)日：2011-06-14
申请号：US11785317
申请日：2007-04-17
申请人： Michael E. Locasto , Angelos D. Keromytis , Salvatore J. Stolfo , Angelos Stavrou , Gabriela Cretu , Stylianos Sidiroglou , Jason Nieh , Oren Laadan
发明人： Michael E. Locasto , Angelos D. Keromytis , Salvatore J. Stolfo , Angelos Stavrou , Gabriela Cretu , Stylianos Sidiroglou , Jason Nieh , Oren Laadan
IPC分类号： G06F11/00
CPC分类号： G06F11/1438
摘要： Methods, systems, and media for enabling a software application to recover from a fault condition, and for protecting a software application from a fault condition, are provided. In some embodiments, methods include detecting a fault condition during execution of the software application, restoring execution of the software application to a previous point of execution, the previous point of execution occurring during execution of a first subroutine in the software application, and forcing the first subroutine to forego further execution and return to a caller of the first subroutine.
摘要翻译：提供了用于使软件应用程序从故障状态恢复并用于保护软件应用程序免受故障状况的方法，系统和媒体。在一些实施例中，方法包括在执行软件应用期间检测故障状况，将软件应用程序的执行恢复到先前的执行点，在执行软件应用程序中的第一子程序期间发生的先前执行点，并强制执行第一个子程序放弃进一步执行并返回第一个子程序的调用者。

8. 发明申请

US20100011243A1 Methods, systems and media for software self-healing 有权
标题翻译：用于软件自愈的方法，系统和媒体
公开(公告)号：US20100011243A1
公开(公告)日：2010-01-14
申请号：US11785317
申请日：2007-04-17
申请人： Michael E. Locasto , Angelos D. Keromytis , Salvatore J. Stolfo , Angelos Stavrou , Gabriela Cretu , Stylianos Sidiroglou , Jason Nieh , Oren Laadan
发明人： Michael E. Locasto , Angelos D. Keromytis , Salvatore J. Stolfo , Angelos Stavrou , Gabriela Cretu , Stylianos Sidiroglou , Jason Nieh , Oren Laadan
IPC分类号： G06F11/14
CPC分类号： G06F11/1438
摘要： Methods, systems, and media for enabling a software application to recover from a fault condition, and for protecting a software application from a fault condition, are provided. In some embodiments, methods include detecting a fault condition during execution of the software application, restoring execution of the software application to a previous point of execution, the previous point of execution occurring during execution of a first subroutine in the software application, and forcing the first subroutine to forego further execution and return to a caller of the first subroutine.
摘要翻译：提供了用于使软件应用程序从故障状态恢复并用于保护软件应用程序免受故障状况的方法，系统和媒体。在一些实施例中，方法包括在执行软件应用期间检测故障状况，将软件应用程序的执行恢复到先前的执行点，在执行软件应用程序中的第一子程序期间发生的先前执行点，并强制执行第一个子程序放弃进一步执行并返回第一个子程序的调用者。

9. 发明申请

US20080141374A1 SYSTEMS AND METHODS FOR DETECTING AND INHIBITING ATTACKS USING HONEYPOTS 有权
标题翻译：使用蜂蜜检测和抑制攻击的系统和方法
公开(公告)号：US20080141374A1
公开(公告)日：2008-06-12
申请号：US11870043
申请日：2007-10-10
申请人： Stylianos Sidiroglou , Angelos D. Keromytis , Kostas G. Anagnostakis
发明人： Stylianos Sidiroglou , Angelos D. Keromytis , Kostas G. Anagnostakis
IPC分类号： G06F21/06
CPC分类号： G06F21/554
摘要： In accordance with some embodiments, systems and methods that protect an application from attacks are provided. In some embodiments, traffic from a communication network is received by an anomaly detection component. The anomaly detection component monitors the received traffic and routes the traffic either to the protected application or to a honeypot, where the honeypot shares all state information with the application. If the received traffic is routed to the honeypot, the honeypot monitors the traffic for an attack. If an attack occurs, the honeypot repairs the protected application (e.g., discarding any state changes incurred from the attack, reverting to previously saved state information, etc.).
摘要翻译：根据一些实施例，提供了保护应用免受攻击的系统和方法。在一些实施例中，来自通信网络的业务由异常检测组件接收。异常检测组件监视接收的流量，并将流量路由到受保护的应用程序或蜜罐，蜜罐与应用程序共享所有状态信息。如果接收到的流量被路由到蜜罐，那么蜜罐会监视流量的攻击。如果发生攻击，蜜罐将修复受保护的应用程序（例如，丢弃从攻击中导致的任何状态更改，恢复到以前保存的状态信息等）。

10. 发明授权

US07904959B2 Systems and methods for detecting and inhibiting attacks using honeypots 有权
标题翻译：使用蜜罐检测和抑制攻击的系统和方法
公开(公告)号：US07904959B2
公开(公告)日：2011-03-08
申请号：US11870043
申请日：2007-10-10
申请人： Stylianos Sidiroglou , Angelos D. Keromytis , Kostas G. Anagnostakis
发明人： Stylianos Sidiroglou , Angelos D. Keromytis , Kostas G. Anagnostakis
IPC分类号： G06F11/00 , H04L9/32
CPC分类号： G06F21/554
摘要： In accordance with some embodiments, systems and methods that protect an application from attacks are provided. In some embodiments, traffic from a communication network is received by an anomaly detection component. The anomaly detection component monitors the received traffic and routes the traffic either to the protected application or to a honeypot, where the honeypot shares all state information with the application. If the received traffic is routed to the honeypot, the honeypot monitors the traffic for an attack. If an attack occurs, the honeypot repairs the protected application (e.g., discarding any state changes incurred from the attack, reverting to previously saved state information, etc.).
摘要翻译：根据一些实施例，提供了保护应用免受攻击的系统和方法。在一些实施例中，来自通信网络的业务由异常检测组件接收。异常检测组件监视接收的流量，并将流量路由到受保护的应用程序或蜜罐，蜜罐与应用程序共享所有状态信息。如果接收到的流量被路由到蜜罐，那么蜜罐会监视流量的攻击。如果发生攻击，蜜罐将修复受保护的应用程序（例如，丢弃从攻击中导致的任何状态更改，恢复到以前保存的状态信息等）。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式