Source: https://patents.google.com/patent/US9754102B2/en
Timestamp: 2018-07-19 08:01:23
Document Index: 681635036

Matched Legal Cases: ['Application No. 05807741', 'Application No. 05807741', 'Application No. 1119949', 'Application No. 1119949', 'Application No. 1406624', 'Application No. 1406624', 'Application No. 1406624', 'Application No. 1406626', 'Application No. 1406626', 'Application No. 1406626', 'Application No. 2012', 'Application No. 2012', 'Application No. 2015', 'Application No. 2015']

US9754102B2 - Malware management through kernel detection during a boot sequence - Google Patents
Malware management through kernel detection during a boot sequence Download PDF
US9754102B2
US9754102B2 US14507657 US201414507657A US9754102B2 US 9754102 B2 US9754102 B2 US 9754102B2 US 14507657 US14507657 US 14507657 US 201414507657 A US201414507657 A US 201414507657A US 9754102 B2 US9754102 B2 US 9754102B2
US14507657
US20150089648A1 (en )
Jerome L. Schneider
A system and method for managing pestware on a protected computer is described. The method in one variation includes monitoring events during a boot sequence of the computer; managing pestware-related events before native applications can run and after a kernel is loaded; managing pestware-related events when native applications can run; and scanning a registry of the computer for pestware when native applications can run. In variations, a pestware management engine is initialized after an operating system of the protected computer is initialized and the pestware management system both receives an event log of the monitored events and compiles the set of behavior rules utilized by kernel-level monitor.
This application is a continuation of U.S. Pat. No. 8,856,505, filed Apr. 30, 2012, and entitled “Malware Management Through Kernel Detection During a Boot Sequence,” which application is a continuation of U.S. Pat. No. 8,190,868, filed Aug. 7, 2006, and entitled “Malware Management Through Kernel Detection,” each of which are incorporated herein by reference in their entireties.
This application is also related to U.S. patent application Ser. No. 10/956,578, entitled “System and Method for Monitoring Network Communications For Pestware,” and U.S. patent application Ser. No. 11/237,291, entitled “Client Side Exploit Tracking,” each of which are incorporated herein by reference in their entireties.
In one embodiment, the invention may be characterized as a method for managing pestware on a computer. The method in this embodiment includes monitoring events during a boot sequence of the computer; managing pestware-related events during a first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a subsystem of an operating system is loaded, and after a kernel is loaded; managing pestware-related events in accordance with a set of behavior rules during a second period in the boot sequence occurring when the computer is configured to run native applications; and scanning a registry of the computer for pestware during the second period in the boot sequence.
Referring now to the drawings, where like or similar elements are designated with identical reference numerals throughout the several views, and referring in particular to FIG. 1, it illustrates a block diagram 100 of one implementation of the present invention. This implementation includes four components: a kernel-level monitor 105, a pestware management engine 110, event storage 115 and behavior rule storage 120.
Referring first to the kernel-level monitor 105, in the exemplary embodiment it is responsible for detecting pestware or pestware activity on a protected computer or system. (The term “protected computer” is used to refer to any type of computer system, including personal computers, handheld computers, servers, firewalls, etc.) In several embodiments, the kernel-level monitor 105 begins execution early in the boot and operating system loading process on the protected computer, and as discussed further herein, the kernel-level monitor 105 obtains (e.g., in a secure manner), a most recent set of behavior rules from the behavior rules storage 120 that was previously compiled by the pestware management engine 110.
Referring next to FIG. 2, it is a flowchart of one method for managing pestware. In this method, a boot sequence of the protected computer is initiated (e.g., by a user of the protected computer) (Block 202), and in advance of a period when native applications (e.g., checkdisk) of the protected computer beginning execution, the kernel-level monitor 105 is initialized (Block 204).
During the time when the kernel-level monitor 105 is loaded and initialized, driver hooks and monitoring mechanisms that are utilized by the kernel-level monitor 105 are placed into the operating system kernel. Referring again to FIG. 4, this time period includes the time period depicted as “Event Snapshot and Rule Enforcement.” In the exemplary boot sequence depicted in FIG. 4, the kernel-level monitor 105 monitors events on an ongoing basis after being initialized early during the period in which the boot drivers are loaded.
In the exemplary embodiment, as the boot sequence continues, the kernel-level monitor 105 continues to run independently, collecting event log data (e.g., during the periods in which additional drivers are initialized and when native applications are capable of executing). As depicted in FIG. 4, as the boot sequence progresses, it is possible that a rootkit or another variety of pestware loads as a driver or service. In the context of a Windows operating system, for example, during the period that the native operating system starts the Win32 subsystem, it is possible that a rootkit or other pestware may toad as a driver or service. Events that are generated by such a pestware driver or service are monitored by the kernel-level monitor 105, added to the event log, and if the behavior rules include specific instance data indicating the event is a pestware-related event, the kernel-level monitor 105 denies or disables the rootkit's attempts to install.
In several embodiments, one of the tasks of the pestware management engine 110 is to communicate securely with the kernel-level monitor 105 so as to retrieve the event logs for examination and analysis (Block 216). In several embodiments, the event logs are compared against factors known o be associated with pestware so as to identify a likelihood that the events in the event log are pestware related events. In addition, the event tog may be sent to a centralized host, which collects information about activities at protected computers and generates weighted factors which are pushed out to the protected computers and utilized to help identify pestware at the protected computer. The above-identified application entitled Client Side Exploit Tracking includes details of techniques that may be used to identify pestware-related events from the event logs.
1. A device-comprising:
a memory encoding computer executable instructions that, when executed by the at least one processor, perform a method comprising:
monitoring events during a boot sequence of the computer; managing pestware-related events during a first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a subsystem of an operating system is loaded, and after a kernel is loaded;
managing pestware-related events in accordance with a set of behavior rules during a second period in the boot sequence occurring when the computer is configured to run native applications;
analyzing the record of events so as to identify the pestware-related events; modifying the set of behavior rules so as to prevent the pestware related events;
scanning a registry of the computer for pestware during the second period in the boot sequence.
2. The device of claim 1, wherein the method further comprises launching, after an operating system is initiated, a pestware management engine; and
wherein the set of behavior rules includes behavior rules compiled by the pestware management engine.
3. The device of claim 1, wherein the record of events includes information selected from the group consisting of: process identification information, file identification information, and hook generation information.
4. The device of claim 1, wherein the method further comprises managing pestware-related events after the computer becomes configured to run native applications.
5. The device of claim 1, wherein the monitoring includes monitoring the boot sequence while boot drivers are initiated.
6. A system for managing pestware on a computer comprising:
monitoring events during a boot sequence of the computer;
managing pestware-related events during first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a subsystem is loaded, and after a kernel is loaded;
modifying the set of behavior rules so as to prevent the pestware related events; and
7. The system of claim 6, wherein the method further comprises launching, after an operating system is initiated, a pestware management engine; and wherein the set of behavior rules includes behavior rules compiled by the pestware management engine.
8. The system of claim 6, wherein the record of events includes information selected from the group consisting of: process identification information, file identification information, and hook generation information.
9. The system of claim 6, wherein the method further comprises
managing pestware-related events after the computer becomes configured to run native applications.
10. The system of claim 6, wherein the method further comprises monitoring the boot sequence while boot drivers are initiated.
11. A hard drive comprising computer executable instructions that, when executed by at least one processor, perform a method comprising:
monitoring events during a boot sequence of a computer;
managing pestware-related events during a first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a subsystem is loaded, and after a kernel is loaded;
12. The hard drive of claim 11 further comprising program instructions for launching, after an operating system is initiated, a pestware management engine; and
13. The hard drive of claim 11, wherein the record of events includes information selected from the group consisting of: process identification information, file identification information, and hook generation information.
14. The hard drive of claim 11 further comprising program instructions for:
15. The hard drive of claim 11, wherein the monitoring includes monitoring the boot sequence while boot drivers are initiated.
US14507657 2006-08-07 2014-10-06 Malware management through kernel detection during a boot sequence Active US9754102B2 (en)
US11462827 US8190868B2 (en) 2006-08-07 2006-08-07 Malware management through kernel detection
US13460655 US8856505B2 (en) 2006-08-07 2012-04-30 Malware management through kernel detection during a boot sequence
US14507657 US9754102B2 (en) 2006-08-07 2014-10-06 Malware management through kernel detection during a boot sequence
US13460655 Continuation US8856505B2 (en) 2006-08-07 2012-04-30 Malware management through kernel detection during a boot sequence
US20150089648A1 true US20150089648A1 (en) 2015-03-26
US9754102B2 true US9754102B2 (en) 2017-09-05
ID=39030780
US11462827 Active 2029-04-06 US8190868B2 (en) 2006-08-07 2006-08-07 Malware management through kernel detection
US13460655 Active 2026-08-31 US8856505B2 (en) 2006-08-07 2012-04-30 Malware management through kernel detection during a boot sequence
US14507657 Active US9754102B2 (en) 2006-08-07 2014-10-06 Malware management through kernel detection during a boot sequence
US (3) US8190868B2 (en)
US7921461B1 (en) * 2007-01-16 2011-04-05 Kaspersky Lab, Zao System and method for rootkit detection and cure
JP5200085B2 (en) * 2010-11-04 2013-05-15 レノボ・シンガポール・プライベート・リミテッド Methods and computer to start the computer in a short time
WO2012154664A3 (en) * 2011-05-06 2013-03-21 University Of North Carolina At Chapel Hill Methods, systems, and computer readable media for detecting injected machine code
CN103679013B (en) * 2012-09-03 2017-10-31 腾讯科技（深圳）有限公司 The system method and apparatus for detecting malware
US9871809B2 (en) 2013-08-26 2018-01-16 Shine Security Ltd. Reversion of system objects affected by a malware
US9942246B2 (en) * 2013-09-02 2018-04-10 Shine Security Ltd. Preemptive event handling
US20150163109A1 (en) * 2013-12-05 2015-06-11 Crowdstrike, Inc. Rpc call interception
EP3123390A4 (en) * 2014-03-27 2017-10-25 Barkly Protects Inc Malicious software identification integrating behavioral analytics and hardware events
US9876852B2 (en) 2015-07-23 2018-01-23 Microsoft Technology Licensing, Llc Coordinating actions across platforms
US5802275A (en) 1994-06-22 1998-09-01 Lucent Technologies Inc. Isolation of non-secure software from secure software to limit virus infection
US5930467A (en) 1995-12-22 1999-07-27 Ricoh Company, Ltd. Information processing apparatus having a reduced access time to storage devices
US6118705A (en) 1998-03-13 2000-09-12 Atmel Corporation Page mode erase in a flash memory array
US20010029511A1 (en) 1999-12-30 2001-10-11 Peter Burda Data processing apparatus
US20020120871A1 (en) 2000-07-14 2002-08-29 Watkins Robert G. Identifying unauthorized communication systems based on their memory contents
WO2002084482A1 (en) 2001-04-12 2002-10-24 W. Quinn, Inc. System and method for using memory mapping to scan a master file table
US20020166059A1 (en) 2001-05-01 2002-11-07 Rickey Albert E. Methods and apparatus for protecting against viruses on partitionable media
US6496913B1 (en) 2000-02-22 2002-12-17 Hewlett-Packard Company System and method for detecting and correcting fragmentation on optical storage media
US20030005183A1 (en) 2001-06-29 2003-01-02 International Business Machines Corporation Methods and apparatus in a logging system for the adaptive logger replacement in order to receive pre-boot information
US20030046558A1 (en) 2001-09-06 2003-03-06 Teblyashkin Ivan Alexandrovich Automatic builder of detection and cleaning routines for computer viruses
US20030051057A1 (en) 2001-08-10 2003-03-13 Garnett Paul J. Edge protection
US20030074573A1 (en) 2001-10-15 2003-04-17 Hursey Nell John Malware scanning of compressed computer files
US20030097409A1 (en) 2001-10-05 2003-05-22 Hungchou Tsai Systems and methods for securing computers
US20030105973A1 (en) 2001-12-04 2003-06-05 Trend Micro Incorporated Virus epidemic outbreak command system and method using early warning monitors in a network environment
CN1423271A (en) 2001-12-03 2003-06-11 英业达股份有限公司 Method and system for computing fragment rate of magnetic disc
US20030110391A1 (en) 2001-12-06 2003-06-12 Wolff Daniel Joseph Techniques for performing malware scanning of files stored within a file storage device of a computer network
US20030120947A1 (en) 2001-12-26 2003-06-26 Moore Robert Edward Identifying malware containing computer files using embedded text
US20030120952A1 (en) 2001-12-26 2003-06-26 Tarbotton Lee Codel Lawson Malware scanning to create clean storage locations
US20030196103A1 (en) 2001-12-14 2003-10-16 Jonathan Edwards Method and system for delayed write scanning for detecting computer malwares
US20030217286A1 (en) 2002-04-13 2003-11-20 Itshak Carmona System and method for detecting malicious code
US20040003290A1 (en) 2002-06-27 2004-01-01 International Business Machines Corporation Firewall protocol providing additional information
US6681972B1 (en) 2002-03-19 2004-01-27 J&C Tapocik, Inc. Hands-free holder which will hold an airline ticket, an identification, credit cards and cash while worn around a user's neck
US20040024864A1 (en) 2002-07-31 2004-02-05 Porras Phillip Andrew User, process, and application tracking in an intrusion detection system
US20040068664A1 (en) 2002-10-07 2004-04-08 Carey Nachenberg Selective detection of malicious computer code
US20040133790A1 (en) 2003-01-06 2004-07-08 Hensley John Alan Protected, hidden emergency boot directory
US20040143661A1 (en) 2003-01-14 2004-07-22 Akio Higashi Content history log collecting system
US20040199827A1 (en) 2003-04-01 2004-10-07 Muttik Igor Garrievich Malware detection uswing external core characteristics
US20040243829A1 (en) 2003-05-29 2004-12-02 Computer Associates Think, Inc. System and method for computer virus detection utilizing heuristic analysis
US20040255165A1 (en) 2002-05-23 2004-12-16 Peter Szor Detecting viruses using register state
US20040268315A1 (en) 2003-06-27 2004-12-30 Eric Gouriou System and method for processing breakpoint events in a child process generated by a parent process
US20050021994A1 (en) 2003-07-21 2005-01-27 Barton Christopher Andrew Pre-approval of computer files during a malware detection
US20050027686A1 (en) 2003-04-25 2005-02-03 Alexander Shipp Method of, and system for, heuristically detecting viruses in executable code
US20050039029A1 (en) 2002-08-14 2005-02-17 Alexander Shipp Method of, and system for, heuristically detecting viruses in executable code
US20050055558A1 (en) 2001-10-31 2005-03-10 Itshak Carmona Memory scanning system and method
US20050071624A1 (en) 2003-09-29 2005-03-31 Rothman Michael A. Providing a self-describing media for a computer system
US20050071649A1 (en) 2003-04-03 2005-03-31 Alexander Shipp System for and method of detecting malware in macros and executable scripts
US20050081053A1 (en) 2003-10-10 2005-04-14 International Business Machines Corlporation Systems and methods for efficient computer virus detection
US20050132177A1 (en) 2003-12-12 2005-06-16 International Business Machines Corporation Detecting modifications made to code placed in memory by the POST BIOS
US20050155031A1 (en) 2004-01-10 2005-07-14 Microsoft Corporation Changed file identification, software conflict resolution and unwanted file removal
US20050154900A1 (en) 2004-01-13 2005-07-14 Networks Associates Technology, Inc. Detecting malicious computer program activity using external program calls with dynamic rule sets
US20050172337A1 (en) 2004-01-30 2005-08-04 Bodorin Daniel M. System and method for unpacking packed executables for malware evaluation
US20050177868A1 (en) 2003-07-11 2005-08-11 Computer Associates Think, Inc. Method and system for protecting against computer viruses
US6931540B1 (en) 2000-05-31 2005-08-16 Networks Associates Technology, Inc. System, method and computer program product for selecting virus detection actions based on a process by which files are being accessed
US20050204205A1 (en) 2004-02-26 2005-09-15 Ring Sandra E. Methodology, system, and computer readable medium for detecting operating system exploitations
US20050204050A1 (en) 2004-03-10 2005-09-15 Patrick Turley Method and system for controlling network access
US20050223238A1 (en) 2003-09-26 2005-10-06 Schmid Matthew N Methods for identifying malicious software
US6959441B2 (en) 2000-05-09 2005-10-25 International Business Machines Corporation Intercepting system API calls
US20050262567A1 (en) 2004-05-19 2005-11-24 Itshak Carmona Systems and methods for computer security
US20050268112A1 (en) 2004-05-28 2005-12-01 Microsoft Corporation Managing spyware and unwanted software through auto-start extensibility points
US20050278783A1 (en) 2004-06-14 2005-12-15 Lionic Corporation System security approaches using multiple processing units
US20050278785A1 (en) 2004-06-09 2005-12-15 Philip Lieberman System for selective disablement and locking out of computer system objects
US20050283838A1 (en) 2003-02-26 2005-12-22 Secure Ware Inc. Malicious-process-determining method, data processing apparatus and recording medium
US20060020779A1 (en) 2004-06-17 2006-01-26 Rothman Michael A Establishing a virtual drive accessible to pre-boot and operating system runtime phases
US20060031667A1 (en) 2000-08-28 2006-02-09 Raghunandan Hulikunta P Method, apparatus and computer program product to check e-mail count at boot time in computing systems
US20060041942A1 (en) 2004-06-24 2006-02-23 Mcafee, Inc. System, method and computer program product for preventing spyware/malware from installing a registry
US20060075468A1 (en) 2004-10-01 2006-04-06 Boney Matthew L System and method for locating malware and generating malware definitions
WO2006039351A2 (en) 2004-10-01 2006-04-13 Webroot Software, Inc. System and method for locating malware
US20060095967A1 (en) 2004-10-29 2006-05-04 David Durham Platform-based identification of host software circumvention
US20060101282A1 (en) 2004-11-08 2006-05-11 Microsoft Corporation System and method of aggregating the knowledge base of antivirus software applications
US20060101263A1 (en) 2004-11-08 2006-05-11 Microsoft Corporation System and method of allowing user mode applications with access to file data
US20060112235A1 (en) 2004-11-19 2006-05-25 Cabot Mason B Matching memory transactions to cache line boundaries
US20060129744A1 (en) 2004-12-13 2006-06-15 Rothman Michael A Method and apparatus for enabling non-volatile content filtering
US7065790B1 (en) 2001-12-21 2006-06-20 Mcafee, Inc. Method and system for providing computer malware names from multiple anti-virus scanners
US20060161793A1 (en) 2005-01-14 2006-07-20 Ati Technologies, Inc. Apparatus and methods for power management of a circuit module
US20060167948A1 (en) 2005-01-26 2006-07-27 Gian-Nicolas Pietravalle Detection of computer system malware
US20060168165A1 (en) 2005-01-22 2006-07-27 Boss Gregory J Provisional application management with automated acceptance tests and decision criteria
WO2006077443A2 (en) 2005-01-20 2006-07-27 William Grant Rothwell Computer protection against malware affection
US20060184792A1 (en) 2005-02-17 2006-08-17 Scalable Software Protecting computer systems from unwanted software
US20060218637A1 (en) 2005-03-24 2006-09-28 Microsoft Corporation System and method of selectively scanning a file on a computing device for malware
US20060230290A1 (en) 2005-04-12 2006-10-12 Michael Burtscher System and method for accessing data from a data storage medium
US20060230291A1 (en) 2005-04-12 2006-10-12 Michael Burtscher System and method for directly accessing data from a data storage medium
US20060236389A1 (en) 2005-04-14 2006-10-19 Horne Jefferson D System and method for scanning memory for pestware
US20060236397A1 (en) 2005-04-14 2006-10-19 Horne Jefferson D System and method for scanning obfuscated files for pestware
US20060236069A1 (en) 2005-04-15 2006-10-19 Microsoft Corporation Method and system for efficient generation of storage reports
US20060259974A1 (en) 2005-05-16 2006-11-16 Microsoft Corporation System and method of opportunistically protecting a computer from malware
US20060294590A1 (en) 2005-06-27 2006-12-28 Enstone Mark R Automated immune response for a computer
US20070006310A1 (en) 2005-06-30 2007-01-04 Piccard Paul L Systems and methods for identifying malware distribution sites
US20070016914A1 (en) 2005-07-13 2007-01-18 Yuen-Pin Yeap Kernel validation layer
US20070039052A1 (en) 2005-08-12 2007-02-15 Computer Associates Think, Inc. System and method for scanning handles
US20070094725A1 (en) 2005-10-21 2007-04-26 Borders Kevin R Method, system and computer program product for detecting security threats in a computer network
US20070094733A1 (en) 2005-10-26 2007-04-26 Wilson Michael C System and method for neutralizing pestware residing in executable memory
US20070101431A1 (en) 2005-10-31 2007-05-03 Microsoft Corporation Identifying malware that employs stealth techniques
US7216367B2 (en) 2003-02-21 2007-05-08 Symantec Corporation Safe memory scanning
JP2007122692A (en) 2005-09-30 2007-05-17 Trend Micro Inc Security management device, communication system and access control method
US20070143843A1 (en) 2005-12-16 2007-06-21 Eacceleration Corporation Computer virus and malware cleaner
US20070169198A1 (en) 2006-01-18 2007-07-19 Phil Madddaloni System and method for managing pestware affecting an operating system of a computer
US20070174911A1 (en) 2006-01-25 2007-07-26 Novatix Corporation File origin determination
US20070179834A1 (en) 2006-02-01 2007-08-02 Novell, Inc. Federation and attestation of online reputations
US7257595B2 (en) 2000-03-30 2007-08-14 Microsoft Corporation Transactional file system
US20070203884A1 (en) 2006-02-28 2007-08-30 Tony Nichols System and method for obtaining file information and data locations
US20070220043A1 (en) 2006-03-17 2007-09-20 Pc Tools Technology Pty Limited Determination of related entities
US20070226704A1 (en) 2006-03-22 2007-09-27 Tony Nichols Method and system for rendering harmless a locked pestware executable object
US7284020B2 (en) 2004-09-01 2007-10-16 Hitachi, Ltd. System and method for data recovery in a storage system
US7302584B2 (en) 2001-03-16 2007-11-27 Mcafee, Inc. Mechanisms for banning computer programs from use
US20070283439A1 (en) 2006-06-05 2007-12-06 Eacceleration Corporation Accelerated file scanning
US20080010326A1 (en) 2006-06-15 2008-01-10 Carpenter Troy A Method and system for securely deleting files from a computer storage device
WO2008008142A2 (en) 2006-07-12 2008-01-17 Kofax Image Products, Inc. Machine learning techniques and transductive data classification
US20080021958A1 (en) 2006-07-18 2008-01-24 David Foote System and method for peer-to-peer internet communication
US20080097936A1 (en) 2006-07-12 2008-04-24 Schmidtler Mauritius A R Methods and systems for transductive data classification
US7380136B2 (en) 2003-06-25 2008-05-27 Intel Corp. Methods and apparatus for secure collection and display of user interface information in a pre-boot environment
US7383299B1 (en) 2000-05-05 2008-06-03 International Business Machines Corporation System and method for providing service for searching web site addresses
US7406466B2 (en) 2005-01-14 2008-07-29 Yahoo! Inc. Reputation based search
US20090006569A1 (en) 2007-06-28 2009-01-01 Symantec Corporation Method and apparatus for creating predictive filters for messages
US7490352B2 (en) 2005-04-07 2009-02-10 Microsoft Corporation Systems and methods for verifying trust of executable files
US20090063248A1 (en) 2007-08-31 2009-03-05 Ebay Inc. Education system to improve online reputation
US20090178125A1 (en) 2008-01-03 2009-07-09 Credme Inc. Method and System for Creation and Validation of Anonymous Digital Credentials
US20090287641A1 (en) 2008-05-13 2009-11-19 Eric Rahm Method and system for crawling the world wide web
US20090299925A1 (en) 2008-05-30 2009-12-03 Ramaswamy Ganesh N Automatic Detection of Undesirable Users of an Online Communication Resource Based on Content Analytics
US20090300720A1 (en) 2008-05-30 2009-12-03 Microsoft Corporation Centralized account reputation
US7738373B2 (en) 2004-03-18 2010-06-15 At&T Intellectual Property Ii, L.P. Method and apparatus for rapid location of anomalies in IP traffic logs
US20100184505A1 (en) 2009-01-21 2010-07-22 Igt Tiered verification
US20110040825A1 (en) 2009-08-13 2011-02-17 Zulfikar Ramzan Using Confidence About User Intent In A Reputation System
US20110047076A1 (en) 2009-08-24 2011-02-24 Mark Carlson Alias reputation interaction system
US8321910B1 (en) 2005-01-21 2012-11-27 Trend Micro, Inc. Determining the source of malware
US8438386B2 (en) 2009-04-21 2013-05-07 Webroot Inc. System and method for developing a risk profile for an internet service
US7383581B1 (en) 2001-12-26 2008-06-03 Mcafee, Inc. Identifying malware containing computer files using embedded text
US7103913B2 (en) 2002-05-08 2006-09-05 International Business Machines Corporation Method and apparatus for determination of the non-replicative behavior of a malicious program
US20050229250A1 (en) 2004-02-26 2005-10-13 Ring Sandra E Methodology, system, computer readable medium, and product providing a security software suite for handling operating system exploitations
US20110167050A1 (en) 2004-12-03 2011-07-07 Fortinet, Inc. Secure system for allowing the execution of authorized computer program code
WO2007050766A2 (en) 2005-10-26 2007-05-03 Webroot Software, Inc. System and method for neutralizing pestware residing in executable memory
WO2007084947A2 (en) 2006-01-18 2007-07-26 Webroot Software, Inc. Systems and methods for neutralizing unauthorized attempts to monitor user activity
US8667586B2 (en) 2006-04-20 2014-03-04 Webroot Inc. Backward researching time stamped events to find an origin of pestware
US20110289587A1 (en) 2006-07-07 2011-11-24 Webroot Software, Inc. Method and system for detecting and removing hidden pestware files
US8856505B2 (en) 2006-08-07 2014-10-07 Webroot Inc. Malware management through kernel detection during a boot sequence
US8065514B2 (en) 2006-08-18 2011-11-22 Webroot Software, Inc. Method and system of file manipulation during early boot time using portable executable file reference
US8140839B2 (en) 2006-08-18 2012-03-20 Webroot Method and system of file manipulation during early boot time by accessing user-level data
Bai et al. (2012) IET Information Security 8(2):140-151 "Approach for malware identification using dynamic behaviour and outcome triggering".
Bontchev (1992) Virus Bulletin Conference 131-141 "Possible Virus Attacks Against Integrity Programs and How to Prevent Them".
Bruschi et al. (2000) IEEE 188-195 "Less Harm, Less Worry or How to Improve Network Security by Bounding System Offensiveness".
Clarke (2009) Department of Mathematics, University of London, Technical Report 178 pages "Fuzzing for Software Vulnerability Discovery".
Codeguru (2001) Hooking the Keyboard by Anoop Thomas, 6 pages.
Codeguru (2003) Three Ways to Inject Your Code into Another Process by Robert Kuster, 22 pages.
Codeguru (2004) Managing Low-Level Keyboard Hooks with the Windows API for VB Net by Paul Kimmel, 10 pages.
DATABASE EPODOC 1 January 1900 (1900-01-01), LIN GUANGXIN [CN]; LIU YABIN [CN]: "Method and system for computing fragment rate of magnetic disc", XP002451265, Database accession no. CN-01139859-A
DATABASE EPODOC 1 January 1900 (1900-01-01), LIN KUANG-SHIN ; LIU YA-BIN: "Method and system for calculating fragment rate of disk", XP002451266, Database accession no. TW-90117985-A
Egele, "A Survey on Automated Dynamic Malware-Analysis Techniques and Tools", Apr. 2012, ACM Computing Surveys, p. 6:1-6:42. *
Erbschole (2005) Elsevier Butterworth-Heinemann 185-189 "Trojans, Worms, and Spyware: A Computer Security Professional's Guide to Malicious Code".
European Patent Application No. 05807741.3, Communication dated Apr. 27, 2012, 6 pages.
European Patent Application No. 05807741.3, Search Report dated Feb. 15, 2012, 2 pages.
Fellows (2005) Digital Investigation 2:89-93 "The joys of complexity and the deleted file".
Gao, "Research on the working Mechanism of Bootkit", 2012, IEEE, pp. 476-479. *
Great Britain Patent Application No. 1119949.4, Examination Report dated Nov. 8, 2013, 3 pages.
Great Britain Patent Application No. 1119949.4, Notification of Grant dated Jun. 17, 2014, 2 pages.
Great Britain Patent Application No. 1406624.5, First Examination Report dated Jul. 31, 2014, 8 pages.
Great Britain Patent Application No. 1406624.5, Notification of Grant dated Jan. 27, 2015, 2 pages.
Great Britain Patent Application No. 1406624.5, Second Examination Report dated Dec. 31, 2014, 3 pages.
Great Britain Patent Application No. 1406626.0, First Examination Report dated Jul. 31, 2014, 10 pages.
Great Britain Patent Application No. 1406626.0, Notification of Grant dated Jan. 27, 2015, 2 pages.
Great Britain Patent Application No. 1406626.0, Second Examination Report dated Dec. 31, 2014, 4 pages.
Harley, et al. (2001) Osborne/McGraw-Hill 219-229 "Viruses Revealed".
Hruska (1997) European Conference on Security and Detection 128-131 "Virus Detection".
International Search Report and Written Opinion from Application No. PCT/US2006/008882, dated Oct. 19, 2007, 5 pages.
International Search Report and Written Opinion from Application No. PCT/US2006/014003, dated Jul. 17, 2007, 6 pages.
International Search Report and Written Opinion from Application No. PCT/US2006/014004, dated Jan. 22, 2007, 4 pages.
International Search Report and Written Opinion from Application No. PCT/US2006/014405, dated Nov. 29, 2007, 5 pages.
International Search Report and Written Opinion from Application No. PCT/US2007/062947, dated Jun. 29, 2007, 8 pages.
International Search Report and Written Opinion from Application No. PCT/US2007/064487, dated Nov. 30, 2007, 8 pages.
International Search Report and Written Opinion from Application No. PCT/US2007/064488, dated Sep. 9, 2007, 9 pages.
International Search Report and Written Opinion, Application No. PCT/US2006/041799, dated Oct. 14, 2008, 5 pages.
International Search Report from Application No. PCT/US05/34873, dated Jun. 12, 2008, 2 pages.
International Search Report from Application No. PCT/US05/34874, dated Jul. 5, 2006, 14 pages.
International Search Report from Application No. PCT/US2006/008883, dated Oct. 19, 2007, 5 pages.
International Search Report from Application No. PCT/US2006/025378, dated Sep. 18, 2007, 10 pages.
International Search Report from Application No. PCT/US2006/041798, dated Dec. 4, 2007, 8 pages.
International Search Report from Application No. PCT/US2007/064489 dated Sep. 27, 2007, 8 pages.
International Search Report from Application No. PCT/US2007/064490, dated Jul. 23, 2007, 10 pages.
International Search Report from Application No. PCT/US2007/067076, dated Nov. 2, 2007, 10 pages.
International Search Report from Application No. PCT/US2007/067078, dated Nov. 2, 2007, 9 pages.
International Search Report from Application No. PCT/US2007/067082, dated Nov. 5, 2007, 8 pages.
International Search Report from Application No. PCT/US2007/067084, dated Nov. 5, 2007, 11 pages.
International Search Report from Application No. PCT/US2010/025702, dated Sep. 17, 2010, 4 pages.
Japanese Patent Application No. 2012-507228, Decision of Rejection dated Jan. 20, 2015, 3pages (English Translation).
Japanese Patent Application No. 2012-507228, Office Action dated Feb. 21, 2014, 3 pages (English Translation).
Japanese Patent Application No. 2015-101464, Notice of Allowance dated Jan. 17, 2017, 4 pages.
Japanese Patent Application No. 2015-101464, Office Action dated May 10, 2016, 9 pages.
Jebara (2004) 21st International Conference on Machine Learning Banff, Canada "Multi-Task Feature and Kernel Selection for SVMs" Online-Availabe at: http://www.cs.columbia.edu/˜jebara/papers/metalearn.pdf.
Jebara (2004) 21st International Conference on Machine Learning Banff, Canada "Multi-Task Feature and Kernel Selection for SVMs" Online—Availabe at: http://www.cs.columbia.edu/˜jebara/papers/metalearn.pdf.
Julisch, et al. (2005) DIMVA Second International Conference Jul. 7-8 Vienna, Austria "Detection of Intrusions and Malware, and Vulnerability Assessment".
Kan, et al. (Aug. 2005) NUS School of Computing "Fast webpage classification using URL features" [online] Available from: http://www.comp.nus.edu.sg/˜kanmy/papers/nustrc8-05.pdf (Accessed on Jan. 28, 2015).
Kan, et al. (Aug. 2005) NUS School of Computing "Fast webpage classification using URL features" [online] Available from: http://www.comp.nus.edu.sg/˜kanmy/papers/nustrc8—05.pdf (Accessed on Jan. 28, 2015).
Kim (2004) "Intercepting System API Calls" 6 pages Available at: https://software.intel.com/en-us/articles/intercepting-system-api-calls.
K-Ways Software Technology AG (2005) "X-Ways Forensics: Integrated Computer Forensics Software" 3 pages Available from: http://web.archive.org/web/20050829195657/http://www.x-ways.net/forensics/index-m.html.
Lin, et al. (2003) Database EPODOC "Method and System for Computing Fragment Rate of Disc" XP002451266 Abstract Only.
Lin, et al. (2003) Database EPODOC "Method and System for Computing Fragment Rate of Magnetic Disc" XP002451265 Abstract Only.
Linn, et al. (2003) "Obfuscation of Executable Code to Improve Resistance to Static Disassembly" ACM 290-299.
Marsh (1993) "Win32 Hooks" 15 pages Available at: http://msdn.microsoft.com/library/en-us/dnwui/html/msdn-hooks32.asp/?frame=true.
Marsh (1993) "Win32 Hooks" 15 pages Available at: http://msdn.microsoft.com/library/en-us/dnwui/html/msdn—hooks32.asp/?frame=true.
Microsoft (2005) "How to Subclass a Window in Windows 95" 2 pages Available at: http://support.microsoft.com/kb/q125680/.
Microsoft Syslnternals (2006) "Rootkit Revealer 1.71" Online Available at: http://filehippo.com/download-rootkit-revealer/ Accessed on: Nov. 17, 2015.
Microsoft Syslnternals (2006) "Rootkit Revealer 1.71" Online Available at: http://filehippo.com/download—rootkit—revealer/ Accessed on: Nov. 17, 2015.
Mikhaliov (2005) "NTFS file system" 8 pages Available at: http://www.digit-life.com/articles/ntfs/ Accessed on Jun. 18, 2007.
Milenković, et al. (2005) ACM SIGARCH Computer Architecture News 33(1):108-117 "Using Instruction Block Signatures to Counter Code Injection Attacks".
Mookhey (2004) "Common Security Vulnerabilities in e-commerce Systems" Symantec 8 pages Available at: http://www.symantec.com/connect/articles/common-security-vulnerabilities-e-commerce-systems; Retrieved on Sep. 9, 2016.
Nachenberg (1997) Communications of the ACM 40(1):46-51 "Computer Virus-Coevolution: The battle to conquer computer viruses is far from won, but new and improved antidotes are controlling the field.".
Nguyen, et al. (Dec. 2006) Proceedings of the 6th International Conference on Internet Information Retrieval, Korea 143-149 "A Maximum Entropy Model for Text Classification" Available from: http://www.uet.vnu.edu.vn/˜thuyhq/papers/06-NNH-International%20Conference%20on%20Internet%20Information%20Retrieval-IRC2006-143-149.pdf (Accessed on Jan. 28, 2015).
Nguyen, et al. (Dec. 2006) Proceedings of the 6th International Conference on Internet Information Retrieval, Korea 143-149 "A Maximum Entropy Model for Text Classification" Available from: http://www.uet.vnu.edu.vn/˜thuyhq/papers/06—NNH—International%20Conference%20on%20Internet%20Information%20Retrieval—IRC2006—143—149.pdf (Accessed on Jan. 28, 2015).
OSDir.com (2004) "ntfsprogs-todo [LONG]" Online Available at: http://osdir.com/ml/linux.file-systems.ntfs.devel/2004-08/msg00023.html; Retrieved on Nov. 13, 2015.
Rabek, et al. (2003) ACM 76-82 "Detection of Injected, Dynamically Generated, and Obfuscated Malicious Code".
Roelker (2004) Sourcefire, Inc. "HTTP IDS Evasions Revisited" Online: Availabe at: https://s3.amazonaws.com/snort-org-site/production/document-files/files/000/000/031/original/sf-HTTP-IDS-evasions.pdf?AW SAccessKeyld=AKIAIXACIED2SPMSC7GA&Expires=1447872643&Signature=GITFKHYyb1mABkFA09oXzegOEkY%3D; Retrieved on Nov. 18, 2015.
Roelker (2004) Sourcefire, Inc. "HTTP IDS Evasions Revisited" Online: Availabe at: https://s3.amazonaws.com/snort-org-site/production/document—files/files/000/000/031/original/sf—HTTP—IDS—evasions.pdf?AW SAccessKeyld=AKIAIXACIED2SPMSC7GA&Expires=1447872643&Signature=GITFKHYyb1mABkFA09oXzegOEkY%3D; Retrieved on Nov. 18, 2015.
Salomon (2010) Undergraduate Topics in Computer Science "Elements of Computer Society" 19 pages.
Singh, et al. (2002) ACM SIGPLAN Notices 37(2): 29-35 "Analysis and Detection of Computer Viruses and Worms: An Annotated Bibliography".
Skoudis (2004) Malware: Fighting Malicious Code 590-618 "Chapter 11: Malware Analysis".
Su, et al. (2006) POPL 372-382 "The Essence of Command Injection Attacks in Web Applications".
Techterms "Vector" Nov. 7, 2007 [Online] Downloaded Feb. 18, 2015 http://techterms.com/definition/vector.
Techterms-2 "URI" Nov. 1, 2007 [Online] Downloaded Feb. 18, 2015 http://techterms.com/definition/uri.
The Computer Guy Magazine (2011) "Virus, Malware, Oh My?" 19 pages.
Tittel (2005) PC Magazine 328-335 "Fighting Spyware, Viruses, and Malware".
Unknown Author (2006) Illusive Society "Wolves in Sheep's Clothing: Malicious DLLs Injected into Trusted Host Applications" 13 pages Available from: http://home.arcor.de/scheinsicherheit/dll.htm.
Wang et al. (2005) IEEE, International Conference on Dependable Systems "Detecting Stealth Software with Strider GhostBuster" 10 pages.
Wen et al. (2008) IEEE, International Conference on Information Security and Assurance 150-155 "Implicit Detection of Hidden Processes with a Local-Booted Virtual Machine".
Whittaker, et al. (2002) ACM 242-246 "Neutralizing Windows-Based Malicious Mobile Code".
Yurcik et al. (2001) IEEE IT Pro 41-44 "A Planning Framework for Implementing Virtual Private Networks".
US8856505B2 (en) 2014-10-07 grant
US8190868B2 (en) 2012-05-29 grant
US20080034429A1 (en) 2008-02-07 application
US20120216027A1 (en) 2012-08-23 application
US20150089648A1 (en) 2015-03-26 application
US20060075501A1 (en) 2006-04-06 System and method for heuristic analysis to identify pestware
US8065728B2 (en) 2011-11-22 Malware prevention system monitoring kernel events
Free format text: CHANGE OF NAME;ASSIGNOR:WEBROOT SOFTWARE, INC.;REEL/FRAME:034919/0706
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SCHNEIDER, JEROME L.;REEL/FRAME:034905/0309