СПОСОБ И СИСТЕМА АВТОМАТИЧЕСКОГО УПРАВЛЕНИЯ ЛИЦЕНЗИЯМИ

Изобретение относится к системам и способам администрирования и управления лицензиями на программное обеспечение устройств, а более конкретно к системам и способам автоматического определения порядка применения политик безопасности к устройствам в сети исходя из доступного числа лицензий. Технический результат настоящего изобретения заключается в повышении защищенности устройств компьютерной сети с ограниченным набором лицензий на программное обеспечение. Способ применения политик безопасности к устройствам содержит этапы, на которых: а. выбирают критерии для устройств, которые, по меньшей мере, характеризуют местоположение устройств, пользователей устройств, программное обеспечение устройств и аппаратную часть устройств, где критерии выбирают в зависимости от целей сортировки устройств; б. получают значения критериев для каждого из устройств; в. вычисляют значение коэффициента устройства на основании полученных значений критериев для сортировки устройств, где коэффициент устройства числовое ...

СИСТЕМА И СПОСОБ УСТРАНЕНИЯ ПОСЛЕДСТВИЙ ЗАРАЖЕНИЯ ВИРТУАЛЬНЫХ МАШИН

Изобретение относится к информационной безопасности. Технический результат заключается в обеспечении безопасности виртуальной машины (ВМ). Способ устранения последствий заражения виртуальных машин, в котором формируют при помощи средства обеспечения безопасности второй ВМ набор инструкций для устранения последствий заражения объектом интереса первой ВМ; для формирования набора инструкций используют информацию из базы данных, содержащей данные о соответствии признаков вредоносных объектов действиям, которые необходимо выполнить, чтобы устранить последствия заражения; анализируют при помощи средства обеспечения безопасности функциональные возможности средства защиты первой ВМ с целью определения набора недостающих компонентов, необходимых средству защиты для выполнения ранее сформированного набора инструкций для устранения последствий заражения первой ВМ; набор недостающих компонентов включает исполняемые файлы, при помощи которых средство выполнения инструкций, входящее в состав средства ...

Системы и способы защиты от вредоносного программного обеспечения на основе нечеткого вайтлистинга

Изобретение относится к области компьютерной безопасности. Технический результат заключается в повышении эффективности вайтлистинга, не допуская при этом снижения безопасности данных. Предложен способ, в котором в клиентской компьютерной системе в ответ на предварительное определение подозрительности целевого объекта на вредоносность генерируют множество целевых хешей целевого объекта, каждый целевой хеш представляет отдельный блок кода целевого объекта, содержащий последовательность процессорных инструкций; отправляют множество целевых хешей на сервер; получают от сервера серверный индикатор, указывающий, является ли целевой объект вредоносным, причем серверный индикатор генерируется посредством получения множества ссылочных хешей ссылочного объекта для по меньшей мере одного целевого хеша из множества целевых хешей, причем ссылочный объект выбирают согласно целевому хешу из набора объектов, занесенных в вайтлист, если множество целевых хешей не идентично множеству ссылочных хешей, определяют ...

ПРОФИЛИРОВАНИЕ ВЫПОЛНЕНИЯ КОДА

Изобретение относится к компьютерной безопасности. Технический результат заключается в обеспечении новой системы и нового способа обнаружения вредоносных программ, которые не могут быть обнаружены известными системами и способами, для защиты электронного устройства. Система защиты электронного устройства содержит набор логики правил доступа вредоносного программного обеспечения, содержащий: идентификацию множества объектов электронного устройства, подлежащих отслеживанию; идентификацию одной или больше операций между объектами, подлежащих отслеживанию; и идентификацию структуры операций, подлежащих отслеживанию; и процессор, выполненный с возможностью генерирования, на основе набора логики правил доступа вредоносного программного обеспечения, уведомления о выполнении одной из операций, подлежащих отслеживанию; модуль борьбы с вредоносным программным обеспечением, выполненный с возможностью определения, на основе уведомления и структуры наблюдаемых операций, указывают ли операции, подлежащие ...

СИСТЕМЫ И СПОСОБЫ ДИНАМИЧЕСКОГО АГРЕГИРОВАНИЯ ПОКАЗАТЕЛЕЙ ДЛЯ ОБНАРУЖЕНИЯ СЕТЕВОГО МОШЕННИЧЕСТВА

Изобретение относится к способам и системам для обнаружения сетевого мошенничества. Технический результат заключается в повышении эффективности обнаружения сетевого мошенничества. Предложен способ, в котором используют компьютерную систему для определения агрегированного показателя мошенничества целевого документа в виде комбинации первого показателя мошенничества и второго показателя мошенничества целевого документа, причем упомянутые первый и второй показатели мошенничества определяют в соответствии с отличающимися процедурами оценки мошенничества; используют компьютерную систему для определения третьего показателя мошенничества целевого документа; в ответ на определение упомянутого третьего показателя мошенничества используют компьютерную систему для изменения агрегированного показателя мошенничества на первую величину, определяемую согласно произведению упомянутого третьего показателя мошенничества и разности между агрегированным показателем и максимально допустимым агрегированным показателем ...

СИСТЕМА И СПОСОБ ОБНАРУЖЕНИЯ ВРЕДОНОСНЫХ ИСПОЛНЯЕМЫХ ФАЙЛОВ НА ОСНОВАНИИ СХОДСТВА РЕСУРСОВ ИСПОЛНЯЕМЫХ ФАЙЛОВ

Изобретение относится к вычислительной технике. Технический результат заключается в повышении эффективности обнаружения вредоносных исполняемых файлов. Система обнаружения вредоносных исполняемых файлов на основании сходства ресурсов исполняемых файлов содержит средство обработки ресурсов для определения вида исполняемого файла и, по крайней мере, одного типа в соответствии с определенным видом исполняемого файла, выявления, по крайней мере, одного ресурса определенного типа исполняемого файла при помощи средства обработки ресурсов, преобразования, по крайней мере, одного выявленного ресурса определенного типа в формат для сравнения и его передачи средству сравнения; средство сравнения для подсчета степени сходства, по крайней мере, одного выявленного ресурса определенного типа с ресурсами упомянутого типа из ресурсов известных вредоносных исполняемых файлов из базы данных ресурсов с помощью алгоритмов сравнения для соответствующих типов ресурсов, передачи результата подсчета степени сходства ...

СПОСОБ ОТЛОЖЕННОГО УСТРАНЕНИЯ ВРЕДОНОСНОГО КОДА

Изобретение относится к антивирусным технологиям, а более конкретно к системам и способам отложенного устранения вредоносного кода. Технический результат настоящего изобретения заключается в обеспечении лечения вредоносных программ, которые препятствуют лечению. Настоящий технический результат достигается путем использования способа лечения обнаруженных вредоносных объектов, при котором обнаруживают вредоносные объекты на компьютере, формируют, по меньшей мере, одну задачу лечения обнаруженных вредоносных объектов, при этом задача формируется с использованием языка сценариев. Сформированную задачу лечения обнаруженных вредоносных объектов записывают в заданную ветку реестра перед перезагрузкой компьютера, проверяют целостность задачи лечения обнаруженных вредоносных объектов, перезагружают компьютер. Загружают драйвер для выполнения, по меньшей мере, одной задачи лечения обнаруженных вредоносных объектов, и драйвер операционной системы, позволяющий выполнить задачу лечения обнаруженных ...

СИСТЕМА И СПОСОБ ОБНАРУЖЕНИЯ ВРЕДОНОСНЫХ ФАЙЛОВ ОПРЕДЕЛЕННОГО ТИПА

Изобретение относится к антивирусным технологиям, а более конкретно к системам обнаружения вредоносных файлов определенного типа. Технический результат заключается в обеспечении возможности обнаружения вредоносного кода в файлах определенного типа с помощью соответствующих сигнатур. Настоящий результат достигается за счет использования способа создания сигнатуры для обнаружения вредоносных файлов определенного формата, который содержит этапы, на которых обнаруживают подозрительный файл и распознают его формат, с учетом которого проверяют упомянутый файл с помощью антивируса и коллекции безопасных файлов. При этом проверяют подозрительный файл с помощью виртуальной машины в том случае, если подозрительный файл не является безопасным на основании сравнения с коллекцией безопасных файлов или вредоносным после его проверки антивирусом. После анализа результатов проверки подозрительного файла с помощью виртуальной машины создают древовидную структуру сигнатур для обнаруженных вредоносных файлов ...

Система и способ оптимизации антивирусной проверки неактивных операционных систем

Изобретение относится к системе и способу антивирусной проверки операционных систем (ОС), установленных на компьютере и неактивных в момент проверки. Технический результат заключается в ускорении проведения антивирусной проверки неактивной ОС и в проведении антивирусной проверки только одной неактивной ОС при наличии нескольких установленных ОС. Система содержит средство перечисления ОС, предназначенное для поиска установленных неактивных ОС, определения идентификаторов логических дисков для каждой установленной неактивной ОС; средство поиска файлов, предназначенное для определения неактивной ОС, которую необходимо проверить на наличие вредоносных файлов, и проведения антивирусной проверки файлов неактивной ОС, причем при наличии нескольких установленных неактивных ОС производится выбор неактивной ОС для антивирусной проверки, при этом сопоставляют идентификаторы логических дисков, относящиеся к неактивной ОС, с идентификаторами логических дисков, относящимися к активной ОС, где под активной ...

СПОСОБ ОБНАРУЖЕНИЯ ВРЕДОНОСНОГО ПРОГРАММНОГО ОБЕСПЕЧЕНИЯ В ЯДРЕ ОПЕРАЦИОННОЙ СИСТЕМЫ

Изобретение относится к вычислительной технике и к обеспечению информационной безопасности автоматизированных и информационно-вычислительных систем, в частности к средствам обнаружения вредоносного программного обеспечения (ПО). Техническим результатом является повышение эффективности обнаружения вредоносного ПО за счет обеспечения возможности обнаружения нелегальных перехватов и изменения кода в ядре и загружаемых модулях ядра ОС. Способ реализуется на компьютере с установленной на нем операционной системой (ОС) и заключается в том, что формируют точку прерывания при выполнении системного вызова пользовательского приложения на возникновение передачи управления по адресу в ядре загруженной ОС, проводят проверку структуры данных загруженной ОС, выполняя следующие действия: определяют адрес команды в оперативной памяти компьютера, которой будет передано управление в ходе системного вызова; проверяют принадлежность адресов команд, выполняемых в ходе системного вызова, к нормальному диапазону ...

СЛОЖНОЕ КЛАССИФИЦИРОВАНИЕ ДЛЯ ВЫЯВЛЕНИЯ ВРЕДОНОСНЫХ ПРОГРАММ

Изобретение относится к области защиты компьютерных систем от вредоносных программ. Техническим результатом является определение, является ли программная сущность вредоносной, на основе множества показателей оценки соответствующей сущности, что позволяет создать более надежное антивредоносное решение по сравнению с аналогичными традиционными решениями. Раскрыта хостовая система для определения вредоносной программной сущности, содержащая блок памяти, хранящий инструкции, при исполнении которых по меньшей мере одним аппаратным процессором хостовой системы хостовая система выполняет модуль управления сущностями, средство оценки сущностей и классифицирующий механизм, при этом: модуль управления сущностями конфигурирован с возможностью управлять коллекцией оцениваемых программных сущностей, причем управление коллекцией содержит: идентификацию набора сущностей-потомков первой сущности коллекции; определение, завершена ли первая сущность; в ответ, когда первая сущность завершена, определение, ...

СПОСОБ ОБНАРУЖЕНИЯ КОДОВ ВРЕДОНОСНЫХ КОМПЬЮТЕРНЫХ ПРОГРАММ В ТРАФИКЕ СЕТИ ПЕРЕДАЧИ ДАННЫХ, В ТОМ ЧИСЛЕ ПОДВЕРГНУТЫХ КОМБИНАЦИЯМ ПОЛИМОРФНЫХ ПРЕОБРАЗОВАНИЙ

Изобретение относится к области компьютерной безопасности. Технический результат заключается в повышении полноты обнаружения вредоносных компьютерных программ, в том числе подвергнутых полиморфным преобразованиям. Способ, в котором упорядоченные ячейки памяти, содержащие зарегистрированный трафик, разделяют на последовательные, равновеликие блоки заданной длины; в оперативной памяти формируют образ трафика, выделяя упорядоченный набор ячеек, с количеством ячеек, равным числу блоков; в каждом из блоков трафика сравнивают состояния всех ячеек памяти, входящих в анализируемый блок, определяя число уникальных состояний ячеек в каждом блоке; в i-е ячейки образа записывают значения, соответствующие числу уникальных состояний ячеек в i-х блоках анализируемого трафика; определяют степень сходства всех подмножеств последовательных ячеек сформированного образа со всеми эталонами, выбирая такие подмножества, длина которых равна длине как минимум одного из эталонов, и вычисляя значение величины степени ...

Система и способ обнаружения вредоносных файлов на распределённой системе виртуальных машин

Изобретение предназначено для антивирусной проверки файлов. Технический результат настоящего изобретения заключается в повышении скорости выполнения антивирусной проверки файлов за счет распределения файлов, предназначенных для выполнения антивирусной проверки, по виртуальным машинам. Данный результат достигается с помощью использования системы проведения антивирусной проверки файлов на виртуальных машинах, при этом упомянутая система содержит: «защищаемую виртуальную машину», которая взаимодействует с двумя «виртуальными машинами защиты». Для «виртуальных машин защиты» определяется аппроксимационная зависимость эффективности антивирусной проверки, на основании которой выбирается конкретная «виртуальная машина защиты», для которой определяется время начала выполнения антивирусной проверки файлов, полученных от «виртуальной машины защиты». 2 н. и 12 з.п. ф-лы, 3 ил.

УСТРОЙСТВО ПРОВЕРКИ СЪЕМНЫХ НОСИТЕЛЕЙ ИНФОРМАЦИИ НА НАЛИЧИЕ ВРЕДОНОСНОГО КОДА

Устройство проверки съемных носителей информации на наличие вредоносного кода относится к вычислительной технике и может быть использовано при работе со сменными носителями информации для предотвращения распространения вредоносного программного обеспечения (компьютерных вирусов).Технический результат, заключающийся в расширении функциональных возможностей за счет обеспечения возможности автономной проверки съемных носителей информации (без использования персонального компьютера), а также обеспечения возможности обновления записей сигнатур вредоносных программ (компьютерных вирусов), достигается путем введения в известное устройство дополнительных компонентов: блока управления, блока индикации, канала обновления записей сигнатур и блока сетевого адаптера беспроводной связи.

Система и способ определения уровня доверия файла

Изобретение относится к области компьютерной безопасности. Технический результат заключается в улучшении качества классификации доверенного программного обеспечения. Согласно варианту реализации используется способ определения уровня доверия файлов, в котором: выбирают имена файлов, расположенных по заданным путям у заданной доли устройств пользователей; формируют группу файлов из двух файлов со стабильными именами и являющимися компонентами одного приложения; для каждой группы определяют разработчика, с использованием закрытого ключа которого подписан файл упомянутой группы; для каждой группы определяют уровень доверия для всех файлов группы на основании вердиктов сторонних сервисов, присвоенных файлам упомянутой группы, а также на основании вердиктов сторонних сервисов, присвоенных файлу на устройствах пользователей, не принадлежащему упомянутой группе и подписанному закрытым ключом доминирующего разработчика, или на основании вердиктов сторонних сервисов, присвоенных файлам другой группы ...

КАСКАДНЫЙ КЛАССИФИКАТОР ДЛЯ ПРИЛОЖЕНИЙ КОМПЬЮТЕРНОЙ БЕЗОПАСНОСТИ

Изобретение относится к области компьютерной безопасности. Технический результат заключается в обеспечении быстрой обработки больших объемов, обучающих данных, при минимальном проценте ложных позитивных срабатываний. Компьютерная система обучения классификатора для определения, представляет ли целевой объект угрозу компьютерной безопасности, содержит аппаратный процессор и запоминающее устройство, причем аппаратный процессор сконфигурирован применять обученный каскад классификаторов для определения, представляет ли целевой объект угрозу компьютерной безопасности, при этом каскад классификаторов обучен на обучающем массиве записей, причем обучающий массив предварительно классифицирован по меньшей мере на первый класс и второй класс записей, в ответ на обучение классификаторов удаление набора записей из обучающего массива для создания сокращенного обучающего массива. 3 н. и 18 з.п. ф-лы, 17 ил.

СПОСОБ ОБОЗНАЧЕНИЯ ИНФИЦИРОВАННЫХ ЭЛЕКТРОННЫХ ФАЙЛОВ

Изобретение относится к электронной технике, в частности к способу обозначения на дисплее (мониторе) электронного устройства инфицированных электронных файлов, размещенных в электронном устройстве или в Интернете. Техническим результатом является расширение функциональных возможностей обнаружения инфицированных электронных файлов за счет различных способов их обозначения, отличающих инфицированные электронные файлы от неинфицированных электронных файлов. Сущность предлагаемого изобретения заключается в том, что отображенный на дисплее электронного устройства в виде виртуального символа, или объекта, или образа инфицированный электронный файл имеет полностью или частично другой цвет, и/или яркость, и/или размер, и/или форму, отличающие его от неинфицированного электронного файла, или наведенный на виртуальный символ, или объект, или образ, обозначающий инфицированный электронный файл, курсор мигает и/или изменяет цвет, и/или яркость, и/или размер, и/или форму, или инфицированный электронный ...

Способ обнаружения вредоносных файлов, противодействующих анализу в изолированной среде

Изобретение относится к способу признания файла вредоносным. Технический результат заключается в расширении арсенала средств, предназначенных для признания вредоносными файлов, использующих средства для противодействия анализу в изолированной среде. Способ, по которому: открывают файл средством безопасности в виртуальной машине в виде среды для безопасного исполнения файлов; формируют с помощью средства перехвата гипервизора журнал, в который сохраняют события, возникающие во время исполнения по меньшей мере одного потока процесса, созданного при открытии файла в упомянутой виртуальной машине; формируют средством безопасности из журнала шаблон поведения, который состоит из тех событий, которые имеют отношение к безопасности; отслеживают средством безопасности события, возникающие во время исполнения по меньшей мере одного потока процесса, созданного при открытии файла на компьютерной системе; признают с помощью средства безопасности файл вредоносным при обнаружении по меньшей мере одного ...

СПОСОБ ПОСТРОЕНИЯ СИСТЕМЫ ОБНАРУЖЕНИЯ ИНЦИДЕНТОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ В АВТОМАТИЗИРОВАННЫХ СИСТЕМАХ УПРАВЛЕНИЯ

Изобретение относится к защите информации. Технический результат заключается в сокращении времени обнаружения инцидента информационной безопасности. Способ построения системы обнаружения инцидентов информационной безопасности (ИБ) для автоматизированных систем управления, включающий в себя этапы построения и формирования подсистем обнаружения инцидентов ИБ, в ходе которого, используя метод морфологического анализа, формируют подсистемы планирования уровня, координации, управления средствами защиты информации и сбора данных о состоянии объекта, этап оценки реализации функций в вариантах построения системы обнаружения инцидентов информационной безопасности АСУ, в ходе которого производят оценку соответствия реализованных функций в каждом варианте построения системы из множества вариантов, сформированного на предыдущем этапе, этап оценки стоимости и вариантов построения системы защиты от компьютерных атак, этап оценки оптимального варианта построения системы обнаружения инцидентов информационной ...

Способ обнаружения вредоносных программ и элементов

Изобретение относится к области вычислительной техники для анализа злонамеренного программного обеспечения. Технический результат заключается в повышении вероятности обнаружения вредоносных программ и элементов без применения режима динамического детектирования при одновременном упрощении способа. Технический результат достигается за счет того, что множество декомпозированных элементов, которые функционально связаны структурой входной программы (сообщения) подвергают анализу с учетом баз данных, содержащих сведения об известных вредоносных и безопасных элементах, после чего безопасные элементы загружают на предусмотренные для них места в структуре входной программы (сообщения), а потенциально вредоносные элементы подвергают очередной декомпозиции на множество более мелких, структурно связанных, декомпозированных элементов, которые, в свою очередь, подвергают анализу с учетом упомянутых баз данных, причем полученные на этом этапе более мелкие декомпозированные безопасные элементы загружают ...

СПОСОБ УМЕНЬШЕНИЯ ВРЕМЕНИ ПРОХОЖДЕНИЯ ИСПОЛНЯЕМОГО ФАЙЛА ЧЕРЕЗ КОНТРОЛЬНУЮ ТОЧКУ

... 1. Способ уменьшения времени прохождения исполняемого файла через контрольную точку, в которой проверяется целостность упомянутого исполняемого файла, при этом упомянутый способ содержит этапы, на которых принимают и накапливают, по меньшей мере, одну часть упомянутого исполняемого файла, которые достигают упомянутой контрольной точки; проверяют целостность упомянутой, по меньшей мере, одной части упомянутого исполняемого файла; выпускают, по меньшей мере, одну накопленную часть, целостность которой проверена, по адресу назначения ускоренным способом; освобождают и отправляют, по меньшей мере, одну накопленную часть по адресу назначения замедленно; и при указании нецелостности упомянутой, по меньшей мере, одной части, выполняют процедуру оповещения. 2. Способ по п.1, к котором упомянутая замедленная отправка выполняется посредством операций, выбранных из группы, состоящей из деления пакетов, которые должны быть отправлены, на более мелкие пакеты, тем самым увеличивая передачу служебных ...

СЛОЖНОЕ КЛАССИФИЦИРОВАНИЕ ДЛЯ ВЫЯВЛЕНИЯ ВРЕДОНОСНЫХ ПРОГРАММ

Система и способ выбора средства обнаружения вредоносных файлов

Изобретение относится к антивирусным технологиям, а более конкретно к системам и способам обнаружения вредоносных файлов. Технический результат заключается в оптимизации использования вычислительных ресурсов при проверке файла на вредоносность. Технический результат достигается за счет определения характеристики файла и признаков поведения файла, определения совокупности параметров, описывающих поверхность, помещённую в вероятностное пространство, на основании определённых характеристик файла и признаков поведения файла, формирования отображения файла путем построения поверхности в указанном пространстве на основании определенной совокупности параметров, выполнения поиска в базе отображений семейства вредоносных файлов на основании сформированного отображения файла, выбора из базы средств обнаружения вредоносных файлов средства обнаружения вредоносных файлов, соответствующего семейству вредоносных файлов, найденному в базе отображений. 8 з.п. ф-лы, 9 ил.

Система и способ управления вычислительными ресурсами для обнаружения вредоносных файлов

Изобретение относится к области антивирусных технологий. Техническим результатом является управление вычислительными ресурсами для обнаружения вредоносных файлов. Раскрыта система управления вычислительными ресурсами для обнаружения вредоносных файлов, которая содержит: а) средство анализа журнала поведения, предназначенное для: формирования по меньшей мере одного шаблона поведения на основании команд и параметров, выбранных из созданного журнала поведения, исполняемых на вычислительном устройстве (далее - приложения), при этом шаблон поведения представляет собой набор из по меньшей мере одной команды и такого параметра, который описывает все команды из упомянутого набора; вычисления свертки от сформированного шаблона поведения; передачи вычисленной свертки средству вычисления степени вредоносности; б) средство вычисления степени вредоносности, предназначенное для: вычисления степени вредоносности приложений на основании анализа полученной свертки с помощью модели обнаружения вредоносных ...

ОБНАРУЖЕНИЕ ВРЕДОНОСНОГО ПРОГРАММНОГО ОБЕСПЕЧЕНИЯ С ПЕРЕКРЕСТНЫМ ОБЗОРОМ

СИСТЕМЫ И СПОСОБЫ ПРЕДОСТАВЛЕНИЯ ТЕКУЩЕЙ КОМАНДЫ ПРОЦЕССОРА ПРИ ВЫХОДЕ ИЗ ВИРТУАЛЬНОЙ МАШИНЫ

СИСТЕМА И СПОСОБ ОБНАРУЖЕНИЯ ВРЕДОНОСНЫХ ПРОГРАММ С АЛГОРИТМОМ ГЕНЕРАЦИИ ДОМЕННЫХ ИМЕН И СИСТЕМ, ЗАРАЖЕННЫХ ТАКИМИ ВРЕДОНОСНЫМИ ПРОГРАММАМИ

ПРОФИЛИРОВАНИЕ ВЫПОЛНЕНИЯ КОДА

СТРУКТУРА ОПРЕДЕЛЕНИЯ ПРОГРАММЫ, АВТОНОМНО НЕЙТРАЛИЗУЮЩЕЙ ВТОРГШИЙСЯ ВИРУС, ПРОГРАММА, ИМЕЮЩАЯ УКАЗАННУЮ СТРУКТУРУ, НОСИТЕЛЬ ДАННЫХ, НА КОТОРОМ ИНСТАЛЛИРОВАНА УКАЗАННАЯ ПРОГРАММА, А ТАКЖЕ МЕТОД И АППАРАТ, АВТОНОМНО РЕШАЮЩИЕ ПРОБЛЕМУ ВИРУСОВ

ОЦЕНКА РЕПУТАЦИИ ФАЙЛА

СПОСОБ И УСТРОЙСТВО ДЛЯ УНИЧТОЖЕНИЯ ВИРУСА С ПРИМЕНЕНИЕМ МНОЖЕСТВЕННЫХ ДВИЖКОВ

... 1. Способ обнаружения и уничтожения компьютерных вирусов, применяющий множество используемых в системе антивирусных движков, содержащей множество блоков приложений, отличающийся тем, что включает этапы, на которых:получают запросы, отправленные блоками приложений через разные каналы связи, подключенные к блокам приложений;соответственно направляют информацию файла в антивирусные движки, соответственно, для сканирования файла антивирусными движками;соответственно, получают информацию сканирования, возвращаемую антивирусными движками; икомпонуют информацию сканирования, возвращаемую антивирусными движками, для определения результата сканирования файла и отправки результата сканирования в блоки приложений через разные каналы связи.2. Способ по п. 1, отличающийся тем, что этап соответствующего направления информации файла в антивирусные движки для соответствующего сканирования файла антивирусными движками включает:анализ запроса для получения информации файла; идобавление информации файла в ...

Система и способ обнаружения модификации веб-ресурса

СИСТЕМА И СПОСОБ ДЛЯ ПРИМЕНЕНИЯ ИНДИКАТОРА РЕПУТАЦИИ ДЛЯ ОБЛЕГЧЕНИЯ СКАНИРОВАНИЯ НА НАЛИЧИЕ ВРЕДОНОСНЫХ ПРОГРАММ

ИСПОЛЬЗОВАНИЕ ТЕХНОЛОГИИ СЛЕЖЕНИЯ ЗА МОЩНОСТЬЮ ДЛЯ КОНТРОЛЯ ЦЕЛОСТНОСТИ И ПОВЫШЕНИЯ БЕЗОПАСНОСТИ КОМПЬЮТЕРНЫХ СИСТЕМ

... 1. Способ выполнения в реальном времени оценки целостности исполнения подпрограммы в компьютерной обрабатывающей платформе, содержащий этапы, на которых:контролируют исполнение подпрограммы путем трассировки энергопотребления процессора посредством взятия выборок во время исполнения подпрограммы;используют методику характеризации платформы, дополнительно содержащую этапы, на которыхобнаруживают участки трасс, которые проявляют наибольшую зависимость от переходов между состояниями в процессоре;используют упомянутые участки для выбора признаков, несущих наибольшую информацию;получают из характеризации выбранных признаков подпрограммы, содержащихся на упомянутых участках, набор доверенных образов мощности для подпрограммы;устанавливают порог для конкретной частоты ложных тревог, основываясь на вероятностном распределении расстояния от сигнатуры, составленной из упомянутых доверенных образов;сравнивают библиотеку упомянутых доверенных образов с признаками, извлеченными из трасс, полученных ...

СЛУЖБА РЕПУТАЦИИ КОНТЕНТА НА ОСНОВЕ ДЕКЛАРАЦИИ

... 1. Способ идентификации декларации контента для элемента данных, содержащий этапы, на которых:(a) с помощью по меньшей мере одного компьютера в первом сетевом узле сравнивают определенный цифровой отпечаток элемента данных с сохраненным цифровым отпечатком, ассоциированным с по меньшей мере одной декларацией контента; и(b) если этот определенный цифровой отпечаток совпадает с сохраненным цифровым отпечатком, то определяют с помощью по меньшей мере одного компьютера в первом сетевом узле, что эта по меньшей мере одна декларация контента ассоциирована с упомянутым определенным цифровым отпечатком элемента данных.2. Способ по п.1, дополнительно содержащий этапы, на которых:(c) до выполнения этапов (а) и (b), с помощью по меньшей мере одного компьютера в первом сетевом узле принимают упомянутую по меньшей мере одну декларацию контента и ассоциированный с ней цифровой отпечаток от по меньшей мере одного компьютера во втором сетевом узле; и(d) до выполнения этапов (а) и (b), сохраняют на постоянной ...

СИСТЕМА И СПОСОБ РАСПРЕДЕЛЕНИЯ ЗАДАЧ АНТИВИРУСНОЙ ПРОВЕРКИ МЕЖДУ ВИРТУАЛЬНЫМИ МАШИНАМИ В ВИРТУАЛЬНОЙ СЕТИ

... 1. Система распределения задачи антивирусной проверки между компонентами антивирусной системы, размещенными в виртуальной среде, которая содержит:а) по крайней мере, две виртуальные машины, развернутые на одном компьютерном устройстве, которое содержит монитор виртуальных машин,б) антивирусный агент, установленный на первой виртуальной машине и предназначенный для:- выявления событий, происходящих в операционной системе данной виртуальной машины,- определения объекта и типа объекта, относящихся к выявленному событию,- определения необходимости проведения антивирусной проверки в соответствии с определенной информацией,- передачи указанной выше информации средству управления,- выполнения задачи антивирусной проверки объектов с помощью назначенных методов антивирусной проверки согласно полученному запросу от средства управления;в) антивирусное средство, установленное на второй виртуальной машине и предназначенное для выполнения задачи антивирусной проверки, и взаимодействующее со средством ...

СИСТЕМА И СПОСОБ ОБНАРУЖЕНИЯ ВРЕДОНОСНЫХ ИСПОЛНЯЕМЫХ ФАЙЛОВ НА ОСНОВАНИИ СХОДСТВА РЕСУРСОВ ИСПОЛНЯЕМЫХ ФАЙЛОВ

... 1. Система обнаружения вредоносных исполняемых файлов на основании сходства ресурсов исполняемых файлов, которая содержит:а) средство обработки ресурсов, предназначенное для извлечения ресурсов анализируемого исполняемого файла и их передачи средству сравнения;б) средство сравнения, предназначенное для поиска сходства ресурсов анализируемого исполняемого файла с известными ресурсами вредоносных исполняемых файлов из базы данных ресурсов, определения и передачи результата поиска сходства средству проверки;в) базу данных ресурсов, предназначенную для хранения известных ресурсов вредоносных исполняемых файлов;г) средство проверки, предназначенное для определения того, является ли анализируемый исполняемый файл вредоносным на основании результата поиска сходства ресурсов анализируемого исполняемого файла с известными ресурсами вредоносных исполняемых файлов при помощи правил определения, хранимых в базе данных правил;д) базу данных правил, предназначенную для хранения правил определения того ...

Система и способ формирования набора антивирусных записей, используемых для обнаружения вредоносных файлов на компьютере пользователя

Система и способ обнаружения фишинговых сценариев

СИСТЕМА И СПОСОБ СОЗДАНИЯ ГИБКОЙ СВЕРТКИ ДЛЯ ОБНАРУЖЕНИЯ ВРЕДОНОСНЫХ ПРОГРАММ

... 1. Способ определения похожих файлов, в котором:а) выделяют множество признаков, по меньшей мере, из одного файла;б) разделяют множество выделенных признаков файла, по меньшей мере, на два подмножества, в одном из которых есть как минимум один изменяемый признак, в другом есть как минимум один неизменяемый признак;в) получают свертку каждого из вышеописанных подмножеств признаков файла;г) создают свертку файла как комбинацию сверток каждого из вышеописанных подмножеств признаков файла;д) сравнивают свертку, по меньшей мере, одного файла с набором заранее созданных сверток файлов;е) признают файл похожим на файлы из множества похожих файлов, имеющих одинаковую свертку, если при сравнении свертка указанного файла совпадает со сверткой файла из указанного множества.2. Способ по п.1, в котором признак файла считают изменяемым, если для множества похожих файлов признак принимает различные значения.3. Способ по п.1, в котором признак файла считают неизменяемым, если для множества похожих файлов ...

VERFAHREN ZUR FESTSTELLUNG BÖSWILLIGEN RECHNERKODES

VERFAHREN UND GERÄT ZUR ERWEITERUNG DES RESERVEGEBIETS EINER PLATTENEINHEIT

Foiling a document exploit attack

Data file transformation

Detection of malware-usable clean file

The present application regards a method of protecting against file-less or memory-resident malware which may execute a clean but vulnerable file (e.g. a web browser, media player or device driver) with a payload that takes over the process of the clean file. The present application therefore proposes methods of identifying vulnerable files by checking their threat of usage by malware or, stated differently, the detection of malware using a clean file. Such methods could exemplarily comprise identifying a vulnerable clean file in a computer system S110, which does not constitute malware but is vulnerable for usage by malware, checking the vulnerable clean file for its threat of usage by malware S120, and detecting the vulnerable clean file as malware-usable clean file on the basis of a result of said checking of its threat of usage by malware S130. A files threat of usage by malware may be indicated by checking reputation information of the vulnerable clean file.

Nullification of malicious code by data file transformation

Restricting Propagation of malicious code through >an> information technology network

A method of restricting transmission of data packets from a host entity in a network, comprising: transmitting outgoing packets to destination hosts whose identities are contained in a record stored in a working set of host identity records; over the course of repeated predetermined time intervals, restricting, to a predetermined number, destination hosts not identified in the working set and to which packets may be transmitted; deleting packets whose transmission has been restricted.

Managing registry access on a computer device

Providing a malware analysis using a secure malware detection process

In certain embodiments, a computer-implemented system comprises a boundary controller and a first malware detection agent. The boundary controller is operable to implement a security boundary between a first computer network environment and a second computer network environment. The second computer network environment has a security classification level that is more restrictive than a security classification level of the first computer network environment. The boundary controller is operable to receive from the first computer network environment a file. The first malware detection agent is positioned in the second computer network environment and is operable to receive via the boundary controller the file and apply a first malware detection process on the file. The first malware detection process is subject to the security classification level of the second computer network environment.

Computer device and method for controlling access to a printer

A method of controlling printing on printing services 50L, 50N, accessible from a primary user account 110 on a computer system comprises isolating untrusted content files 221 in a sandbox 200, formed as a content isolation environment by a secondary user account 210, which does not have access to the printing services. Printing may be controlled by an agent 500. The agent may decide, having examined an intercepted print request from the secondary user account, to allow printing to a staging file 511. The staging file is then stored in a location which may be accessible from the primary user account. Once a notification has been received indicating that the printing to the staging file has been completed, the staging file can then be printed using the printer services accessible from the primary user account.

Computer device and method for controlling access to a printer

Cyber security

Input data is received S1 that is associated with an entity associated with a computer system (10, fig. 1), e.g. a user or device. Preferably the data includes data relating to the entitys activity on the computer system. Metrics, representative of the datas characteristics, are derived S2 from the data and may reflect usage of the computer system by the entity over time, e.g. metrics relating to network traffic. The metrics are analysed S3 using one or more models, perhaps arranged to detect different types of threat. A cyber-threat risk parameter is determined S4, S5 in accordance with the analysed metrics and a model of normal behaviour of the entity, e.g. by comparing the metrics with the model. The parameter is indicative of a likelihood of a cyber-threat, preferably the probability of such likelihood, and is preferably determined using recursive Bayesian estimation. The parameter may be compared with a threshold, possibly a moving threshold, to determine whether or not there is a ...

Preventing clean files being used by malware

Protection from malicious and/or harmful content in cloud-based service scenarios

A transmission attempt of a file between a file service cloud entity 22 and a remote accessing entity 21 is detected The file is identified and a check is made for presence of a security threat scan result for said file in a scan result memory based on the identification. Based on the result of said checking, a security threat scan task for said file to a security cloud entity 23 connected to the file service cloud entity. The file is preferably identified by calculating a hash value as an identifier.

Security in virtualised computing environments

A machine learning algorithm is trained as a classifier based on a plurality of training data items, each training data item corresponding to a training virtual machine (VM) and including a representation of parameters for a configuration of the training VM and a representation of characteristics of security attacks for the training VM. One or more relationships are identified between VM configuration parameters and attack characteristics by sampling the trained machine learning algorithm. A directed graph representation of one or more sequences of VM configuration parameters for achieving a particular attack characteristic is further received. A subset of sequences in the directed graph that correspond to VM parameters of a target VM are determined to identify VM parameters of the target VM used in a security attack against the target VM. In response, protective measures may be implemented so as to protect the VM from attacks having the attack characteristic. The machine learning algorithm ...

Secure configuration in a virtualised computing environment

Secure configuration in a virtualised computing environment

A machine learning algorithm is trained as a classifier based on a plurality of training data items, each training data item corresponding to a training virtual machine (VM) and including a representation of parameters for a configuration of the training VM and a representation of characteristics of security attacks for the training VM. One or more relationships are identified between VM configuration parameters and attack characteristics by sampling the trained machine learning algorithm. A set of VM configuration parameters are identified that are indicated as being associated with a particular attack characteristic. A VM configuration for a target VM is then generated, wherein the configuration parameters in the identified set are absent in the generated VM configuration. The generated VM configuration may be applied to the target VM, or the existing target VM configuration may be adapted in accordance with the generated VM configuration. The machine learning algorithm may be a restricted ...

Data content checking

Method for detecting and preventing an attack

This application is for a way of detecting a hash collision attack by having two hash functions for the same file, one with weak collision resistance, and a second one with strong collision resistance. It works by generating a first hash value for an entity with weak collision resistance and storing the hash value to a database, 200, 202. The hash value is also sent to a server to be stored in a database of known hash value pairs 204. When the client computer detects a request for the entity with an object that has a first and second hash value 206, it first checks that the first hash values match 208. If they do it accepts the object and sends the data to a server for a validity check 210. It then receives the result of that validity check, and if the second hash values do not match takes further actions as it has detected a collision attempt 212.

network access system and method

Malware detection method

Labelling computing objects for improved threat detection

Providing a malware analysis using a secure malware detection process

Remote malware scanning capable of static and dynamic file analysis

A method of remote malware scanning comprises comparing at a first node (e.g. a host) file items of an electronic file (e.g. an Android app) to be scanned for malware with the file items of previously scanned electronic files that include a predetermined number of same file items than the app to be scanned, and generating a recipe that includes information for identifying the previously scanned app and one or more file items included in the app to be scanned, and the result of the comparison. The recipe is used at the server to reconstruct the app and execute a dynamic malware analysis on a runtime behaviour of the reconstructed app. The server may then send the result of the analysis to the host. A malware property query may be performed for the app and its file items before the aforementioned method, and the method may be initiated if the query yields an inconclusive result. Upon receiving the recipe, the server may request any missing files, i.e. files that are not readily available ...

Labeling computing objects for improved threat detection

Labeling computing objects for improved threat detection

Threat detection system

Labeling computing objects for improved threat detection

Detecting vulnerable applications

A method and system of determining a vulnerability of software. Libraries are downloaded and stored in a database. For each library, a set of features are extracted and stored in a library index table of the database. For each library, it is determined whether it poses a security concern and flagged accordingly in the library index table. Applications are downloaded and stored in the database. For each application a set of features are extracted and stored in an application index table of the database. For each application, the set of features of the application are compared to the set of features of each of the libraries in the library index table to identify which libraries in the library index table are associated with the application. For each application, a name of the application and names of the associated libraries are stored in a vulnerability reference table in the database.

An isolation unit

An isolation unit 100 for preventing access to one or more computer devices or network segments 102 by malicious software (e.g. ransomware). The isolation unit has first 104 and second 108 connection interfaces, at least one of which is configured to connect the isolation unit to a data carrying input 106, and the other being at least for outputting data to the computer devices/network segments. Connection circuitry 110 connects the first and second interfaces, and has at least one switchable connection path 112 with a layer 1 switch 114 (i.e. a switch operable at the OSI physical layer). A controller 116 is configured to switch the switch between a closed state, in which the first and second interfaces are connected by the switchable connection path, and an open state, in which the switchable connection path is disconnected between the first and second interfaces. The isolation unit may be used to isolate a data storage back-up device.

Apparatus and method for threat detection in a device

A method for threat detection in a device comprises maintaining a trust state of installed applications at a device, the trust state comprising an application identifier for each application, such as an application ID or app ID, and trust state of the application, wherein trust state of the application comprises at least one of the following states: empty, trusted, untrusted. The method further comprises searching the trust status with an application identifier of the installed application when an application is installed or of the trust status with an application identifier of the application to be installed when the application is to be installed on the device, the installation requested by a user of the device and/or the installation being a first-time installation of the application on the device. If trust status of the application is trusted, skipping scanning of the installed application. If trust status of the application is empty or not trusted, performing a scanning for the application ...

PROCEDURE AND EQUIPMENT FOR THE EXTENSION OF THE RESERVE AREA OF A DISK UNIT

A METHOD, A COMMUNICATIONS NETWORK AND A PROGRAM PRODUCT FOR THE DISTRIBUTION OF SOFTWARE PACKAGES OR SOFTWARE UPDATES

Forensic analysis of computing activity and malware detection using an event graph

A data recorder stores endpoint activity on an ongoing basis as sequences of events that causally relate computer objects such as processes and files. When a security event is detected, an event graph may be generated based on these causal relationships among the computing objects. For a root cause analysis, the event graph may be traversed in a reverse order from the point of an identified security event (e.g., a malware detection event) to preceding computing objects, while applying one or more cause identification rules to identify a root cause of the security event. Once a root cause is identified, the event graph may be traversed forward from the root cause to identify other computing objects that are potentially compromised by the root cause. Further, patterns within the event graph can be used to detect the presence of malware on the endpoint.

Forensic analysis of computing activity and malware detection using an event graph

A data recorder stores endpoint activity on an ongoing basis as sequences of events that causally relate computer objects such as processes and files. When a security event is detected, an event graph may be generated based on these causal relationships among the computing objects. For a root cause analysis, the event graph may be traversed in a reverse order from the point of an identified security event (e.g., a malware detection event) to preceding computing objects, while applying one or more cause identification rules to identify a root cause of the security event. Once a root cause is identified, the event graph may be traversed forward from the root cause to identify other computing objects that are potentially compromised by the root cause. Further, patterns within the event graph can be used to detect the presence of malware on the endpoint.

System and method for detecting data anomalies by analysing morphologies of known and/or unknown cybersecurity threats

SYSTEM AND METHOD FOR DETECTING DATA ANOMALIES BY ANALYSING MORPHOLOGIES OF KNOWN AND/OR UNKNOWN CYBERSECURITY THREATS Abstract This document describes a system and method for detecting anomalous data files and preventing detected anomalous data files from being stored in a data storage. In particular, the system and method detects anomalous data files by dividing each data file into blocks of data whereby entropy values are obtained for each block of data and this information is collated and subsequently used in a machine learning model to ascertain the security level of the data file.

Computer security

A METHOD AND SYSTEM FOR DETECTING PRESENCE OF MALICIOUS CODE IN THE E-MAIL MESSAGES OF AN ORGANIZATION

File opening method, apparatus and terminal

Disclosed are a file opening method, apparatus and terminal, belonging to the field of data processing technologies. The method comprises: capturing a file opening action, and acquiring a corresponding original file system device object and a corresponding original file system distribution function address; directly sending a file opening request to a file system where the original file system device object is located, and transferring the file opening request through the file system to an original file system distribution function corresponding to the original file system distribution function address; and executing a file opening operation through the original file system distribution function. In the present invention, a file opening request is directly sent to a file system where an original file system device object is located, and a file opening operation is executed through an original file system distribution function, so as to implement penetration on file filtering driving, and ...

System and method of monitoring and controlling application files

Checking data content

A system for automated checking of data content includes content checkers (208) to (214) arranged in parallel and connected between an input sub-system (204) and an output sub- system (216). The content checkers (208) to (214) check different data formats. Incoming data from an external computer system (202) is passed by the input sub-system (204) to the checkers (208) to (214), which report check results to both input and output sub-systems (204) and (216). From the four check results, the input sub-system (204) judges the data's acceptability for forwarding to a sensitive computer system (218). Unacceptable data is discarded; acceptable data passes to the output sub-system (216), which also judges the data's acceptability from the four check results. The output sub-system (216) only receives such data if the check results are all positive or if the input sub-system (204) malfunctions: in the latter case the check results are not all positive, and the output sub-system (216) will not forward ...

Method and system of distributing security policies

Systems and methods for exposing a result of a current processor instruction upon exiting a virtual machine

Described systems and methods enable a host system to efficiently perform computer security activities, when operating in a hardware virtualization configuration. A processor is configured to generate a VM suspend event (e.g., a VM exit or a virtualization exception) when a guest instruction executing within a guest VM. performs a memory access violation. In some embodiments, the processor is further configured to delay generating the VM suspend event until the execution stage of the pipeline for the guest instruction is complete, and to save results of the execution stage to a specific location (e.g. a specific processor register readable by security-software) before generating the event.

Providing a malware analysis using a secure malware detection process

In certain embodiments, a computer-implemented system comprises a boundary controller and a first malware detection agent. The boundary controller is operable to implement a security boundary between a first computer network environment and a second computer network environment. The second computer network environment has a security classification level that is more restrictive than a security classification level of the first computer network environment. The boundary controller is operable to receive from the first computer network environment a file. The first malware detection agent is positioned in the second computer network environment and is operable to receive via the boundary controller the file and apply a first malware detection process on the file. The first malware detection process is subject to the security classification level of the second computer network environment.

Secure mobile user interface and mobile device case

The invention provides systems and method for securely inputting user data from a user into a mobile device and also for generating user data to be input by a user into a mobile device. For example, there is provided a mobile device case for securely inputting user data from a user into a mobile device, the case comprising: a microcontroller, a communication module for communicating with the mobile device and a user interface to enable the user to input the user data. The microcontroller is preferably configured to receive the user data which is input by a user via the user interface, process said user data to create processed data and communicate said processed data to said mobile device. Alternatively, the microcontroller is configured to receive a request to generate the user data; generate said user data and display said user data on the user interface.

Digital DNA sequence

In an embodiment of the invention, a method of classifying a data object includes: scanning the data object; evaluating contents of data objects base on at least one selected rule; and generating a digital DNA sequence that classifies at least some contents in the data object.

A SYSTEM TO IDENTIFY MACHINES INFECTED BY MALWARE APPLYING LINGUISTIC ANALYSIS TO NETWORK REQUESTS FROM ENDPOINTS

A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided. 402: Receiveurl Extract fully qualified domain tr name 46 first cache 408 Susp clous No 4123 N o 410 Yes Apply ...

USING METADATA IN SECURITY TOKENS TO PREVENT COORDINATED GAMING IN A REPUTATION SYSTEM

To prevent gaming of a reputation system, a security token is generated for a security module using metadata about the client observed during the registration of the security module. The registration server selects metadata for use in generating the security token. The generated security token is provided to identify the client in later transactions. A security server may conduct a transaction with the client and observe metadata about the client during the transaction. The security server also extracts metadata from the security token. The security server correlates the observed metadata during the transaction with the extracted metadata from the security token. Based on the result of the correlation, a security policy is applied. As a result, the metadata in the security token enables stateless verification of the client.

RESISTING THE SPREAD OF UNWANTED CODE AND DATA

A method or system of receiving an electronic file containing content data in a predetermined data format, the method comprising the steps of: receiving the electronic file, determining the data format, parsing the content data, to determine whether it conforms to the predetermined data format, and if the content data does conform to the predetermined data format, regenerating the parsed data to create a regenerated electronic file in the data format.

METHOD FOR REDUCING FALSE-POSITIVES FOR IDENTIFICATION OF DIGITAL CONTENT

Many areas of investigation require searching through data that may be of interest. In a first method step, a digital content element is provided. The digital content element may have any suitable format or data structure of interest to a searching entity.The digital content element may be a particular data file that is of interest to a searching entity. In a second step, the digital content element is compared with a first set of data provided by a combination of a second set of data and a third set of data. The first set of data is a collection of known digital content elements that are of interest to a searching entity, for example contraband digital content elements or digital content elements owned by or represented by the searching entity. In a third method step, the digital content element is identified as known if the digital content element is detected within the first set of data.

METHODS AND SYSTEMS FOR NETWORK SECURITY

Described are devices, systems, and methods for improving network security by providing network interface devices communicatively coupled to end-point-protection platforms.

DYNAMIC REPUTATION INDICATOR FOR OPTIMIZING COMPUTER SECURITY OPERATIONS

Described systems and methods allow protecting a computer system from malware such as viruses, worms, and spyware. A reputation manager executes on the computer system concurrently with an anti-malware engine. The reputation manager associates a dynamic reputation indicator to each executable entity seen as a unique combination of individual components (e.g., a main executable and a set of loaded libraries). The reputation indicator indicates a probability that the respective entity is malicious. The reputation of benign entities may increase in time. When an entity performs certain actions which may be indicative of malicious activity, the reputation of the respective entity may drop. The anti-malware engine uses an entity-specific protocol to scan and/or monitor each target entity for malice, the protocol varying according to the entity's reputation. Entities trusted to be non-malicious may be analyzed using a more relaxed protocol than unknown or untrusted entities.

INFORMATION SECURITY METHOD AND SYSTEM

The present invention discloses an improved information security system and method. A polymorphic engine is used to enhance the security features of a software application and the data generated by or made available to the application and/or the operating system. The polymorphic engine operates to randomly alter the standard executable code of the original application while preserving its functional characteristics. Each polymorphed instance of the application differs from any other instance of the same application in form only. Various other security features operate to protect the polymorphic engine itself and/or the polymorphed code generated therefrom. These other security features include: just-in-time instruction code decryption; virtual CPU instruction code pre-processing; call mutation; stack manipulation; secure hook-capture of device input; secure display device output; application level encryption of encrypted hardware data streams; and a dynamic, randomly configured graphical ...

SYSTEMS AND METHODS FOR DETERMINING MALICIOUS-DOWNLOAD RISK BASED ON USER BEHAVIOR

The disclosed computer-implemented method for determining malicious-download risk based on user behavior may include (1) identifying a set of users that are at high risk for malicious downloads and a set of users that are at low risk for malicious downloads, (2) determining a high-risk pattern of download behavior that is shared by the set of high-risk users and that is not shared by the set of low- risk users, (3) analyzing download behavior of an uncategorized user over a predefined time period in order to categorize the download behavior as high-risk or low-risk, and (4) categorizing the uncategorized user as a high-risk user in response to determining that the download behavior of the uncategorized user falls within a predefined similarity threshold of the high-risk pattern of download behavior. A corresponding system and computer-readable media are also disclosed.

COMPUTER SECURITY SYSTEMS AND METHODS USING ASYNCHRONOUS INTROSPECTION EXCEPTIONS

Described systems and methods enable an efficient analysis of security-relevant events, especially in hardware virtualization platforms. In some embodiments, a notification handler detects the occurrence of an event within a virtual machine, and communicates the respective event to security software. The security software then attempts to match the respective event to a collection of behavioral and exception signatures. An exception comprises a set of conditions which, when satisfied by an tuple, indicates that the respective entity is not malicious. In some embodiments, a part of exception matching is performed synchronously (i.e., while execution of the entity that triggered the respective event is suspended), while another part of exception matching is performed asynchronously (i.e., after the triggering entity is allowed to resume execution).

FRAUD DETECTION NETWORK SYSTEM AND FRAUD DETECTION METHOD

... [Problem] To provide an illicit activity sensing network system and illicit activity sensing method which efficiently detect behavior of malware which carries out illicit activity, are easily adopted, and are not susceptible to attack. [Solution] Provided is an illicit activity sensing network system, in which a web server device includes a call script in web content information and transmits same to a user terminal device, and the web content is displayed and the call script executed upon the user terminal device. The user terminal device acquires an illicit activity sensing script from an illicit activity sensing server on the basis of the call script, searches on the basis of the illicit activity sensing script for search subject data which is included in the web content information, and transmits the result of the search to the illicit activity sensing server device. A prescribed illicit activity countermeasure action is carried out on the basis of an illicit activity sensing result ...

ANTI-MALWARE MOBILE CONTENT DATA MANAGEMENT APPARATUS AND METHOD

There is provided an anti-malware mobile content data management apparatus, for use in managing content data within an input electronic file containing content data to be sent over a wireless network comprising at least one mobile device being served by the wireless network, comprising at least one tokeniser to tokenise the content data contained within the input electronic file into a tagged generic representation of the content data, a content management engine to apply a predetermined content management policy to the tagged generic representation of the content data to form content-managed tagged generic content data and a validator to create validated content-managed content data by being arranged to ensure the content-managed content data represented in the content-managed tagged generic representation conforms to any predefined limits and rules applied to each form of content data appearing in the content data of the input electronic file, wherein an output of the validator is operably ...

System and Method for Organizing, Managing and Running Enterprise-Wide Scans

Disclosed is a system and method for creating, organizing, and monitoring computer searches across a large number of networked computers. The system allows individual searches to be created and tailored depending upon specific objectives. Once established, the system permits the search parameters to be subsequently edited as needed. A graphical user interface (GUI) allows users to view established searches and to monitor searches once activated. Search results can also be tabulated by way of the GUI.

Method and apparatus for virus throttling with rate limiting

A method for traffic control of a network device in a network are disclosed. The network device determines potentially malicious behavior by a host device in the network. A permissible rate of traffic from the host device through a port of the network device is reduced in response to determining the potentially malicious behavior. A rate of traffic through the port of the network device is measured. The measured traffic rate is compared with a threshold rate. The permissible rate of traffic is adjusted based on the comparison.

Protection against malware on web resources

A method and system for identification of malware threats on web resources. The system employs a scheduled antivirus (AV) scanning of web resources. The scheduled scanning of web resources allows to create malware check lists and to configure access to web resources. Frequency and depth of inspection (i.e., scan) are determined for each web resource. The user identifiers are used for scheduled AV scanning of web resources. The system allows for scanning a web resource based on selected configurations without using additional client applications.

Functional patching/hooking detection and prevention

A method for preventing malicious attacks on software, using the patching method, includes providing a database of malicious known patches (malware). The database contains characteristic signatures of the malware. The method also includes detecting whether a patch is malicious by comparing it with a signature in the database and performing one or more activities needed to prevent the malicious patch from performing undesired activities.

Smart card, anti-virus system and scanning method using the same

A smart card installed in a device receives from the device data to be scanned and determines whether a virus exists in the data. Accordingly, security of the device may be enhanced without using substantial resources of the device.

Application selection using current detection intelligence

Selecting one or more applications from the plurality of similar or near redundant applications to activate. A method includes retrieving information about current characteristics of one or more applications. The method further includes retrieving information about a current computing operational landscape. Based on the information about current characteristics of one or more applications and the information about a current computing operational landscape, the method further includes creating a ranking of applications. The rankings are made available to a system with a plurality of applications with similar or near redundant functionality. At the system, one or more of the applications in the plurality of applications are selected to activate based on the ranking of applications.

System recovery method and computing apparatus having system recovery function

A system recovery method and a computing apparatus having a system recovery function. The computing apparatus includes a first memory unit to store a general operating system (OS) in a system partition where a primary anti-virus program operates, and to store a recovery OS in a recovery partition where a secondary anti-virus program operates; a second memory unit to store firmware determining a booting partition of the computing apparatus; and a processor to control execution of the firmware to, when the system partition is infected by a virus and thus the computing apparatus does not boot to the general OS, boot the computing apparatus to the recovery OS, and to control recovery of the system partition.

Mobile communication system and mobile terminal having function of inactivating mobile communication viruses, and method thereof

A mobile communication system for inactivating a virus includes: a database associated with the mobile communication system, for storing at least one virus vaccine program; and a virus monitoring unit associated with the mobile communication system, for checking virus infection of received data, analyzing virus information, choosing one of virus vaccine programs that are stored in the database and inactivating the virus. Virus vaccine programs are timely updated over the air (OTA) whenever a new version of vaccine program is available.

Detecting Malicious Use of Computer Resources by Tasks Running on a Computer System

A method, apparatus, and computer program product for identifying malware is disclosed. The method identifies processes in a running process list on a host computer system. The method identifies ports assigned to the processes in the running process list on the host computer system. The method determines whether any one of ports that is currently in use in the host computer system is not assigned to any of the processes in the running process list. The method then makes a record that a hidden, running process is present as a characteristic of an attack in response to a determination that one of the ports is currently in use but is not assigned to any of the processes in the running process list in the host computer system.

Wireless intrusion prevention system and method

A wireless intrusion prevention system and method to prevent, detect, and stop malware attacks is presented. The wireless intrusion prevention system monitors network communications for events characteristic of a malware attack, correlates a plurality of events to detect a malware attack, and performs mitigating actions to stop the malware attack.

System and method for identifying malicious activities through non-logged-in host usage

A method for identifying malware activities, implemented within a computer infrastructure, includes receiving a data communication via a data channel and determining a user is not interactively logged in to a host. Additionally, the method includes identifying the data communication as a potential malware communication in response to the determining the user is not interactively logged in to the host.

System and method for a scanning api

Application programs for mobile communication devices are stored in a data store. The applications may be collected from any number of different sources such as through an application programming interface (API), from web crawling, from users, or combinations of these. The applications are analyzed and the analysis results reported. The applications may be “continuously” analyzed so that any changes in assessments can be reported. If an application for which an analysis is sought is not in the data store, information about a different, but related application may be provided.

Computer Worm Curing System and Method and Computer Readable Storage Medium for Storing Computer Worm Curing Method

A computer worm curing system includes a string receiving module, a string generating module and a string replying module. The string receiving module receives an infected string, which is generated by a computer worm, from an infected host, which is infected by the computer worm, through a network. The infected string includes a shellcode, and the shellcode is executed utilizing a vulnerable process. The string generating module generates a curing code for curing the computer worm, and replaces the shellcode in the infected string with the curing code to generate a curing string, such that the curing string can be executed utilizing the vulnerable process. The string replying module replies the curing string to the infected host, such that the curing code of the curing string can be executed utilizing the vulnerable process of the infected host to cure the infected host of the computer worm.

Malicious Mobile Code Runtime Monitoring System and Methods

Protection systems and methods provide for protecting one or more personal computers (“PCs”) and/or other intermittently or persistently network accessible devices or processes from undesirable or otherwise malicious operations of Java TN applets, ActiveX™ controls, JavaScript™ scripts, Visual Basic scripts, add-ins, downloaded/uploaded programs or other “Downloadables” or “mobile code” in whole or part. A protection engine embodiment provides for monitoring information received, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information. An MPC embodiment further provides, within a Downloadable-destination, for initiating the Downloadable, enabling malicious Downloadable operation attempts to be received by the MPC, and causing (predetermined) corresponding operations to be executed in response to the attempts.

Anti-malware scanning system and method thereof

Provided are an anti-malware scanning system and a method thereof. The system includes: a host; and a chip which is removably connected to the host, receives a file to be scanned from the host, and scans whether malware exists in the file, wherein the host adjusts a size of the file to be scanned to correspond to a storage capacity of a storage unit of the chip and transmits the adjusted file to the chip. Accordingly, scanning is performed effectively even in an environment in which resources of the anti-malware scanning system are limited.

Standardized Configuration Checklists For Software Development

Implementations of the present disclosure include methods for generating a configuration checklist template. In some implementations, methods include retrieving one or more source code files, each of the one or more source code files corresponding to a software product, scanning the one or more source code files to generate one or more configuration check building blocks, receiving first user input, processing the one or more configuration check building blocks and the first user input to generate one or more check definitions, receiving second user input, processing the one or more check definitions and the second user input to generate the configuration checklist template, electronically storing the configuration checklist template, and transmitting the configuration checklist template to one or more computing devices associated with a customer entity over a network.

Computer system and method for scanning computer virus

According to the present invention, a timeout caused by executing a virus scan is avoided. A computer system has a first computer, a second computer coupled to the first computer, and a storage system coupled to the first computer and the second computer. The first computer receives a request to write data, writes the requested data in the storage system, and sends a virus scan request of the written data to the second computer. The second computer receives the virus scan request from the first computer, reads the written data out of the storage system, and partially executes a virus scan of the read data. After the partial virus scan of the read data is finished, the first computer sends a response to the received write request. After the first computer sends the response, the second computer executes the remainder of the virus scan of the read data.

System and methods for protecting users from malicious content

A method, system and device for allowing the secure collection of sensitive information is provided. The device includes a display, and a user interface capable of receiving at least one user-generated interrupt in response to a stimulus generated in response to content received by the device, wherein the action taken upon receiving the user-generated interrupt depends on a classification of the content, the classification identifying the content as trusted or not trusted. The method includes detecting a request for sensitive information in content, determining if an interrupt is generated, determining if the content is trusted, allowing the collection of the sensitive information if the interrupt is generated and the content is trusted, and performing an alternative action if the interrupt is generated and the content is not trusted. The method may include instructions stored on a computer readable medium.

Secure auditing system and secure auditing method

Disclosed is a technique that audits security of a terminal connected to a network and executes a given program wherein a computer-virus free file is permitted to execute a program in a manner such that a computer virus is not activated. As a result, the terminal is maintained in a secure state.

Method for identifying infected electronic files

The invention relates to electronic engineering and in particular to a method for identifying infected electronic files on a display (monitor) of an electronic device, said infected electronic files being located in the electronic device or on the Internet. The aim of the proposed invention is to provide a novel method of identifying infected electronic files. As a result of the use of the proposed invention, the user of the electronic device or the Internet is provided with the possibility of discovering infected electronic files with the aid of different identification methods which distinguish infected electronic files from uninfected electronic files.

System And Method For Packet Profiling

Systems and methods for packet profiling are disclosed. According to one embodiment, a method for profiling incoming data packets for an organization includes the steps of (1) receiving, at an interface for a transport provider, a data packet; (2) using a computer processor, analyzing the data packet; (3) using the computer processor, based on the analysis, marking the data packet; and (4) transmitting the data packet to the organization.

System and method for server-coupled application re-analysis to obtain trust, distribution and ratings assessment

A system and method for preventing malware, spyware and other undesirable applications from affecting mobile communication devices uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a characterization assessment and can also provide a characterization re-assessment for the application, or data object, and transmits the assessment to the device. By performing analysis on a server, the invention allows a device to reduce the battery and performance cost of protecting against undesirable applications. The servers transmit notifications to devices that have installed applications that are discovered to be undesirable. The server can accumulate this data and then perform a characterization re-assessment of a data object it has previously assessed to provide an assessment based upon one of trust, distribution and ratings information.

Memory storage device and memory controller and virus scanning method thereof

A memory storage device, a memory controller, and a virus scanning method are provided. In the method, a virus signature database recording a predetermined file segment and a corresponding virus signature is provided. A plurality of logical addresses is mapped to a part of a plurality of physical addresses in a rewritable non-volatile memory chip of the memory storage device, a host system accesses the logical addresses by using a file system including a file allocation table (FAT). At lease one binary code is received. The FAT is analyzed to identify a file segment containing the at least one binary code. If the file segment matches the predetermined file segment, the at least one binary code is not written into the memory storage device or transmitted back to the host system when the at least one binary code matches the virus signature corresponding to the predetermined file segment.

Crawling multiple markets and correlating

A crawler program collects and stores application programs including application binaries and associated metadata from any number of sources such as official application marketplaces and alternative application marketplaces. An analysis including comparisons and correlations are performed among the collected data in order to detect and warn users about pirated or maliciously modified applications.

Method and apparatus for determining software trustworthiness

Aspects of the invention relate to a method, apparatus, and computer readable medium for determining software trustworthiness. In some examples, a software package identified as including at least one file of unknown trustworthiness is installed on a clean machine. A report package including a catalog of files that have been installed or modified on the clean machine by the software package is generated. Identification attributes for each of the files in the catalog is determined. Each of the files in the catalog is processed to assign a level of trustworthiness thereto. The report package is provided as output.

Data storage devices including integrated anti-virus circuits and method of operating the same

A data storage device includes a storage medium and a controller circuit configured to be coupled to an external host to provide an interface between the external host and the storage medium, the controller circuit configured to detect a virus carried by a data file transferred to and/or stored in the storage medium. The controller circuit may be further configured to cure the detected virus.

Systems and methods for managing applications

A system for managing applications. The system includes a first device, a second device, a first interface and a second interface. The first device is responsible for exhibiting and providing the applications to one or more user(s). The second device is responsible for managing the applications which are uploaded by one or more developer(s) who have developed the applications. The first interface is provided for the second device to submit the applications to the first device. The second interface is provided for the first device to transmit at least a report message to the second device.

Multi-Nodal Malware Analysis

A computer-implemented method includes accessing, by an analysis console, information related to a first file received at a first host of a plurality of hosts. Each host is capable of running a corresponding set of malware detection processes. The information includes: an identifier of the first file; and data indicating a first result of the first host applying the set of malware detection processes to the first file. The identifier is generated by the first host and is usable by each of the hosts to determine whether a second file comprises content substantially equivalent to content of the first file. The analysis console generates a first output including: the identifier of the first file; and a second result indicating whether the first file comprises malware. The second result is usable by each of the hosts to determine whether the second file comprises malware. The first output is propagated to the hosts.

Compliance-based adaptations in managed virtual systems

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Peer integrity checking system

A distributed file integrity checking system is described. The described peer integrity checking system (PICS) may negate an attack by storing a properties database amongst nodes of a peer-to-peer network of hosts, some or all of which co-operate to protect and watch over each other.

System and method for server-coupled application re-analysis

To prevent malware, spyware and other undesirable applications from affecting mobile communication devices (e.g., smartphones, netbooks, and tablets), a device uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a categorization assessment and can provide a categorization re-assessment, and transmits the assessment to the device. By performing analysis on a server, a device can reduce its battery and performance cost of protecting against undesirable applications. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats. The server can accumulate this data and perform a categorization re-assessment of a data object previously assessed.

Emulating Mixed-Code Programs Using a Virtual Machine Instance

The subject disclosure is directed towards a technology for efficiently emulating program code that is protected by one or more various code virtualization techniques to detect the presence of malware. An emulation engine emulates a program containing a mix of native code, custom (e.g., virtualized obfuscated) code, and at least one emulator and/or interpreter that understands the custom code, by building a custom emulation component that is built by detecting and analyzing the internal emulator or interpreter. The custom emulation component may access a translation table built from the analysis, and also may simplify a plurality of instructions in the program into a lesser number of instructions in an intermediate language used for emulation.

Automatic detection of search results poisoning attacks

Search result poisoning attacks may be automatically detected by identifying groups of suspicious uniform resource locators (URLs) containing multiple keywords and exhibiting patterns that deviate from other URLs in the same domain without crawling and evaluating the actual contents of each web page. Suspicious websites are identified and lexical features are extracted for each such website. The websites are clustered based on their lexical features, and group analysis is performed on each group to identify at least one suspicious group. Other implementations are directed to detecting a search engine optimization (SEO) attack by processing a large population of URLs to identify suspicious URLs based on the presence of a subset of keywords in each URL and the relative newness of each URL.

System and method for non-signature based detection of malicious processes

Systems and methods for detecting malicious processes in a non-signature based manner are disclosed. The system and method may include gathering features of processes running on an electronic device, applying a set of rules to the features, and applying a statistical analysis to the results of the rules application to determine whether a process should be classified into one or more of a plurality of process categories.

Engine, system and method of providing a domain social network having business intelligence logic

An engine, system and method for a domain social network that interconnects Internet users with at least domains owned by or of interest to those Internet users, and that may obtain and/or forward obtained dynamic data regarding those domains automatically, such as by web service or email service. The dynamic data may be used to filter and protect content and data of the respective domains, to protect users by identifying low quality web pages or malicious software or pages, to isolate or improve search results regarding the domain, and/or to improve Internet-based transaction flow, such as the creation of advertising.

Malware automated removal system and method

The present invention automates the operation of multiple malware removal software products using a computerized system that systematically operates the multiple selected software products. These products are operated them in a customized “Safe Mode” using a shell that is different than the computer's other shell environments. Unlike the ordinary Safe Modes shells, the Custom Safe Mode prevents malware from functioning that ties itself to the normal shell, such as the Windows Explorer shell. In addition, the Custom Safe Mode allows the automation of tasks beyond that which is available under the standard command line shell.

Portable Security Device and Methods for Detection and Treatment of Malware

Disclosed is a portable security device and method for detection and treatment of computer malware. The security device includes a communication interface for connecting to a computer, a memory for storing a set of data for use in malware detection experiments, and an antivirus engine configured to perform one or more malware detection experiments on the computer. A malware detection experiment includes simulating a connection to the computer of a data storage device containing a predefined set of data. The antivirus engine further configured to identify modifications in the set of data contained in the data storage device after termination of one or more malware detection experiments, analyze a modified set of data for presences of computer malware, determine a treatment mechanism for the detected malware, perform treatment of the detected malware on the computer, and generate user reports.

Mobile communication terminal having a behavior-based malicious code detection function and detection method thereof

A mobile communication terminal comprises: a system unit which performs application installation and removal, outputs an installation completion message upon completion of the application installation, and provides, upon receipt of request for authority information on the application, the requested authority information; a behavior information database in which behavior information data is stored; and an inspection unit which makes a request for the authority information to the system unit and receives the authority information, upon receipt of the installation completion message from the system unit, and which compares the authority information and the behavior information data stored in the behavior information database to examine whether the application is a malicious code or not.

Remote-Assisted Malware Detection

Remote assistance is provided to a mobile device across a network to enable malware detection. The mobile device transmits potentially infected memory pages to a remote server across a network. The remote server performs analysis, and provides feedback to the mobile device. Based on the received feedback, the mobile device halts a process, or retrieves and transmits additional memory pages to the remote server for more analysis. This process is repeated until a compromised region of memory is identified and/or isolated for further repair to be performed. The feedback from the remote server reduces the processing and storage burden on the mobile device, resulting in a more reliable detection that uses fewer resources. Embodiments including hypervisors and virtual machines are disclosed.

Auditing a device

The auditing of a device that includes a physical memory is disclosed. One or more hardware parameters that correspond to a hardware configuration is received. Initialization information is also received. The physical memory is selectively written in accordance with a function. The physical memory is selectively read and at least one result is determined. The result is provided to a verifier.

System and methods for adaptive model generation for detecting intrusion in computer systems

A system and methods for detecting intrusions in the operation of a computer system comprises a sensor configured to gather information regarding the operation of the computer system, to format the information in a data record having a predetermined format, and to transmit the data in the predetermined data format. A data warehouse is configured to receive the data record from the sensor in the predetermined data format and to store the data in a SQL database. A detection model generator is configured to request data records from the data warehouse in the predetermined data format, to generate an intrusion detection model based on said data records, and to transmit the intrusion detection model to the data warehouse according to the predetermined data format. A detector is configured to receive a data record in the predetermined data format from the sensor and to classify the data record in real-time as one of normal operation and an attack based on said intrusion detection model. A data analysis engine is configured to request data records from the data warehouse according to the predetermined data format and to perform a data processing function on the data records.

Server based malware screening

An Internet infrastructure is provided to transfer a packet of data between a client device and source device. The infrastructure consists of a support server that screens the packet for malware codes on behalf of a registered client. In order to scan for malware, the support server contains hardware and/or software modules to perform malware detection and quarantine functions. The modules identify malware bit sequence in the packet(s), malware bit sequences or entire contaminated code is quarantined or repaired as appropriate. After identification of malware code (if any), the support server sends warning messages to affected parties, providing information regarding the malware codes that were detected.

Enhanced browsing with security scanning

A method scans a second web page linked to a first web page being displayed by a browser in a browser window. The method identifies, in the first web page, a target link to the second web page. Prior to receiving a user selection of the target link, the method prefetches content from the second web page and loads it into a safe cache according to a prefetching order before receiving the user selection of the target link and before the content of the second web page is opened by an application configured to provide access to the content of the second web page. The method scans the prefetched content from the second web page for a security threat, within the safe cache, which is configured to prevent the prefetched content from altering a memory location or storage location external to the safe cache.

Providing a Network-Accessible Malware Analysis

In certain embodiments, a computer-implemented method comprises receiving, via a computer network and from a first computer system, a first malware analysis request. The first malware analysis request comprises a file to be analyzed for malware by a malware analysis system. The method includes initiating a malware analysis by the malware analysis system of the first file for malware. The method includes communicating to the first computer system a response for the first file determined by the malware analysis system to the first computer system. The response comprises an indication of whether the first file comprises malware.

Outbound Connection Detection and Blocking at a Client Computer

A method of detecting and blocking a malicious SSL connection at a client computer. The method includes identifying, at a network firewall level, an outbound SSL connection being set up at the client computer; detecting an SSL certificate associated with the SSL connection; sending a request to a central server for reputation information on the SSL certificate; at the central server, determining reputation information in dependence upon the SSL certificate; providing said reputation information from the central server to the client computer; and using the reputation information at the client computer to determine whether or not to block the connection.

SYSTEM AND METHOD FOR PREVENTING MALWARE ON A MOBILE COMMUNICATION DEVICE

A server receives from a mobile communication device information about a data object (e.g., application) on the device when the device cannot assess the data object. The server uses the information along with other information stored at the server to assess the data object. Based on the assessment, the device may be permitted to access the data object or the device may not be permitted to access the data object. The other information stored at the server can include data objects known to be bad, data objects known to be good, or both. 1. A non-transitory computer-readable storage medium having stored thereon a plurality of instructions which , when executed by a processor , cause the processor to perform the steps of a method for assessing a data object present on a mobile communication device , the assessment provided by a server computer , the method comprising:before receiving data identifying at least a portion of the data object present on the mobile communication device at the server computer, determining if previously stored definition information stored in a local store at the mobile communication device corresponds to the data identifying at least a portion of the data object present on the mobile communication device, the local store storing a corresponding assessment for the previously stored definition information; and,if the previously stored definition information in the local store at the mobile communication device does not correspond to the data identifying at least a portion of the data object present on the mobile communication device, then at the server computer, receiving data identifying at least a portion of the data object present on the mobile communication device;at the server, determining if previously stored definition information for a data object corresponds to the received data, the definition information stored in a data store accessible by the server, the data store storing a corresponding assessment for the definition information;if ...

Login initiated scanning of computing devices

Embodiments of the invention relate to systems, methods, and computer program products for login initiated remote scanning of computer devices. The present invention detects login to the network via access management systems. The login data provides information that identifies the device so that the device can be checked against a scan database to determine if and when a previous scan occurred. Based on the findings in the scan database determinations are made as to whether to perform a scan. Additionally, the level of scanning can be determined based on previous scan dates and previous scan results, which may dictate customized scanning. In addition, the priority of the impending scan may be dictated by previous scan dates and results. Further embodiments provide for assessing risk, such as risk scoring or the like, concurrently or in near-real-time with the completion of the scan so that alerts may be communicated.

SYSTEMS AND METHODS OF PROCESSING DATA ASSOCIATED WITH DETECTION AND/OR HANDLING OF MALWARE

The present disclosure relates to malware and, more particularly, towards systems and methods of processing information associated with detecting and handling malware. According to certain illustrative implementations, methods of processing malware are disclosed. Moreover, such methods may include one or more of unpacking and/or decrypting malware samples, dynamically analyzing the samples, disassembling and/or reverse engineering the samples, performing static analysis of the samples, determining latent logic execution path information regarding the samples, classifying the samples, and/or providing intelligent report information regarding the samples. 1. A method of analyzing samples/data/code for malware , comprising:unpacking and/or decrypting malware samples;dynamically analyzing the samples;disassembling and/or reverse engineering the samples;performing static analysis of the samples;determining latent logic execution path information regarding the samples;classifying the samples; andproviding intelligent report information regarding the samples.2. The method of wherein dynamically analyzing the samples includes running malware samples parallel in completed secure and safe native OS environment claim 1 , observing malware behavior claim 1 , and generating a completed intelligent report regarding the behavior of the malware with all actionable items.3. The method of wherein determining latent logic execution path information includes analysis of latent execution logic paths as against run time execution logic paths and providing report information regarding each path.4. The method of wherein classifying the samples includes determining a family to which a given malware sample belongs.5. The method of wherein the report information includes malware current payloads and any potential payload information regarding payloads that are hidden in latent code.6. The method of wherein classifying the samples includes determining a family to which a given malware sample ...

System and method for profile based filtering of outgoing information in a mobile environment

A system and method in one embodiment includes modules for detecting an access request by an application to access information in a mobile device, determining that the application is a potential threat according to at least one policy filter, and blocking a send request by the application to send the information from the mobile device without a user's consent. More specific embodiments include user selecting the information through a selection menu on a graphical user interface that includes information categories pre-populated by an operating system of the mobile device, and keywords that can be input by the user. Other embodiments include queuing the send request in a queue with other requests, and presenting an outbox comprising the queue to the user to choose to consent to the requests. The outbox includes graphical elements configured to permit the user to selectively consent to any requests in the queue.

Handling Noise in Training Data for Malware Detection

Described systems and methods allow the reduction of noise found in a corpus used for training automatic classifiers for anti-malware applications. Some embodiments target pairs of records, which have opposing labels, e.g. one record labeled as clean/benign, while the other labeled as malware. When two such records are found to be similar, they are identified as noise and are either discarded from the corpus, or relabeled. Two records may be deemed similar when, in a simple case, they share a majority of features, or, in a more sophisticated case, they are sufficiently close in a feature space according to some distance measure.

AUTOMATED BEHAVIORAL AND STATIC ANALYSIS USING AN INSTRUMENTED SANDBOX AND MACHINE LEARNING CLASSIFICATION FOR MOBILE SECURITY

The present system includes a computer-networked system that allows mobile subscribers, and others, to submit mobile applications to be analyzed for anomalous and malicious behavior using data acquired during the execution of the application within a highly instrumented and controlled environment for which the analysis relies on per-execution as well as comparative aggregate data across many such executions from one or more subscribers. 1. A method for assessing the quality of mobile applications , the method comprising: performs a static analysis risk assessment of binary code associated with a plurality of mobile applications, each being submitted by a submission source;', 'examines execution behaviors of the mobile applications within an instrumented sandbox environment; and', 'aggregates analyses of the execution behaviors and static analysis into predictor statistics describing quality and vulnerability characteristics of mobile applications., 'providing a computer networked environment comprising a cloud-based service for mobile devices that when operated;'}2. The method of claim 1 , wherein the cloud-based service generates an analysis vector comprised of one or more feature sets derived from analysis of application related data selected from the group comprising execution characteristics of the application and analysis of static characteristics of the application.3. The method of claim 1 , wherein the cloud service generates an analysis report comprised of at least of one of: a risk assessment identifying suspicious behavioral characteristics of the mobile application; a malware confidence rating indicating a confidence of the risk assessment; a malware risk rating indicating dangerousness of the associated risks; and a malware label indicating details about nature of the risks associated with the mobile application.4. The method of further comprising accumulating analysis results from a selected set of previously generated analysis vectors.5. The method of ...

Private Domain Name Registration

A service for protecting the privacy of domain name registrants while preserving the registrant's ability to directly change the registration information or transfer the registration. A whois record is created that reflects the registrant's actual identity but contains contact information that is entirely associated with a privacy service. 1. A method for protecting the privacy of a registrant of a domain name , comprising configuring a whois record such that the registrant name displayed in the whois record is the actual registrant name and the contact information displayed in the whois record is entirely alternate contact information.2. The method of claim 1 , wherein correspondence received at an alternate contact is forwarded to a registrant contact in accordance with a predetermined rule.3. The method of claim 2 , wherein postal correspondence received at an alternate contact is scanned and forwarded to a registrant e-mail address.4. The method of claim 1 , wherein an e-mail message received at an alternate email address is scanned and forwarded to a registrant e-mail address if it is determined not to be SP AM and if it is determined not to contain malicious code.5. An apparatus for protecting the privacy of a registrant of a domain name claim 1 , comprising:a processor;a memory coupled to said processor, said memory storing a whois record for a domain name registration wherein the registrant name of the who is record is the actual registrant name and the contact information of the who is record is entirely alternate contact information.6. The apparatus of claim 5 , wherein said instructions are further adapted to be executed by said processor to perform steps including:receiving an e-mail message addressed to an alternate e-mail address listed in a whois record;scanning the e-mail message for SPAM; andforwarding the e-mail message to an e-mail address specified by the registrant if the message is determined not to be SPAM.7. The apparatus of claim 5 , wherein ...

Detection of undesired computer files in archives

Systems and methods for content filtering are provided. According to one embodiment, a type and structure of an archive file are determined. The archive file includes identification bytes that identify the type of archive file and header information both in unencrypted and uncompressed form and a file data portion containing contents of files in encrypted form, compressed form or both. The determination is based solely on the identification bytes and/or the header information. Based thereon, descriptive information, describing characteristics of the files, is extracted from the header information for each file. The descriptive information includes a checksum of the file in uncompressed form, a size of the file in uncompressed form and/or a size of the file in compressed form. A file is identified as being potentially malicious or undesired when a comparison of the descriptive information to detection signatures of known malicious or undesired files results in a match.

METHODS FOR DETECTING MALICIOUS PROGRAMS USING A MULTILAYERED HEURISTICS APPROACH

Three heuristic layers are used to determine whether suspicious code received at a port of a data processing device is malware. First, static analysis is applied to the suspicious code. If the suspicious code passes the static analysis, dissembling analysis is applied to the suspicious code. Preferably, if the suspicious code passes the dissembling analysis, dynamic analysis is applied to the suspicious code. 2. The method of claim 1 , further comprising the step of:(d) if the suspicious code passes said disassembling analysis, applying dynamic analysis to the suspicious code.3. The method of claim 2 , wherein said dynamic analysis includes monitoring behavior of an execution of the suspicious code in a one-time isolated environment.4. The method of claim 1 , wherein said disassembling analysis includes seeking at least one flexible signature in the suspicious code.5. The method of claim 1 , wherein said dissembling analysis is effected by steps including:(i) identifying a plurality of nodes in the suspicious code;(ii) arranging said nodes in a tree; and(iii) collapsing said tree into a single node.7. The data processing device of claim 6 , wherein said module is implemented at least in part in hardware.8. The data processing device of claim 6 , wherein said module is implemented at least in part in firmware.9. The data processing device of claim 6 , wherein said module is implemented at least in part in software. This is a continuation of U.S. patent application Ser. No. 12/690,121 filed Jan. 20, 2010, which is a continuation-in-part of U.S. Provisional Patent Application No. 61/220,218, filed Jun. 25, 2009The present invention relates to methods for detecting malicious programs using a multilayered heuristics approach.The exposure of computer systems to malicious attacks threatens the integrity of secure data storage and transactions. Today's attacks have become very sophisticated. Industry-wide practice shows there is no single solution for detection of malicious ...

System and Method for Bidirectional Trust Between Downloaded Applications and Mobile Devices Including a Secure Charger and Malware Scanner

A system and method are described that will enable mobile smart devices, such as a cellular phones, PDAs, or iPads, smartphones, mobile payment systems, mobile healthcare systems, handheld law enforcement systems, and other types of tablet devices, to trust download applications and for the download applications to trust the mobile smart devices onto which they are downloaded. The system and method enables charging a mobile smart device and while charging the mobile smart device scans for malware and other viruses in the applications and the operating system on the mobile smart device.

OFFLINE EXTRACTION OF CONFIGURATION DATA

A configuration scanning system is described herein that scans a system configuration database for malware-related information with less impact on other operations that access the system configuration database. The system employs techniques to reduce the impact on other operations that access the configuration database, including parsing a file-based stored version of the configuration database, accessing the configuration database using opportunistic locking, and caching configuration information obtained by scanning the configuration database. In this way, the system is able to respond to requests antimalware programs using cached information without impacting other programs using the configuration database. Thus, the configuration scanning system protects a computer system against malware while reducing the burden on the configuration database and on other programs that access the configuration database. 1. A computer-readable storage medium having instructions stored therein for using cached system configuration data by performing actions comprising:receiving a request to access the cached system configuration data, wherein the cached system configuration data relates to the computing device, and wherein the request includes a first logical path for a resource;determining that the cached system configuration data is valid;searching the cached system configuration data for a record entry that is associated with the first logical path;retrieving a value of the record entry that is associated with the first logical path, wherein the value includes a second logical path usable to access the resource when a user associated with the cached system configuration data is logged on to the computing device; andproviding a response to the received request, wherein the response includes the retrieved value.2. The computer-readable storage medium of claim 1 , wherein the actions further comprise:employing the second logical path during an anti-malware operation.3. The ...

CONTENT FILTERING OF REMOTE FILE-SYSTEM ACCESS PROTOCOLS

Methods and systems for content filtering of remote file-system access protocols are provided. According to one embodiment, a first set of Server Message Block/Common Internet File System (SMB/CIFS) protocol requests originated by a first process running on a client and relating to a file associated with a share of a server and a second set of SMB/CIFS protocol requests originated by a second process running on the client and relating to the file are transparently proxied by a gateway device. The existence or non-existence of malicious, dangerous or unauthorized content contained within the file is determined by the gateway device by (i) buffering data being read from or written to the file as a result of the first and second set of SMB/CIFS protocol requests into a shared file buffer; and (ii) performing content filtering on the shared file buffer when a scanning condition is satisfied. 1. A method comprisingtransparently proxying, by a gateway device, (i) a first plurality of Server Message Block/Common Internet File System (SMB/CIFS) protocol requests originated by a first process running on a client and relating to a file associated with a share of a server and (ii) a second plurality of SMB/CIFS protocol requests originated by a second process running on the client and relating to the file; and buffering data being read from or written to the file as a result of the first plurality of SMB/CIFS protocol requests and the second plurality of SMB/CIFS protocol requests into a shared file buffer within a memory of the gateway device; and', 'when one or more of a plurality of scanning conditions are satisfied, then performing content filtering on the shared file buffer., 'determining, by the gateway device, the existence or non-existence of malicious, dangerous or unauthorized content contained within the file by'}2. The method of claim 1 , further comprising tracking claim 1 , by the gateway device claim 1 , references to the shared file buffer by maintaining a ...

PATTERN MATCHING ENGINE, TERMINAL APPARATUS USING THE SAME, AND METHOD THEREOF

Provided is a pattern matching engine. The pattern matching engine calculates an error detection sign of target data and compares the calculated error detection sign with an error detection sign of a malware pattern DB. When the error detection sign of the target data and the error detection sign of the malware pattern DB are identical to each other, the pattern matching engine compares the target data with the malware pattern. 1. A pattern matching engine , comprising:an error detection sign comparison unit which calculates an error detection sign of sub-data, which is a part of target data, and compares the calculated error detection sign with an error detection sign of a malware pattern; anda matcher which, when the error detection sign of the sub-data and the error detection sign of the malware pattern are identical to each other, compares the sub-data with the malware pattern.2. The pattern matching engine as claimed in claim 1 , further comprising a hash loader which compares a hash value of the sub-data with a hash value of the malware pattern; wherein claim 1 , when the hash value of the sub-data and the hash value of the malware pattern are identical to each other claim 1 , the matcher compares the sub-data with the malware pattern.3. The pattern matching engine as claimed in claim 2 , further comprising a hash value comparison unit which:calculates a hash value of the target data by applying a hash algorithm, andcompares the calculated hash value with a hash value of the malware pattern;wherein the error detection sign comparison unit, the matcher, and the hash loader are operated only after an indication that the hash value of the target data and the hash value of the malware pattern are not identical to each other.4. The pattern matching engine as claimed in claim 3 , further comprising a text loader which provides the sub-data to the hash loader and the error detection sign comparison unit.5. The pattern matching engine as claimed in claim 2 , further ...

SYSTEM AND METHOD FOR ATTACK AND MALWARE PREVENTION

The present invention is a system and method for detecting and preventing attacks and malware on mobile devices such as a cell phones, smartphones or PDAs, which are significantly limited in power consumption, computational power, and memory. The invention enables mobile devices to analyze network data, executable data files, and non-executable data files in order to detect and prevent both known and unknown attacks and malware over vectors that are not typically protected by desktop and server security systems. Security analysis is performed by a combination of “known good,” “known bad,” and decision components. The invention identifies known good executables and/or known characteristics of network data or data files that must be present in order for the data to be considered good. Furthermore, known good and known bad identifier databases may be stored on a server which may be queried by a mobile device. 1. In a mobile communications device having a network interface for receiving and sending data , a memory and a microprocessor , and further having software components for processing , analyzing and storing data , including at least a known good component for identifying data that is recognizably safe , a known bad component for identifying data that is recognizably malicious , and a decision component for evaluating whether data is safe or malicious , a method comprising:providing data on the mobile communications device;applying a hash function to the data to create a hash identifier for the data; andcomparing by the known good component, the data hash identifier against a database of identifiers of known good data stored in the mobile communications device memory; andif the comparison by the known good component results in a positive match, then allowing the data to be processed by the mobile communications device.2. The method of claim 1 , further comprising:if the comparison by the known good component does not result in a positive match, then comparing by ...

SYSTEM AND METHOD FOR ATTACK AND MALWARE PREVENTION

The present invention is a system and method for detecting and preventing attacks and malware on mobile devices such as a cell phones, smartphones or PDAs, which are significantly limited in power consumption, computational power, and memory. The invention enables mobile devices to analyze network data, executable data files, and non-executable data files in order to detect and prevent both known and unknown attacks and malware over vectors that are not typically protected by desktop and server security systems. Security analysis is performed by a combination of “known good,” “known bad,” and decision components. The invention identifies known good executables and/or known characteristics of network data or data files that must be present in order for the data to be considered good. Furthermore, known good and known bad identifier databases may be stored on a server which may be queried by a mobile device. 1. On a server having a network interface for receiving from and sending data to a mobile communications device having software components for processing and analyzing data , a method comprising:when the mobile communications device receives data, creates a hash identifier for the data, compares the data hash identifier against a database of known good data stored on the mobile communications device and does not obtain a positive match, receiving the data hash identifier at the server;at the server, using a known bad component, comparing the received data hash identifier against a database stored in memory associated with the server containing hash identifiers of known bad data; and,if the data hash identifier comparison by the known bad component results in a positive match, then sending an instruction from the server to the mobile communications device to reject the data from being processed by the mobile communications device.2. The method of further comprising:if the data hash identifier comparison at the server by the known bad component does not result in a ...

Taint injection and tracking

An embodiment or embodiments of an electronic device can comprise an input interface and a hardware component coupled to the input interface. The input interface can be operable to receive a plurality of taint indicators corresponding to at least one of a plurality of taints indicative of potential security risk which are injected from at least one of a plurality of resources. The hardware component can be operable to track the plurality of taints.

METHODS AND APPARATUS FOR CONTROL AND DETECTION OF MALICIOUS CONTENT USING A SANDBOX ENVIRONMENT

A non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process includes code to cause the processor to receive a set of indications of allowed behavior associated with an application. The processor is also caused to initiate an instance of the application within a sandbox environment. The processor is further caused to receive, from a monitor module associated with the sandbox environment, a set of indications of actual behavior of the instance of the application in response to initiating the instance of the application within the sandbox environment. The processor is also caused to send an indication associated with an anomalous behavior if at least one indication from the set of indications of actual behavior does not correspond to an indication from the set of indications of allowed behavior. 1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor , the code comprising code to cause the processor to:receive a set of indications of allowed behavior associated with an application;initiate an instance of the application within a sandbox environment;receive, from a monitor module associated with the sandbox environment, a set of indications of actual behavior of the instance of the application in response to initiating the instance of the application within the sandbox environment; andsend an indication associated with an anomalous behavior if at least one indication from the set of indications of actual behavior does not correspond to an indication from the set of indications of allowed behavior.2. The non-transitory processor-readable medium of claim 1 , wherein the code to cause the processor to send includes code to cause the processor to send the indication associated with the anomalous behavior such that the sandbox environment is terminated.3. The non-transitory processor-readable medium of claim 1 , wherein the code to cause the processor to ...

Multilayered deception for intrusion detection and prevention

Concepts and technologies are disclosed herein for multilayered deception for intrusion detection. According to various embodiments of the concepts and technologies disclosed herein, a multilayer deception system includes honey servers, honey files and folders, honey databases, and/or honey computers. A multilayer deception system controller generates honey activity between the honey entities and exposes a honey profile with contact information associated with a honey user. Contact directed at the honey user and/or activity at any of the honey entities can trigger alarms and/or indicate an attack, and can be analyzed to prevent future attacks.

APPARATUS AND METHOD FOR ANALYZING MALWARE IN DATA ANALYSIS SYSTEM

An apparatus and method for analyzing malware in a data analysis system are provided. The apparatus includes a data analysis unit and a controller. The data analysis unit sorts data into primary harmful data and primary harmless data using screening data information of malicious code information and virus information. The controller screens or deletes the primary harmful data, and sends a request for precision analysis of the primary harmless data to a server. The data analysis unit sorts secondary harmful data from the primary harmless data using the precision analysis result received from the server. 1. An apparatus for analyzing malware in a portable terminal , the apparatus comprising:a data analysis unit for sorting data into primary harmful data and primary harmless data based on screening data information of malicious code information and virus information; anda controller for screening or deleting the primary harmful data, and for sending a request for analysis of the primary harmless data to a server,wherein the data analysis unit sorts secondary harmful data from the primary harmless data based on the analysis result received from the server.2. The apparatus of claim 1 , wherein the screening data information is provided and updated in a security enterprise claim 1 , andwherein the controller comprises information about the secondary harmful data in the screening data information.3. The apparatus of claim 1 , wherein the controller screens access to the sorted secondary harmful data or deletes the secondary harmful data.4. The apparatus of claim 1 , wherein the controller transmits holding data information that is information of data stored in the portable terminal claim 1 , to the server claim 1 , receives harmful data information included in the holding data information from the server claim 1 , and deletes harmful data based on the received harmful data information.5. An apparatus for analyzing malware in a server claim 1 , the apparatus comprising:a ...

OPERATION OF A DUAL INSTRUCTION PIPE VIRUS CO-PROCESSOR

Circuits and methods are provided for detecting, identifying and/or removing undesired content. According to one embodiment, a method for virus processing content objects is provided. A content object is stored within a system memory by a general purpose processor using a virtual address. Most recently used entries of a page directory and a page table of the system memory are cached within a translation lookaside buffer (TLB) of a virus co-processor. Instructions are read from a virus signature memory of the co-processor. Those of a first type are assigned to a first of multiple instruction pipes of the co-processor. The first instruction pipe executes an instruction including accessing a portion of the content object by performing direct virtual memory addressing of the system memory using a physical address derived based on the virtual address and the TLB and comparing it to a string associated with the instruction. 1. A method of virus processing content objects , the method comprising:storing, by a general purpose processor, a content object that is to be virus processed to a system memory of the general purpose processor using a virtual address, the system memory having stored therein a page directory and a page table containing information for translating virtual addresses to physical addresses within a physical address space of the system memory;caching, by a virus co-processor, coupled to the general purpose processor via an interconnect bus, a plurality of most recently used entries of the page directory and the page table within one or more translation lookaside buffers implemented within an on-chip cache of the virus co-processor;reading, by a virus co-processor, a subset of instructions from a virus signature memory of the virus co-processor, the subset of instructions containing op-codes of a first instruction type and op-codes of a second instruction type;assigning, by the virus co-processor, instructions of the subset of instructions of the first ...

Interactive analysis of a security specification

Analyzing a security specification. An embodiment can include identifying a downgrader in a computer program under test. Via a processor, testing on the downgrader can be performed in a first level of analysis. Responsive to the downgrader not passing the testing performed in the first level of analysis, a counter example for the downgrader can be automatically synthesized. Further, a test unit can be created for the downgrader using the counter example as an input parameter to the downgrader. The test unit can be executed to perform testing on the downgrader in a second level of analysis. Responsive to the downgrader passing the testing performed in the second level of analysis, a user can be prompted to simplify a model of the downgrader.

Method and system for rapid signature search over encrypted content

A method for detecting malware includes dividing data to be scanned for malware into at least a first data segment and a second data segment, dividing a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment, performing a relationship function on the first signature segment and the second signature segment yielding a first result, performing the relationship function on the first data segment and the second data segment yielding a second result, comparing the first result and the second result, and, based on the comparison, determining that the data includes information corresponding to the signature. The relationship function characterizes the relationship between at least two information sets.

METHOD AND SYSTEM FOR AUTOMATICALLY GENERATING VIRUS DESCRIPTIONS

Systems and methods for automatically generating information describing malware are disclosed. In accordance with certain embodiments, a client computer may be provided with an antivirus program capable of finding malware and a server for receiving malware information sent from the antivirus program via a network. In accordance with one embodiment, the antivirus program may checked the client computer for malware and, in the event that malware is found, the antivirus program may acquire information about the malware such as the type of malware, the form of identification of the malware, whether the malware has already been executed, and/or whether it has been possible to remove the malware. This malware information may be transmitted from the client computer to the server in an automatic, structured manner. When received by the server, the malware information may be fed into a database on the server and subsequently displayed, for example, in an automatic, structured manner on a web page or via an interface of the antivirus program. 1. A method , comprising:receiving via a network a message containing information describing one or more aspects of a malware detected on a remote computer by an antivirus program;storing the received information about the malware in an entry in a database that is associated with the malware;retrieving information about the malware from the database;generating a description page describing the malware using the retrieved information and a template; andsending the description page via the network to the remote computer for display at the remote computer.2. The method of claim 1 , wherein the antivirus program runs on the remote computer.3. The method of claim 1 , wherein the antivirus program is located at a location remote from the remote computer and analyzes the malware on the remote computer via the network.4. The method of claim 1 , wherein the malware is detected at the remote computer by the antivirus program through an analysis of ...

Active Defense Method on The Basis of Cloud Security

The present invention relates to an active defense method based on cloud security comprising: a client collecting and sending a program behavior launched by a program thereon and/or a program feature of the program launching the program behavior to a server; with respect to the program feature and/or the program behavior sent by the client, the server performing an analysis and comparison in its database, making a determination on the program based on the comparison result, and feeding back to the client; based on the feedback determination result, the client deciding whether to intercept the program behavior, terminate execution of the program and/or clean up the program, and restore the system environment. The invention introduces a cloud security architecture, and employs a behavior feature based on active defense to search and kill a malicious program, thereby ensuring network security. 1. An active defense method based on cloud security , comprising:collecting a program behavior launched by a program and/or a program feature of the program launching the behavior;with respect to the program feature and/or the program behavior, performing an analysis and comparison in a database, making a determination on the program based on the comparison result;based on the feedback determination result, deciding whether to intercept the program behavior, terminate execution of the program and/or clean up the program, restore the system environment.2. A method as claimed in claim 1 , wherein the program behavior comprises the program behavior itself and the attributes of the object of the program behavior; the attributes of the object of the program behavior further comprise the black and white level to which the behavioral object itself belongs claim 1 , the position in the system and type of the behavioral object claim 1 , the behavior itself made by the behavioral object and the black and white level to which the behavior itself belongs.3. A method as claimed in claim 1 , ...

Geo-mapping system security events

A particular security event is identified that has been detected as targeting a particular computing device included in a particular computing system. A particular grouping of assets in a plurality of asset groupings within the particular computing system is identified as including the particular computing device. A source of the particular security event is also identified and at least one of a geographic location and a grouping of assets in the plurality of asset groupings is associated with the identified source. Data is generated that is adapted to cause a presentation of a graphical representation of the particular security event on a display device, the graphical representation including a first graphical element representing the particular computing device as included in the particular grouping of assets and a second graphical element representing the source associated with the at least one of a geographic location and a grouping of assets.

PLANT SECURITY MANAGING DEVICE, MANAGING METHOD AND MANAGING PROGRAM

A technology is provided which ensures a high security without affecting a plant operation. A plant security managing device includes a determining unit that determines which one of control units multiplexed as a service system and a standby system associated with monitoring and controlling of a plant is the standby system, a security processing unit that performs a security process for detecting the presence/absence of a security abnormality on the control unit that is the standby system, and a change instructing unit that outputs an instruction for changing the control unit that is the standby system and the control unit that is the service system with each other after the completion of the security process by the security processing unit. 1. A plant security managing device comprising:a determining unit that determines which one of elements multiplexed as a service system and a standby system associated with monitoring and controlling of a plant is the standby system;a security processing unit that performs a security process only on the element that is the standby system; anda change instructing unit that outputs an instruction for changing the standby-system element and the service-system element with each other.2. The plant security managing device according to claim 1 , wherein the security processing unit comprises:a detector that detects a security abnormality in the standby-system element; andan eliminator that eliminates the abnormality detected by the detector.3. The plant security managing device according to claim 1 , further comprising:a loading-factor determining unit that determines whether or not a loading factor of the service-system element between the multiplexed elements exceeds a predetermined threshold; anda restraining unit that restrains the security process by the security processing unit in accordance with a determination result by the loading-factor determining unit.4. The plant security managing device according to claim 1 , further ...

WHITELIST-BASED INSPECTION METHOD FOR MALICIOUS PROCESS

A method of detecting a malware based on a white list comprises: receiving on a server side a program feature and/or a program behavior of a program to be detected sent from a client side; comparing the program feature and/or the program behavior of the detected program with legitimate program features and/or legitimate program behaviors stored in a white list; obtaining a legitimacy information of the unknown program based on the comparison result and feeding this back to the client side. In the invention, a legitimate program is determined by using a white list, thereby determining an illegitimate program excluded from the white list as a malware, which performs a determination and detecting and removing of a malware from another perspective. 1. A method of detecting a malware based on a white list , comprising:receiving on a server side a program feature and/or a program behavior of a program to be detected sent from a client side;comparing the program feature and/or the program behavior of the detected program with legitimate program features and/or legitimate program behaviors stored in a white list;obtaining a legitimacy information of the unknown program based on the comparison result and feeding the legitimacy information back to the client side.2. The method as claimed in claim 1 , wherein the obtaining of the legitimacy information of the unknown program based on the comparison result and the feeding of the legitimacy information back to the client side comprise: if the program feature and/or the program behavior of the detected program hits a legitimate program feature and/or a legitimate program behavior stored in the white list claim 1 , then determining the detected program as a legitimate program claim 1 , and feeding this back to the client side; if missed claim 1 , then determining the detected program as a malware claim 1 , and feeding this back to the client side.3. The method as claimed in claim 1 , wherein the obtaining of the legitimacy ...

ANTI-VIRUS PROTECTION FOR MOBILE DEVICES

A computing device, machine-readable medium, and method associated with identifying viruses on a mobile device are disclosed. In embodiments, a computing device may include a communication interface, one or more storage media containing instructions, and a processing unit coupled to the communication interface and the one or more storage media. The instructions, when executed by the processor, may configure the computing device to analyze files, received by the computing device, for the presence of a virus. The instructions, when executed by the processor, may further notify the mobile device when the presence of a virus is detected. 1. A computing device comprising:a communication interface;one or more storage media having a plurality of instructions; anda processing unit coupled to the communication interface and the one or more storage media; analyze files transmitted by a mobile device to the computing device for backup to determine whether at least one of the files is infected by a virus; and', 'perform one or more remedial actions, in response to a result of the determination that indicates at least one of the files is infected by a virus., 'wherein the instructions, in response to execution by the processing unit, cause the computing device to'}2. The computing device of claim 1 , wherein the one or more remedial actions includes:transmission of a notification that informs the mobile device of the at least one of the files determined to be infected by a virus; ortransmission of a notification to the mobile device to disable usage and/or execution of the at least one of the files determined to be infected by a virus.3. The computing device of claim 1 , wherein the one or more remedial actions includes:transmission to the mobile device, a clean version of the at least one of the files determined to be infected by a virus; andtransmission to the mobile device, instructions that cause the mobile device to replace the at least one of the files determined to be ...

Pre-boot firmware based virus scanner

The present disclosure relates to allowing the utilization of a virus scanner and cleaner that operates primarily in the pre-boot phase of computer operation and, more particularly, to allowing the utilization of a virus scanner and cleaner that operates primarily during the loading of an operating system.

Detecting Malicious Software

A computer implemented method, apparatus, and program code for detecting malicious software components. A series of calls made by a software component is monitored to identify an identified respective series of call types to components named in said calls. A determination is made as to whether the identified respective series of call types to components named in said calls is indicative of malicious behavior. 1. A method for detecting a malicious software component method comprising:a computer receiving a request to write a potentially malicious software component to storage in the computer;responsive to receiving the request, the computer initiating execution of the potentially malicious software component in an emulated data processing system, the emulated data processing system isolating the potentially malicious software component from one or more other software components that are called by the potentially malicious software component such that if the potentially malicious software component is malicious, it will not damage the other software components;while executing the potentially malicious software component in the emulated data processing system, the potentially malicious software component making a series of calls specified by the potentially malicious software component to the emulated data processing system;the computer monitoring the series of calls made by the potentially malicious software component to the emulated data processing system to determine a respective series of call types to the other software components named in the series of calls;the emulated data processing system executing the series of calls;the computer determining whether the respective series of call types is indicative of a malicious behavior based on a comparison of the respective series of call types to a set of pre-determined call patterns indicative of malicious behavior for the potentially malicious software component; andallowing the request in response to determining the ...

System, Method and Computer Program Product for Performing a Security or Maintenance Operation in Association with Virtual Disk Data

A system, method and computer program product are provided for performing a security or maintenance operation in association with virtual disk data accessed independent of a virtual machine. In use, data stored on a virtual disk is accessed at least in part independent of a virtual machine. Further, a security or maintenance operation is performed in association with the accessed data.

Method, System And Apparatus For Improving Security Level Of A Terminal When Surfing Internet

A method, system, and apparatus for improving security level of a terminal when it surfs the Internet. The method includes receiving, by a network side, network security information reported by a terminal, generating a network security policy according to the network security information reported by each terminal, and transmitting a security indication to the network security policy to the terminal; providing, by the terminal, a security prompt for network information to be obtained or having been obtained according to the security indication. Various embodiments can improve the security level of the terminal when it surfs the Internet and save resources of the terminal.

Detecting Application Harmful Behavior and Grading Application Risks for Mobile Devices

In one embodiment, a method determines a permission list from an application and generates a set of potential behaviors. The potential behaviors are associated with actions that the application allows when executing on a mobile device where the potential behaviors are determined without execution of the application. The method then determines functional category information regarding a functional category from a set of application marketplaces that contain the application and determines application description information for the application. A required behavior list is generated including a set of required behaviors from the functional category information and the application description information. The method compares the required behaviors to the potential behaviors to determine a set of security related behaviors. The security related behaviors are behaviors found in the potential behaviors, but not in the required behaviors. A security rating is determined based on the set of security related behaviors.

PROGRAM ANALYSIS SYSTEM AND METHOD THEREOF

A program analysis system that analyzes a program while adjusting time elapse velocity in program execution environment sets analysis conditions such as time elapse velocity in the execution environment, program execution start time and execution termination time, adjusts the time elapse velocity and the program execution start time according to the determination of an analysis manager, executes the program till the execution termination time, monitors the execution environment, acquires an action record of the program, analyzes the action record, and clarifies the behavior of the program. Further, the program analysis system resets the analysis conditions based upon a result of analysis, re-analyzes, monitors communication between a sample and an external terminal, and varies the time elapse velocity set by the analysis manager to prevent time-out from occurring in communication. 1. A program analysis system that operates a program the operation of which is to be verified in execution environment where time elapse velocity can be arbitrarily adjusted , comprising:a system management device provided with an analysis manager that manages an analysis situation of the program and determines time elapse velocity;at least one sample execution device provided with a sample executor that executes the program in the execution environment based upon the time elapse velocity specified by the analysis manager and an action recorder that acquires the behavior of the program in the execution environment as an action record;at least one action analyzer provided with an action analyzer that analyzes the action record and outputs a characteristic of the program as a result of analysis; andat least one communication monitoring device provided with a communication monitor that adjusts the time elapse velocity so as to prevent time-out from occurring when the program communicates with an external device.2. The program analysis system according to claim 1 , wherein the communication ...

SYSTEMS AND METHODS FOR CYBER-THREAT DETECTION

Disclosed herein are systems and methods relating generally to computer system security and more specifically to scalable cyber-threat detection systems and methods that systematically and automatically execute and monitor code within a secure isolated environment to automatically identify and filter out malicious code so that it is not executed on a live system. 1. A computer-implemented method of executing content within a secure isolated environment , monitoring and recording the execution of the content , and processing the recorded results of the execution to detect and filter out cyber-based threats , the method comprising the steps of:locating and identifying content for execution and monitoring within a unique secure isolated environment, the unique secure isolated environment comprising a computer including a processor configured to execute computer readable instructions;preparing the located and identified content for execution and monitoring by separating the content into individual components;processing each individual component by executing each individual component within the unique secure isolated environment;monitoring and recording system activity resulting from the execution of each individual component within the unique secure isolated environment;processing the recorded system activity from each of the components to identify whether the located and identified content is a threat; andreporting the processing results.2. The computer-implemented method according to wherein one or more client components are configured to locate and identify the content for execution and monitoring within the unique secure isolated environment.3. The computer-implemented method according to claim 2 , wherein at least one client component is configured to systematically scan a network to locate and identify resident files for execution and monitoring within the unique secure isolated environment.4. The computer-implemented method according to claim 2 , wherein one or ...

System and Method for Bidirectional Trust Between Downloaded Applications and Mobile Devices Including a Secure Charger and Malware Scanner

A system and method are described that will enable mobile smart devices, such as a cellular phones, PDAs, or iPads, smartphones, mobile payment systems, mobile healthcare systems, handheld law enforcement systems, and other types of tablet devices, to trust download applications and for the download applications to trust the mobile smart devices onto which they are downloaded. The system and method enables charging a mobile smart device and while charging the mobile smart device scans for malware and other viruses in the applications and the operating system on the mobile smart device. 1. A computer-based system for determining a bidirectional trust between an electronic device and computer-based applications downloaded to such electronic device , comprising:(a) a scanning device that includes being removably connected to the electronic device, with the scanning device for scanning the electronic device for malicious software (“malware”) and receiving scan results that indicate whether the electronic device is compromised by having malware thereon or not compromised by being free of malware; and (1) a server that includes at least a frontend server and a backend server, with the frontend server for receiving requests from and providing responses to customer input devices external to the internal network, and with the backend server for bidirectional communications with the scanning device for receiving at least scan results from the scanning device and transmitting at least computer software updates to the scanning device,', '(2) an internal network database connected to the frontend server and backend server for storing at least customer information, electronic device information, and scan results,', '(3) a certification authority for transmitting certificate information to the backend server and certificate information to the scanning device through the backend server for establishing secure communications between the scanning device and the backend server, and', ...

Security scanning system and method

The present disclosure provides a computer-readable medium, method, and system for determining security vulnerabilities for a plurality of application programs used to provide television services to a customer device over a communications network. The method includes running a first scanning program against a first application program relating to a control panel for the customer device; running a second scanning program against a second application program that provides Internet content to the customer device, running a third scanning program against a third application program that relates to a component management system of customer premises equipment; and correlating security vulnerabilities identified utilizing the first, second, and third scanning programs.

Embedded anti-virus scanner for a network adapter

A network adapter system and associated method are provided. The network adapter system includes a processor positioned on a network adapter coupled between a computer and a network. Such processor is configured for scanning network traffic transmitted between the computer and the network.

System, method, and computer program product for preventing a modification to a domain name system setting

A system, method, and computer program product are provided for preventing a modification to a domain name system setting. In use, an attempt to modify a domain name system setting is detected. Additionally, a source of the attempt and an attribute of the modification are verified. Further, the modification to the domain name system setting is prevented, based on the verification.

System, method, and computer program product for utilizing a data structure including event relationships to detect unwanted activity

A system, method, and computer program product are provided for utilizing a data structure including event relationships to detect unwanted activity. In use, a plurality of events is identified. Additionally, a data structure including objects associated with the plurality of events and relationships associated with the plurality of events is generated. Further, unwanted activity is detected utilizing the data structure.

Output control apparatus, computer-readable medium for storing program for output control apparatus, output control method, and output control system

Provided is an output section that outputs data to outside; a condition storage section that stores an abnormal condition showing at least one of a characteristic of data to be outputted from the output section by means of malicious software and a characteristic of an operational pattern of the output section that results when the malicious software outputs data; and an output control section that prohibits output of data when at least one of a characteristic of data to be outputted from the output section and a characteristic of an operational pattern of the output section satisfies the abnormal condition.

SYSTEM AND METHOD FOR DETECTION OF NON-COMPLIANT SOFTWARE INSTALLATION

A system and method for performing a security check may include using at least one processor to periodically check a status of a flag, generate and store a baseline representation of modules stored on the device where the flag is determined to be set to a first state, and, where the flag is determined to be set to a second state, generate an active representation of modules stored on the first device, compare the active representation of modules to the baseline representation of modules, and, responsive to a determination in the comparing step of a difference between the baseline and active representations of modules, output an alert. The flag status may depend on an association of the device with one of a plurality of authorization policies, each mapped to one of the two states. Results of the comparison may be appended to an activity log of the device. 1. A computer-implemented security method for detecting non-compliant software installation , the method comprising: determining a status of a flag;', 'where the flag is determined to be set to a first state, generating and storing a baseline representation of modules stored on a first device; and', generating an active representation of the modules stored on the first device,', 'comparing the active representation of the modules to the baseline representation of the modules,', 'determining if there is a difference between the baseline and the active representations of the modules, and', 'outputting an alert if there is a difference between the baseline and the active representations of the modules., 'where the flag is determined to be set to a second state], 'performing, on a periodic basis and using at least one computer processor, the following2. The method of claim 1 , wherein:a period of the periodic performance is controlled by a timer,the timer is automatically reset subsequent to the generation of the baseline representation of the modules where the flag is determined to be set to the first state, andthe ...

Emulator updating system and method

One embodiment includes a method and computer program product for distributing and/or receiving a first emulator extension with respect to an emulator capable of performing an emulation using emulation code. The first emulator extension includes program instructions that aid in the process of emulating in order to detect potentially unwanted computer software. Such program instructions of the first emulator extension are additional beyond that associated with the emulator code, for assisting the emulator code in the emulation by patching the additional program instructions into the emulator in order to aid in detecting the potentially unwanted computer software within the suspect code. In use, an emulation is performed using the first emulator extension and the suspect code. The emulation is performed within an insulated environment in a computer system so that the computer system is insulated from potentially unwanted actions of the suspect code. 1. A method to be performed in conjunction with a processor and a memory , the method comprising:receiving a first emulator extension from among a plurality of different emulator extensions at an emulator for performing an emulation using emulation code, each of the plurality of different emulator extensions including program instructions that read suspect code of a computer system during the process of emulating in order to detect that the suspect code includes potentially unwanted computer software;performing a first emulation using the first emulator extension and the suspect code to detect whether the suspect code contains potentially unwanted computer software, the first emulation being performed within an insulated environment in the computer system, wherein each of the plurality of different emulator extensions is configured for loading, from a database containing the plurality of different emulator extensions, into an emulator buffer as a patch to the suspect code such that at least some of the suspect code is ...

System, method and computer program product for removing null values during scanning

A system, method, and computer program product are provided for scanning data values. Initially, a set of data values are received. Null values between the data values are then removed such that the data values are contiguous. Further, the data values with the null values removed are scanned for the purpose of identifying unwanted data. 1. A method , comprising:receiving a set of data values at a computer, which includes a processor;determining if a threshold is met before removing null values;removing the null values between the data values such that the data values are made contiguous and shorter;evaluating a size of the data values after the null values have been removed;scanning the set of data values with the null values removed to identify unwanted data in the computer; andcollapsing at least a portion of whitespace within text-based files corresponding to the set of data values such that certain sequences of whitespace characters are replaced by a single whitespace character.2. (canceled)3. (canceled)4. The method of claim 1 , wherein the threshold includes a size of the set of data values.5. The method of claim 1 , wherein only a portion of the set of data values is received if the set of data values is larger than the threshold.6. The method of claim 5 , wherein the portion of the set of data values only includes the data values that are necessary for the scanning.7. The method of claim 5 , wherein the portion of the set of data values is identified utilizing a key position.8. The method of claim 7 , wherein the key position is based on a virus signature associated with the scanning.9. The method of claim 6 , wherein claim 6 , after the null values are removed in a first portion of the set of data values claim 6 , the first portion of the set of data values is stored with the null values removed claim 6 , and it is determined whether a second portion of the set of data values is to be received.10. The method of claim 9 , wherein claim 9 , after the portions ...

DYNAMIC MANAGEMENT OF RESOURCE UTILIZATION BY AN ANTIVIRUS APPLICATION

System and method for dynamically managing utilization of computing capacity by an antivirus application having distinct security modules configurable by adjustment of operational parameters. An identification of the computing resources required by each of the security modules to perform certain corresponding security-related functionality is obtained. A current state of authorization granted to the antivirus application to access each of the plurality of computing resources is determined. The operational parameters are adjusted for the at least one of the security modules in response to a determination that the current state of authorization is insufficient for the antivirus application to access certain ones of the computing resources required by the at least one of the security modules to perform its corresponding functionality. The operational parameters are adjusted to disable the corresponding functionality and to thereby de-allocate a portion of the computing capacity needed to execute that corresponding functionality. 1. In a computing device comprising a plurality of computing resources and an operating system interfaced with the computing resources , a system for dynamic management of utilization of computing capacity by an antivirus application , the system comprising:a plurality of distinct security modules defined by program instructions associated with the antivirus application and stored in a non-transitory data storage medium of the computing device that, when executed, cause the computing device to provide a corresponding security-related functionality based on one or more adjustable operational parameters, wherein adjustment of the one or more adjustable operational parameters for each of the security modules affects allocation of available computing capacity needed to execute the security-related functionality of that security module; access a resource requirements data structure stored in a non-transitory data storage medium, the resource ...

System and method for detecting potential threats by monitoring user and system behavior associated with computer and network activity

A system and method is provided to monitor user and system behavior associated with computer and network activity to determine deviations from normal behavior that represent a potential cyber threat or cyber malicious activity. The system and method uses a multi-factor behavioral and activity analysis approach to determine when a trusted insider might be exhibiting threatening behavior or when a user's computer or network credentials have been compromised and are in use by a third-party. As a result, changes in insider behavior that could be indicative of malicious intent can be detected, or an external entity masquerading as a legitimate user can be detected.

Server-Side Restricted Software Compliance

Server-side restricted software compliance may be provided. An application installed on a user device may be identified and analyzed to determine whether the application comprises a security threat by comparing the application to a copy of the application. In response to determining that the application comprises a security threat, a user of the user device may be notified that the application comprises a security threat. 1. A method comprising:identifying an application installed on a user device;determining whether the application comprises a security threat by comparing the application to a copy of the application;in response to determining that the application comprises a security threat, notifying a user of the user device that the application comprises a security threat.2. The method of claim 1 , wherein the user device comprises at least one of the following: a server claim 1 , a desktop computer claim 1 , a laptop computer claim 1 , a personal digital assistant claim 1 , a cellular telephone claim 1 , a set-top box claim 1 , a music player claim 1 , a web pad claim 1 , a tablet computer system claim 1 , a game console.3. The method of claim 1 , further comprising downloading the copy of the application from a distributor of the application.4. The method of claim 3 , wherein the distributor of the application comprises a publicly accessible application store.5. The method of claim 3 , wherein the distributor of the application comprises a private application store associated with an enterprise.6. The method of claim 1 , further comprising:in response to determining that the application comprises a security threat, disabling the application.7. The method of claim 1 , further comprising:in response to determining that the application comprises a security threat, deleting the application.8. The method of claim 1 , further comprising:in response to determining that the application comprises a security threat, notifying an administrator that the application ...

Method, System and Program Product for Optimizing Emulation of a Suspected Malware

A method, system and program product for optimizing emulation of a suspected malware. The method includes identifying, using an emulation optimizer tool, whether an instruction in a suspected malware being emulated by an emulation engine in a virtual environment signifies a long loop and, if so, generating a first hash for the loop. Further, the method includes ascertaining whether the first hash generated matches any long loop entries in a storage and, if so calculating a second hash for the long loop. Furthermore, the method includes inspecting any long loop entries ascertained to find an entry having a respective second hash matching the second hash calculated. If an entry matching the second hash calculated is found, the method further includes updating one or more states of the emulation engine, such that, execution of the long loop of the suspected malware is skipped, which optimizes emulation of the suspected malware. 1. A method for optimizing emulation of a suspected malware program , the method comprising the steps of:a computer identifying a first instruction in the suspected malware program that initiates a loop, and in response, the computer determining a length of the loop based at least in part on a number of times that the loop will be repeated, and if the length exceeds a predetermined threshold, generating a first hash value based at least in part on a hash of instructions in the loop;the computer identifying a second, subsequent instruction in the suspected malware program that initiates a loop, and in response, the computer determining a length of the loop initiated by the second instruction, based at least in part on a number of times that the loop initiated by the second instruction will be repeated, and if the length exceeds a predetermined threshold, generating a second hash value based at least in part on a hash of instructions within the loop initiated by the second instruction; andif the second hash value matches the first hash value, the ...

APPARATUS AND METHOD FOR REMOVING MALICIOUS CODE

Disclosed are an apparatus and a method for removing a malicious code. Accordingly, the present invention provides a technology of mixing a cloud computing based network detecting scheme and a conventional malicious code detecting scheme for providing a detection engine to a client terminal according to a situation based on characteristics of the client terminal, helping efficiently cope with a malicious code. 1. A malicious code removing apparatus comprising:a determiner for determining whether a detection engine associated with detection and removal of a malicious code will be provided to a client terminal, or the malicious code will be detected and removed based on cloud computing, based on characteristics of the client terminal;a detection engine transmitter for, when the determiner determines that the detection engine will be provided to the client terminal, transmitting the detection engine to the client terminal; andan execution unit for, when the determiner determines that the malicious code will be detected and removed based on cloud computing, detecting and removing the malicious code based on cloud computing.2. The malicious code removing apparatus as claimed in claim 1 , further comprising a database where characteristic information associated with characteristics of the client terminal is stored claim 1 , wherein the determiner determines whether the detection engine will be provided to the client terminal claim 1 , or the malicious code will be detected and removed based on cloud computing claim 1 , with reference to the characteristic information from the database.3. The malicious code removing apparatus as claimed in claim 1 , wherein when the detection engine is received from the malicious code removing apparatus claim 1 , the client terminal detects and removes the malicious code using the detection engine.4. The malicious code removing apparatus as claimed in claim 1 , wherein the determiner determines whether the detection engine will be provided ...

Controlling Anti-Virus Software Updates

The present invention relates to a method of controlling the download of anti-virus software updates to a device. The device is configured to transmit an update query to a network device requesting information on whether any updates are available for the anti-virus software. When the device receives the response it stores the response in the cache. The cache can then be queried following a trigger and, if the cache indicates an update to the anti-virus software is available the device downloads an update to the anti-virus software. In an alternative embodiment the device may download and install an update upon receiving the response to the query if the response to the query indicates that an update is available. The query may be transmitted during a scan or upon determining a change in a connection at a device.

Systems and methods for implementing security in a cloud computing environment

Computer systems and methods are provided in which an agent executive, when initially executed in a virtual machine, obtains an agent API key from a user. This key is communicated to a grid computer system. An agent identity token, generated by a cryptographic token generation protocol when the key is valid, is received from the grid and stored in a secure data store associated with the agent executive. Information that evaluates the integrity of the agent executive is collected using agent self-verification factors. The information, encrypted and signed with a cryptographic signature, is communicated to the grid. Commands are sent from the grid to the agent executive to check the security, compliance, and integrity of the virtual machine processes and data structures. Based on these check results, additional commands are sent by the grid to the agent executive to correct security, compliance or integrity problems and/or to prevent security compromises.

System and method for determining and using local reputations of users and hosts to protect information in a network environment

A method in an example embodiment includes correlating a first set of event data from a private network and determining a local reputation score of a host in the private network based on correlating the first set of event data. The method further includes providing the local reputation score of the host to a security node, which applies a policy, based on the local reputation score of the host, to a network communication associated with the host. In specific embodiments, the local reputation score of the host is mapped to a network address of the host. In further embodiments, the first set of event data includes one or more event indicators representing one or more events, respectively, in the private network. In more specific embodiments, the method includes determining a local reputation score of a user and providing the local reputation score of the user to the security node.

METHOD AND APPARATUS FOR RETROACTIVELY DETECTING MALICIOUS OR OTHERWISE UNDESIRABLE SOFTWARE

A system for retroactively detecting malicious software on an end user system without performing expensive cross-referencing directly on the endpoint device. A client provides a server with information about files that are on it together with what it knows about these files. The server tracks this information and cross-references it against new intelligence it gathers on clean or malicious files. If a discrepancy is found (i.e., a file that had been called malicious, but that is actually benign or vice versa), the server informs the client, which in turn takes an appropriate action based on this information. 1. A method for the retroactive detection and removal of undesirable software , comprising:periodically receiving, at a server in communication with a network, information relating to files on a client computing device, including information relating to whether one or more files have previously been classified as posing a threat or not;storing on said server said information relating to files on said client computing device, including said information relating to whether one or more files have previously been classified as posing a threat or not;periodically receiving at a server in communication with a network information useful in classifying files as posing a threat or not;cross-referencing said information relating to files on said client computing device with said information useful in classifying files as posing a threat or not to determine whether a previous classification of a file is inconsistent with a classification based on current information;if an inconsistent classification is found; communicating information concerning an updated classification to said client computing device or to an administrator responsible for said client computing device.2. A method according to claim 1 , wherein said information relating to whether one or more files have been classified as posing or threat or not comprises information relating to whether one or more files ...

ENVIRONMENTAL IMAGING

A method and system for detecting whether a computer program, sent to a first computer having an operating environment including a plurality of files, includes malware is provided. A second computer lists in a file a plurality of environment details of the operating environment of the first computer. The second computer simulates in the second computer the presence of the plurality of files in the operating environment by exhibiting the plurality of environment details without installing the plurality of files in the second computer. The second computer executes the computer program in the second computer with the simulation and determines whether the computer program attempts to access or utilize the plurality of files in a manner indicative of malware. If not, the second computer records and generates a notification that the computer program is not malware. 1. A method for determining whether a computer program , addressed to a first computer having a plurality of files different than the computer program , includes malware , the method comprising the steps of:a second computer receiving the computer program via a network;listing in a file in the second computer, without installing the plurality of files in the second computer, identities of the plurality of files in the first computer and respective creation dates or respective last edit dates for the respective plurality of files in the first computer;creating, for the computer program, a simulated operating environment in the second computer using the file having the listing of identities of the plurality of files in the first computer and the respective creation dates or respective last edit dates;executing the computer program in the second computer; andthe second computer determining whether the computer program attempts to access or utilize the plurality of files in a manner indicative of malware, and if so, the second computer generating a first record that the computer program exhibits a characteristic of ...

METHOD AND APPARATUS FOR DETECTING A MALWARE IN FILES

An apparatus for detecting a malware in files includes an acquisition unit configured to obtain from a file system information about a first time point when an interested folder is created by the file system, and information about a second time point when an interested file is created in the interested folder by the file system, a candidate determination unit configured to determine whether the interested file is a candidate file to be subjected to a malware inspection, based on the information on the first and the second time point, and an inspection unit configured to perform the malware inspection on the interested file determined to be the candidate file for the malware inspection. 1. An apparatus for detecting a malware in files , comprising:an acquisition unit configured to obtain from a file system information about a first time point when an interested folder is created by the file system, and information about a second time point when an interested file is created in the interested folder by the file system;a candidate determination unit configured to determine whether the interested file is a candidate file to be subjected to a malware inspection, based on the information on the first and the second time point; andan inspection unit configured to perform the malware inspection on the interested file determined to be the candidate file for the malware inspection.2. The apparatus of claim 1 , wherein the candidate determination unit is configured to determine the interested file as the candidate file to be inspected in case that the second time point is behind a predetermined term from the first time point.3. The apparatus of claim 1 , wherein the interested folder is associated with an operating system employing the file system.4. The apparatus of claim 3 , wherein the interested folder has a folder name that is prohibited from being renamed by the operating system.5. The apparatus of claim 1 , wherein the interested folder has a parent folder claim 1 , and ...