Detection of malicious computer code

Details Detection of malicious computer code Detection of malicious computer code

2002-10-07

2008-12-23

Barron, Jr., Gilberto (Department: 2132)

Information security

Monitoring or scanning of software or data including attack...

Intrusion detection

Reexamination Certificate

active

07469419

ABSTRACT:
Systems, methods, and computer readable media for determining whether a computer file (210) has been infected with malicious code by an attacking agent. A scanning engine (205) determines whether the file (210) contains malicious code. The scanning engine (205) includes detection modules (325) for detecting particular attacking agents, and indicators of when particular attacking agents were first created. The scanning engine (205) determines a critical date for a file (210) with regards to a particular attacking agent. If the file (210) has not been changed since the critical date, the scanning engine (205) determines that the file (210) has not been infected by that attacking agent.

REFERENCES:
patent: 5398196 (1995-03-01), Chambers
patent: 5440723 (1995-08-01), Arnold et al.
patent: 5452442 (1995-09-01), Kephart
patent: 5473769 (1995-12-01), Cozza
patent: 5572590 (1996-11-01), Chess
patent: 5675710 (1997-10-01), Lewis
patent: 5696822 (1997-12-01), Nachenberg
patent: 5715174 (1998-02-01), Cotichini et al.
patent: 5715464 (1998-02-01), Crump et al.
patent: 5758359 (1998-05-01), Saxon
patent: 5812763 (1998-09-01), Teng
patent: 5826013 (1998-10-01), Nachenberg
patent: 5826249 (1998-10-01), Skeirik
patent: 5832208 (1998-11-01), Chen et al.
patent: 5854916 (1998-12-01), Nachenberg
patent: 5889943 (1999-03-01), Ji et al.
patent: 5949973 (1999-09-01), Yarom
patent: 5951698 (1999-09-01), Chen et al.
patent: 5956481 (1999-09-01), Walsh et al.
patent: 5960170 (1999-09-01), Chen et al.
patent: 5974549 (1999-10-01), Golan
patent: 5978917 (1999-11-01), Chi
patent: 5987610 (1999-11-01), Franczek et al.
patent: 6021510 (2000-02-01), Nachenberg
patent: 6023723 (2000-02-01), McCormick et al.
patent: 6052709 (2000-04-01), Paul et al.
patent: 6070244 (2000-05-01), Orchier et al.
patent: 6072830 (2000-06-01), Proctor et al.
patent: 6072942 (2000-06-01), Stockwell et al.
patent: 6088803 (2000-07-01), Tso et al.
patent: 6092194 (2000-07-01), Touboul
patent: 6094731 (2000-07-01), Waldin et al.
patent: 6104872 (2000-08-01), Kubota et al.
patent: 6108799 (2000-08-01), Boulay et al.
patent: 6130924 (2000-10-01), Rosenzweig et al.
patent: 6161130 (2000-12-01), Horvitz et al.
patent: 6167434 (2000-12-01), Pang
patent: 6192379 (2001-02-01), Bekenn
patent: 6199181 (2001-03-01), Rechef et al.
patent: 6253169 (2001-06-01), Apte et al.
patent: 6275938 (2001-08-01), Bond et al.
patent: 6298351 (2001-10-01), Castelli et al.
patent: 6338141 (2002-01-01), Wells
patent: 6347310 (2002-02-01), Passera
patent: 6357008 (2002-03-01), Nachenberg
patent: 6370526 (2002-04-01), Agrawal et al.
patent: 6370648 (2002-04-01), Diep
patent: 6397200 (2002-05-01), Lynch et al.
patent: 6397215 (2002-05-01), Kreulen et al.
patent: 6421709 (2002-07-01), McCormick et al.
patent: 6424960 (2002-07-01), Lee et al.
patent: 6442606 (2002-08-01), Subbaroyan et al.
patent: 6456991 (2002-09-01), Srinivasa et al.
patent: 6493007 (2002-12-01), Pang
patent: 6502082 (2002-12-01), Toyama et al.
patent: 6505167 (2003-01-01), Horvitz et al.
patent: 6535891 (2003-03-01), Fisher et al.
patent: 6552814 (2003-04-01), Okimoto et al.
patent: 6611925 (2003-08-01), Spear
patent: 6622150 (2003-09-01), Kouznetsov et al.
patent: 6662198 (2003-12-01), Satyanarayanan et al.
patent: 6678734 (2004-01-01), Haatainen et al.
patent: 6697950 (2004-02-01), Ko
patent: 6721721 (2004-04-01), Bates et al.
patent: 6735700 (2004-05-01), Flint et al.
patent: 6748534 (2004-06-01), Gryaznov et al.
patent: 6763462 (2004-07-01), Marsh
patent: 6813712 (2004-11-01), Luke
patent: 6851057 (2005-02-01), Nachenberg
patent: 6898715 (2005-05-01), Smithson et al.
patent: 6910134 (2005-06-01), Maher et al.
patent: 7010696 (2006-03-01), Cambridge et al.
patent: 7093239 (2006-08-01), van der Made
patent: 7093293 (2006-08-01), Smithson et al.
patent: 7096215 (2006-08-01), Bates et al.
patent: 7099916 (2006-08-01), Hericourt et al.
patent: 2001/0020272 (2001-09-01), Le Pennec et al.
patent: 2002/0004908 (2002-01-01), Galea
patent: 2002/0035693 (2002-03-01), Eyres et al.
patent: 2002/0035696 (2002-03-01), Thacker
patent: 2002/0038308 (2002-03-01), Cappi
patent: 2002/0046275 (2002-04-01), Crosbie et al.
patent: 2002/0073046 (2002-06-01), David
patent: 2002/0083175 (2002-06-01), Afek et al.
patent: 2002/0083343 (2002-06-01), Crosbie et al.
patent: 2002/0087649 (2002-07-01), Horvitz
patent: 2002/0087740 (2002-07-01), Castanho et al.
patent: 2002/0091940 (2002-07-01), Wellborn et al.
patent: 2002/0138525 (2002-09-01), Karadimitriou et al.
patent: 2002/0147694 (2002-10-01), Dempsey et al.
patent: 2002/0147782 (2002-10-01), Dimitrova et al.
patent: 2002/0157008 (2002-10-01), Radatti
patent: 2002/0162015 (2002-10-01), Tang
patent: 2002/0178374 (2002-11-01), Swimmer et al.
patent: 2002/0178375 (2002-11-01), Whittaker et al.
patent: 2002/0194488 (2002-12-01), Cormack et al.
patent: 2002/0199186 (2002-12-01), Ali et al.
patent: 2002/0199194 (2002-12-01), Ali
patent: 2003/0018903 (2003-01-01), Greca et al.
patent: 2003/0023865 (2003-01-01), Cowie et al.
patent: 2003/0033587 (2003-02-01), Ferguson et al.
patent: 2003/0051026 (2003-03-01), Carter et al.
patent: 2003/0065926 (2003-04-01), Schultz et al.
patent: 2003/0101381 (2003-05-01), Mateev et al.
patent: 2003/0105973 (2003-06-01), Liang et al.
patent: 2003/0115458 (2003-06-01), Song
patent: 2003/0115479 (2003-06-01), Edwards et al.
patent: 2003/0115485 (2003-06-01), Milliken
patent: 2003/0120951 (2003-06-01), Gartside et al.
patent: 2003/0126449 (2003-07-01), Kelly et al.
patent: 2003/0140049 (2003-07-01), Radatii
patent: 2003/0191966 (2003-10-01), Gleichauf
patent: 2003/0212902 (2003-11-01), van der Made
patent: 2003/0236995 (2003-12-01), Fretwell, Jr.
patent: 2004/0015712 (2004-01-01), Szor
patent: 2004/0015726 (2004-01-01), Szor
patent: 2004/0030913 (2004-02-01), Liang et al.
patent: 2004/0039921 (2004-02-01), Chuang
patent: 2004/0158730 (2004-08-01), Sarkar
patent: 2004/0162808 (2004-08-01), Margolus et al.
patent: 2004/0181687 (2004-09-01), Nachenberg et al.
patent: 2005/0021740 (2005-01-01), Bar et al.
patent: 2005/0044406 (2005-02-01), Stute
patent: 2005/0132205 (2005-06-01), Palliyil et al.
patent: 2005/0177736 (2005-08-01), De los Santos et al.
patent: 2005/0204150 (2005-09-01), Peikari
patent: 2006/0064755 (2006-03-01), Azadet et al.
patent: 2006/0161979 (2006-07-01), Pandey et al.
patent: 100 21 686 (2001-11-01), None
patent: 0636977 (1995-02-01), None
patent: 1 280 039 (2003-01-01), None
patent: 1408393 (2004-04-01), None
patent: 2 364 142 (2002-01-01), None
patent: WO 93/25024 (1993-12-01), None
patent: WO 97/39399 (1997-10-01), None
patent: WO 99/15966 (1999-04-01), None
patent: WO 00/28420 (2000-05-01), None
patent: WO 01/37095 (2001-05-01), None
patent: WO 01/91403 (2001-11-01), None
patent: WO 02/05072 (2002-01-01), None
patent: WO 02/33525 (2002-04-01), None
Szor, P. and Ferrie, P., “Hunting for Metamorphic”, Virus Bulletin Conference, Sep. 2001, Virus Bulletin Ltd., The Pentagon, Abingdon, Oxfordshire, England, pp. 123-144.
“News Release—Symantec Delivers Cutting-Edge Anti-Virus Technology with Striker32”, Oct. 1, 1999, 2 pages, [online]. Retrieved on Nov. 11, 2003. Retrieved from the Internet:<URL:http://www.symantec.com/press/1999
991001.html>. Author unknown.
Szor, P. and Ferrie, P., Attacks on Win32, Virus Bulletin Conference, Sep. 1998, Virus Bulletin Ltd., The Pentagon, Abingdon, Oxfordshire, England, pp. 57-84.
Szor, P. and Ferrie, P., “Attacks in Win32 Part II”, Virus Bulletin Conference, Sep. 2000, Virus Bulletin Ltd., The Pentagon, Abingdon, Oxfordshire, England, pp. 47-68.
Von Babo, Michael, “Zehn Mythnum Computerviren: Dichtug Und Wahrheit Uber Den Schrecken Des Informatkzeitlers,”Technische Kundschau, Hallwag, Bern CH vol. 84, No. 36. Sep. 4, 1992, pp. 44-47.
Delio, M., “Virus Throttle a Hopeful Defense”, Wired News, Dec. 9, 2002, retrieved from Internet Http://www.wired.com
ews/print/0,1294,56753,00.html Jan. 7, 2003.
“System File Protection and Windows ME”, [online], last updated Dec. 4, 2001, [retrieved on Apr. 9, 2

Affiliated with

Also associated with

Rating

Detection of malicious computer code does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Detection of malicious computer code, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Detection of malicious computer code will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-4023060