ATE512538T1 - System und verfahren zur erkennung eines bösartigen programmcodes - Google Patents

System und verfahren zur erkennung eines bösartigen programmcodes

Info

Publication number
ATE512538T1
ATE512538T1 AT08154997T AT08154997T ATE512538T1 AT E512538 T1 ATE512538 T1 AT E512538T1 AT 08154997 T AT08154997 T AT 08154997T AT 08154997 T AT08154997 T AT 08154997T AT E512538 T1 ATE512538 T1 AT E512538T1
Authority
AT
Austria
Prior art keywords
program file
urls
malware
detecting
function
Prior art date
Application number
AT08154997T
Other languages
English (en)
Inventor
Christoph Alme
Original Assignee
Secure Computing Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Secure Computing Corp filed Critical Secure Computing Corp
Application granted granted Critical
Publication of ATE512538T1 publication Critical patent/ATE512538T1/de

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2115—Third party
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2119—Authenticating web pages, e.g. with suspicious links
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer And Data Communications (AREA)
  • Information Transfer Between Computers (AREA)
AT08154997T 2007-04-23 2008-04-23 System und verfahren zur erkennung eines bösartigen programmcodes ATE512538T1 (de)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US11/738,703 US9246938B2 (en) 2007-04-23 2007-04-23 System and method for detecting malicious mobile program code

Publications (1)

Publication Number Publication Date
ATE512538T1 true ATE512538T1 (de) 2011-06-15

Family

ID=39639470

Family Applications (1)

Application Number Title Priority Date Filing Date
AT08154997T ATE512538T1 (de) 2007-04-23 2008-04-23 System und verfahren zur erkennung eines bösartigen programmcodes

Country Status (3)

Country Link
US (1) US9246938B2 (de)
EP (1) EP1986399B1 (de)
AT (1) ATE512538T1 (de)

Families Citing this family (87)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007050244A2 (en) 2005-10-27 2007-05-03 Georgia Tech Research Corporation Method and system for detecting and responding to attacking networks
US7797746B2 (en) 2006-12-12 2010-09-14 Fortinet, Inc. Detection of undesired computer files in archives
US8863286B1 (en) 2007-06-05 2014-10-14 Sonicwall, Inc. Notification for reassembly-free file scanning
US8826034B1 (en) * 2007-09-28 2014-09-02 Symantec Corporation Selective revocation of heuristic exemption for content with digital signatures
US8341200B2 (en) * 2008-06-12 2012-12-25 Pomian & Corella, Llc Protecting a web application against attacks through shared files
US10027688B2 (en) 2008-08-11 2018-07-17 Damballa, Inc. Method and system for detecting malicious and/or botnet-related domain names
CN105897702B (zh) * 2008-11-07 2019-03-19 华为技术有限公司 一种媒体网关实现包过滤的方法及媒体网关
US20100192222A1 (en) * 2009-01-23 2010-07-29 Microsoft Corporation Malware detection using multiple classifiers
US7603713B1 (en) * 2009-03-30 2009-10-13 Kaspersky Lab, Zao Method for accelerating hardware emulator used for malware detection and analysis
US8863282B2 (en) * 2009-10-15 2014-10-14 Mcafee Inc. Detecting and responding to malware using link files
US8302194B2 (en) * 2009-10-26 2012-10-30 Symantec Corporation Using file prevalence to inform aggressiveness of behavioral heuristics
US8713681B2 (en) * 2009-10-27 2014-04-29 Mandiant, Llc System and method for detecting executable machine instructions in a data stream
US8458774B2 (en) * 2009-11-02 2013-06-04 Authentify Inc. Method for secure site and user authentication
US8578497B2 (en) 2010-01-06 2013-11-05 Damballa, Inc. Method and system for detecting malware
US8505094B1 (en) * 2010-01-13 2013-08-06 Trend Micro, Inc. Detection of malicious URLs in a web page
US8826438B2 (en) 2010-01-19 2014-09-02 Damballa, Inc. Method and system for network-based detecting of malware from behavioral clustering
US8813232B2 (en) * 2010-03-04 2014-08-19 Mcafee Inc. Systems and methods for risk rating and pro-actively detecting malicious online ads
US9213838B2 (en) 2011-05-13 2015-12-15 Mcafee Ireland Holdings Limited Systems and methods of processing data associated with detection and/or handling of malware
WO2011127488A2 (en) 2010-04-08 2011-10-13 Lynux Works, Inc. Systems and methods of processing data associated with detection and/or handling of malware
US8914879B2 (en) 2010-06-11 2014-12-16 Trustwave Holdings, Inc. System and method for improving coverage for web code
US8510829B2 (en) * 2010-06-24 2013-08-13 Mcafee, Inc. Systems and methods to detect malicious media files
US9516058B2 (en) 2010-08-10 2016-12-06 Damballa, Inc. Method and system for determining whether domain names are legitimate or malicious
US8631489B2 (en) 2011-02-01 2014-01-14 Damballa, Inc. Method and system for detecting malicious domain names at an upper DNS hierarchy
US8713679B2 (en) 2011-02-18 2014-04-29 Microsoft Corporation Detection of code-based malware
US8555388B1 (en) 2011-05-24 2013-10-08 Palo Alto Networks, Inc. Heuristic botnet detection
US8966625B1 (en) 2011-05-24 2015-02-24 Palo Alto Networks, Inc. Identification of malware sites using unknown URL sites and newly registered DNS addresses
US9323928B2 (en) * 2011-06-01 2016-04-26 Mcafee, Inc. System and method for non-signature based detection of malicious processes
US9129123B2 (en) 2011-06-13 2015-09-08 Lynx Software Technologies, Inc. Systems and methods of secure domain isolation involving separation kernel features
US8893278B1 (en) 2011-07-12 2014-11-18 Trustwave Holdings, Inc. Detecting malware communication on an infected computing device
US8874579B2 (en) 2011-08-18 2014-10-28 Verisign, Inc. Systems and methods for identifying associations between malware samples
US8782792B1 (en) * 2011-10-27 2014-07-15 Symantec Corporation Systems and methods for detecting malware on mobile platforms
US8510841B2 (en) * 2011-12-06 2013-08-13 Raytheon Company Detecting malware using patterns
US9038185B2 (en) 2011-12-28 2015-05-19 Microsoft Technology Licensing, Llc Execution of multiple execution paths
US8533836B2 (en) * 2012-01-13 2013-09-10 Accessdata Group, Llc Identifying software execution behavior
CA2874489A1 (en) * 2012-05-09 2013-11-14 SunStone Information Defense Inc. Methods and apparatus for identifying and removing malicious applications
WO2013184653A1 (en) * 2012-06-04 2013-12-12 Board Of Regents, The University Of Texas System Method and system for resilient and adaptive detection of malicious websites
US8819772B2 (en) * 2012-06-25 2014-08-26 Appthority, Inc. In-line filtering of insecure or unwanted mobile device software components or communications
EP4036721B1 (de) 2012-06-26 2025-03-26 Lynx Software Technologies Inc. Systeme und verfahren mit hardware-virtualisierungsfunktionen wie trennungskernel-hypervisoren, hypervisoren, hypervisor-gast-kontext, hypervisorkontext, rootkit-erkennungsprävention und anderen funktionen
US10547674B2 (en) 2012-08-27 2020-01-28 Help/Systems, Llc Methods and systems for network flow analysis
US9894088B2 (en) 2012-08-31 2018-02-13 Damballa, Inc. Data mining to identify malicious activity
US9680861B2 (en) 2012-08-31 2017-06-13 Damballa, Inc. Historical analysis to identify malicious activity
US10084806B2 (en) 2012-08-31 2018-09-25 Damballa, Inc. Traffic simulation to identify malicious activity
US9166994B2 (en) 2012-08-31 2015-10-20 Damballa, Inc. Automation discovery to identify malicious activity
US9104870B1 (en) * 2012-09-28 2015-08-11 Palo Alto Networks, Inc. Detecting malware
US9215239B1 (en) 2012-09-28 2015-12-15 Palo Alto Networks, Inc. Malware detection based on traffic analysis
RU2514142C1 (ru) 2012-12-25 2014-04-27 Закрытое акционерное общество "Лаборатория Касперского" Способ повышения эффективности работы аппаратного ускорения эмуляции приложений
US9471783B2 (en) 2013-03-15 2016-10-18 Mcafee, Inc. Generic unpacking of applications for malware detection
US9571511B2 (en) 2013-06-14 2017-02-14 Damballa, Inc. Systems and methods for traffic classification
US9336025B2 (en) 2013-07-12 2016-05-10 The Boeing Company Systems and methods of analyzing a software component
US9280369B1 (en) 2013-07-12 2016-03-08 The Boeing Company Systems and methods of analyzing a software component
US9396082B2 (en) 2013-07-12 2016-07-19 The Boeing Company Systems and methods of analyzing a software component
US9852290B1 (en) 2013-07-12 2017-12-26 The Boeing Company Systems and methods of analyzing a software component
US9811665B1 (en) 2013-07-30 2017-11-07 Palo Alto Networks, Inc. Static and dynamic security analysis of apps for mobile devices
US9613210B1 (en) 2013-07-30 2017-04-04 Palo Alto Networks, Inc. Evaluating malware in a virtual machine using dynamic patching
US10019575B1 (en) 2013-07-30 2018-07-10 Palo Alto Networks, Inc. Evaluating malware in a virtual machine using copy-on-write
TWI515598B (zh) * 2013-08-23 2016-01-01 國立交通大學 產生純化惡意程式的方法、偵測惡意程式之方法及其系統
US9479521B2 (en) 2013-09-30 2016-10-25 The Boeing Company Software network behavior analysis and identification system
WO2015100327A1 (en) * 2013-12-26 2015-07-02 Mcafee, Inc. Generic unpacking of program binaries
WO2015176046A1 (en) 2014-05-15 2015-11-19 Lynx Software Technologies, Inc. Systems and methods involving features of hardware virtualization, hypervisor, apis of interest, and/or other features
WO2016004263A1 (en) 2014-07-01 2016-01-07 Lynx Software Technologies, Inc. Systems and methods involving aspects of hardware virtualization such as separation kernel hypervisors, hypervisors, hypervisor guest context, hypervisor context, anti-fingerprinting, and/or other features
US9390267B2 (en) 2014-05-15 2016-07-12 Lynx Software Technologies, Inc. Systems and methods involving features of hardware virtualization, hypervisor, pages of interest, and/or other features
WO2015176048A1 (en) 2014-05-15 2015-11-19 Lynx Software Technologies, Inc. Aspects of hardware virtualization, hypervisors, code detection
US11782745B2 (en) 2014-07-01 2023-10-10 Lynx Software Technologies, Inc. Systems and methods involving aspects of hardware virtualization such as separation kernel hypervisors, hypervisors, hypervisor guest context, hypervisor context, anti-fingerprinting and/or other features
US9489516B1 (en) 2014-07-14 2016-11-08 Palo Alto Networks, Inc. Detection of malware using an instrumented virtual machine environment
US10079876B1 (en) 2014-09-30 2018-09-18 Palo Alto Networks, Inc. Mobile URL categorization
US9542554B1 (en) 2014-12-18 2017-01-10 Palo Alto Networks, Inc. Deduplicating malware
US9805193B1 (en) 2014-12-18 2017-10-31 Palo Alto Networks, Inc. Collecting algorithmically generated domains
US9930065B2 (en) 2015-03-25 2018-03-27 University Of Georgia Research Foundation, Inc. Measuring, categorizing, and/or mitigating malware distribution paths
US10019572B1 (en) 2015-08-27 2018-07-10 Amazon Technologies, Inc. Detecting malicious activities by imported software packages
US10032031B1 (en) 2015-08-27 2018-07-24 Amazon Technologies, Inc. Detecting unknown software vulnerabilities and system compromises
US10200391B2 (en) * 2015-09-23 2019-02-05 AVAST Software s.r.o. Detection of malware in derived pattern space
US10210331B2 (en) * 2015-12-24 2019-02-19 Mcafee, Llc Executing full logical paths for malware detection
US9894085B1 (en) * 2016-03-08 2018-02-13 Symantec Corporation Systems and methods for categorizing processes as malicious
US11314862B2 (en) * 2017-04-17 2022-04-26 Tala Security, Inc. Method for detecting malicious scripts through modeling of script structure
US11010474B2 (en) 2018-06-29 2021-05-18 Palo Alto Networks, Inc. Dynamic analysis techniques for applications
US10956573B2 (en) 2018-06-29 2021-03-23 Palo Alto Networks, Inc. Dynamic analysis techniques for applications
CN110768943A (zh) * 2018-09-20 2020-02-07 哈尔滨安天科技集团股份有限公司 一种多态url检测方法、装置及存储介质
US11106791B2 (en) 2018-10-01 2021-08-31 Blackberry Limited Determining security risks in binary software code based on network addresses
US11347850B2 (en) * 2018-10-01 2022-05-31 Blackberry Limited Analyzing binary software code
US10984102B2 (en) 2018-10-01 2021-04-20 Blackberry Limited Determining security risks in binary software code
US11580163B2 (en) 2019-08-16 2023-02-14 Palo Alto Networks, Inc. Key-value storage for URL categorization
US11748433B2 (en) 2019-08-16 2023-09-05 Palo Alto Networks, Inc. Communicating URL categorization information
US11196765B2 (en) 2019-09-13 2021-12-07 Palo Alto Networks, Inc. Simulating user interactions for malware analysis
CN113672919A (zh) * 2021-08-05 2021-11-19 支付宝(杭州)信息技术有限公司 基于小程序动静态分析的风险检测方法、装置以及设备
US12153713B1 (en) * 2022-03-23 2024-11-26 Gen Digital Inc. Systems and methods for protecting user data privacy by detecting the extension of tracker coverage of website browsing sessions through indirect data disclosure
US12483588B2 (en) 2023-01-31 2025-11-25 Cisco Technology, Inc. Web analyzer engine for identifying security-related threats
US12417286B2 (en) * 2023-01-31 2025-09-16 Splunk Inc. Automated attack chain following by a threat analysis platform

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6085229A (en) * 1998-05-14 2000-07-04 Belarc, Inc. System and method for providing client side personalization of content of web pages and the like
US6615242B1 (en) * 1998-12-28 2003-09-02 At&T Corp. Automatic uniform resource locator-based message filter
US7096500B2 (en) * 2001-12-21 2006-08-22 Mcafee, Inc. Predictive malware scanning of internet data
US20060190561A1 (en) * 2002-06-19 2006-08-24 Watchfire Corporation Method and system for obtaining script related information for website crawling
US7421498B2 (en) * 2003-08-25 2008-09-02 Microsoft Corporation Method and system for URL based filtering of electronic communications and web pages
US7664819B2 (en) 2004-06-29 2010-02-16 Microsoft Corporation Incremental anti-spam lookup and update service
US20060075468A1 (en) * 2004-10-01 2006-04-06 Boney Matthew L System and method for locating malware and generating malware definitions
US20060075494A1 (en) * 2004-10-01 2006-04-06 Bertman Justin R Method and system for analyzing data for potential malware
US7287279B2 (en) * 2004-10-01 2007-10-23 Webroot Software, Inc. System and method for locating malware
US8438499B2 (en) * 2005-05-03 2013-05-07 Mcafee, Inc. Indicating website reputations during user interactions
JP4880675B2 (ja) * 2005-05-05 2012-02-22 シスコ アイアンポート システムズ エルエルシー 参照リソースの確率的解析に基づく不要な電子メールメッセージの検出
WO2007117582A2 (en) * 2006-04-06 2007-10-18 Smobile Systems Inc. Malware detection system and method for mobile platforms
US9654495B2 (en) * 2006-12-01 2017-05-16 Websense, Llc System and method of analyzing web addresses

Also Published As

Publication number Publication date
EP1986399B1 (de) 2011-06-08
US9246938B2 (en) 2016-01-26
EP1986399A1 (de) 2008-10-29
US20080263659A1 (en) 2008-10-23

Similar Documents

Publication Publication Date Title
ATE465587T1 (de) System und verfahren zur analyse von web-adressen
WO2004088483A3 (en) System for and method of detecting malware in macros and executable scripts
WO2007005524A3 (en) Systems and methods for identifying malware distribution sites
EP1814055A3 (de) Verbessertes Verfahren und System zur Detektion bösartiger Verhaltensstrukturen bei einem Computer unter Verwendung von maschinellem Lernen
EP1788938A4 (de) System, software und verfahren zur detektion von schlafgestörter atmung mithilfe eines elektrokardiogramms
ATE232616T1 (de) Verfahren zur überwachung des programmablaufs
US20150128272A1 (en) System and method for finding phishing website
WO2007044388A3 (en) Computer behavioral management using heuristic analysis
ATE555430T1 (de) Systeme und verfahren für computersicherheit
WO2008091947A3 (en) System and method for detection and analysis of speech
EP1843348A4 (de) Av-verarbeitungsvorrichtung, av-verarbeitungsverfahren und -programm
DE602006002489D1 (de) Verfahren zur erleichterung eines bohrlochbetriebes
EP1783580A4 (de) Java-applet, jar-dateierzeugungsverfahren, jar-dateierzeugungsprogramm und jar-dateierzeugungseinrichtung
EP1848178A4 (de) Einrichtung, system, verfahren, programm und schaltung zur kommunikation
EP1768302A4 (de) Datenuntersuchungseinrichtung, datenuntersuchungsverfahren und datenuntersuchungsprogramm
ATE546930T1 (de) System, verfahren und computerprogramm zur kommunikationsänderung
WO2008114245A3 (en) System and method for identification, prevention and management of web-sites defacement attacks
EP2128768A4 (de) Detektionseinrichtung, system, programm und detektionsverfahren
ATE550726T1 (de) Verfahren und vorrichtung zur detektion eines fehlerinjektion
ATE397098T1 (de) Verfahren zur diagnostik von eierstock endometriose
DE602006012292D1 (de) Verfahren zur datenverarbeitung mit modularer potenzierung und dazugehörige vorrichtung
WO2010024606A3 (ko) 정상 파일 데이터베이스 제공 시스템 및 방법
ATE446355T1 (de) Verfahren zur selektiven entfernung von safrol aus muskatöl
DE602006016726D1 (de) Biologische Detektionsvorrichtung, Vorrichtung zur Authentifizierung von Fingerabdrücken und biologisches Detektionsverfahren
EP1821172A4 (de) Kollationsverfahren, kollationssystem, computer und programm

Legal Events

Date Code Title Description
RER Ceased as to paragraph 5 lit. 3 law introducing patent treaties