Information security – Monitoring or scanning of software or data including attack... – Intrusion detection
Reexamination Certificate
2011-05-03
2011-05-03
Dinh, Minh (Department: 2432)
Information security
Monitoring or scanning of software or data including attack...
Intrusion detection
Reexamination Certificate
active
07937764
ABSTRACT:
The executions of computer viruses are analyzed to develop register signatures for the viruses. The register signatures specify the sets of outputs the viruses produce when executed with a given set of inputs. A virus detection system (VDS) (400) holds a database (430) of the register signatures. The VDS (400) selects (710) a file that might contain a computer virus and identifies potential entry points in the file. The VDS (400) uses a virtual machine (422) having an initial state to emulate (714) a relatively small number of instructions at each entry point. While emulating each potential entry point, the VDS builds (716) a register table that tracks the state of a subset of the virtual registers (428). Once the VDS (400) reaches an emulation breakpoint, it analyzes the register table in view of the register signatures to determine whether the file contains a virus.
REFERENCES:
patent: 5999723 (1999-12-01), Nachenberg
patent: 7146305 (2006-12-01), van der Made
patent: 7334263 (2008-02-01), Szor
patent: 7409717 (2008-08-01), Szor
patent: 2002/0056076 (2002-05-01), van der Made
patent: WO 99/15966 (1999-04-01), None
patent: WO 01/69356 (2001-09-01), None
patent: WO 02/35328 (2002-05-01), None
Szor et al., “Hunting for Metamorphic”, Virus Bulletin Conference, Sep. 2001, pp. 123-143.
Szor, “The New 32-bit Medusa”, Virus Bulletin, Dec. 2000.
Chinese Office Action, Chinese Application No. 03811842.4, Apr. 4, 2008, 10 pages.
Chinese Office Action, Chinese Application No. 03811842.4, Sep. 26, 2009, 10 pages.
European Supplementary Search Report, European Application No. 03738966.5, Feb. 25, 2010, 3 pages.
Chinese Notification of Third Office Action, Chinese Application No. 03811842.4, Jun. 28, 2010, 11 pages.
European Examination Report, European Application No. 03738966.5, Dec. 28, 2010, 4 pages.
Dinh Minh
Fenwick & West LLP
Symantec Corporation
LandOfFree
Metamorphic computer virus detection does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Metamorphic computer virus detection, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Metamorphic computer virus detection will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2677262