US 10,210,329 B1Grant
Method to detect application execution hijacking using memory protection
Issue Date:2019-02-19
•20 Claims
•10 Drawing Sheets
Abstract
According to one embodiment, a system comprising a dynamic analysis server comprising one or more virtual machines is disclosed, wherein the one or more virtual machines may be configured to execute certain event logic with respect to a loaded module. The virtual machines may be communicatively coupled to a virtual machine manager and a database; and rule-matching logic comprising detection logic, wherein the detection logic is configured to determine (1) whether an access source is attempting to access a protected region such as a page guarded area; and (2) determine whether the access source is from the heap. The system further comprises reporting logic that is configured to generate an alert so as to notify a user and/or network administrator of a probable application-execution hijacking attack.
Metadata
Assignee
- FireEye, Inc.
Inventors
- Amit Malik
- Reghav Pande
- Aakash Jain
Application Information
Application Number:US 14/871,987
Filing Date:2015-09-30
Priority Date:2015-09-30
Art Unit:2491
Classifications
IPC:
G06F21/55G06F21/53H04L29/06
Field of Search:
G06F 21/554G06F 2221/033G06F 21/53H04L 63/1466H04L 63/1416
Patent Drawings (10 sheets)
Description
FIELD
[0001] Embodiments of the disclosure relate to the field of cyber-security. More specifically, one embodiment of the disclosure relates to a system, apparatus and method for identifying potential application-execution hijacking attacks using memory protection techniques.
GENERAL BACKGROUND
[0002] Over the last decade, malicious software has become a pervasive problem for Internet users as many networked resources include vulnerabilities that are subject to attack. For instance, over the past few years, more and more vulnerabilities are being discovered in software that is loaded onto network devices, such as vulnerabilities within operating systems for example. While some vulnerabilities continue to be addressed through software patches, prior to the release of such software patches, network devices will continue to be targeted for attack by malware, namely information such as computer code that attempts during execution to take advantage of a vulnerability in computer software by acquiring sensitive information or adversely influencing or attacking normal operations of the network device or the entire enterprise network.
[0003] For example, one commonly exploited vulnerability is known as a buffer overflow. In general, programs write data to a buffer. However, during a buffer overflow, the written data overruns the buffer's allocated boundary and overwrites adjacent memory locations. As a result, buffer overflows are the basis of many software vulnerabilities and can be maliciously exploited to cause erratic program behavior, memory access errors, incorrect results, and/or the misappropriation of sensitive data such as intellectual property.
[0004] Various techniques have been attempted to detect and prevent software exploits, however each technique has various tradeoffs. One of the most generic techniques include Data Execution Prevention (DEP), which is generally provided for by a processor. Using DEP, memory spaces are automatically marked as non-executable unless they are explicitly told they are being allocated for executable code. Specifically, a flag is set on a per-page basis and is set via a bit in the page table entry (PTE) for that page. If an attempt is made to execute code from a memory region that is marked as non-executable, the hardware feature passes an exception to DEP within the operating system and provides a corresponding indication. Consequently, DEP causes an exception within the code stack that is executing, thereby causing a failure coupled with an access violation. DEP may be made stronger by CPU support with the No-Execute (NX) bit, also known as the XD bit, EVP bit, or XN bit, which allows the CPU to enforce execution rights at the hardware level.
[0005] Unfortunately, in short order, bypasses were developed by hackers to overcome DEP schemes. Specifically, a technique known as Return-Oriented Programming (ROP) was developed to circumvent DEP schemes. ROP techniques search for portions of code known as ROP gadgets in legitimate modules within a particular process. ROP gadgets generally comprise of one or more instructions, followed by a return. Combining a plurality of ROP gadgets along with appropriate values in the stack allows for the malicious shell code to be executed. Typically, the hacker's goal is to locate the address of a memory protection API, such as VirtualProtect, and mark the relevant memory region as executable (as compared to non-executable). Thereafter, the hacker may introduce a final ROP gadget to transfer the execution to the relevant memory region to execute the shellcode. As a result, the DEP scheme may be bypassed.
[0006] In an effort to make potential DEP bypasses more difficult, Address Space Layout Randomization (ASLR) was developed. ASLR involves randomly offsetting memory structures and module base addresses such that merely “guessing” the location of ROP gadgets and APIs becomes exceedingly difficult. On certain operating systems, such as the Microsoft® Windows® operating system, ASLR may be configured to randomize the location of executables and Dynamic Link Libraries (DLLs) in memory, stacks and heaps. For example, when an executable is loaded into memory, the operating system may receive a processor's timestamp counter (TSC), shift the TSC by a nominal amount, perform a division (e.g., a modulo operation), and then add a constant. The result of this operation may then be multiplied by yet another constant, at which point an executable image is loaded at the calculated offset.
[0007] However, some DLLs (including for example, ntdll, kernel32, etc.) are shared in memory across processes, their offsets are determined by a system-wide bias value that is computed at boot. Notably, the offset value is computed only once per boot. When DLLs are loaded, they are disposed into a shared memory region. The order in which modules are loaded is randomized too. Furthermore, when threads are created, their stack base address is randomized. Once the base address has been calculated, another value is derived from the TSC to compute the final stack base address. By using this method, ASLR was intended to provide a high theoretical degree of randomness.
[0008] When all of these ALSR mechanisms were combined with DEP, it was understood that shellcode would be prevented from executing because the memory region could not be executed. Moreover, it was expected that potential hackers also would not know the location of any ROP instructions in memory because the ROP gadget's address would be unreliable due to the randomization.
[0009] Nonetheless, bypasses were developed by hackers to overcome ASLR mechanisms so that DEP schemes could be easily exploited. For example, NOP sleds may be utilized to create a probabilistic exploit. Furthermore, using a pointer leak, a hacker can make an educated guess regarding a value on the stack at a reliable location to locate a usable function pointer or ROP gadget.
[0010] In other words, using these and other techniques, it may be possible to create a payload that reliably bypasses both DEP and ASLR. Moreover, once ASLR and DEP are compromised, it is a straight forward matter to control the execution of shellcode in the context of the application. Therefore, there exists a need for a system, apparatus and method for identifying potential application-execution hijacking attacks using memory protection techniques so as to prevent the execution of malicious shellcode.
BRIEF DESCRIPTION OF THE DRAWINGS
[0011] Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings, in which like references indicate similar elements and in which:
[0012] FIG. 1A is an exemplary logical representation of a communication system deploying an application-execution hijacking detection system communicatively coupled to a network.
[0013] FIG. 1B an exemplary embodiment of a representation of the application-execution hijacking detection system of FIG. 1A .
[0014] FIG. 2 is an exemplary representation of a plurality of mobile devices deploying an application-execution hijacking detection application communicatively coupled to a network.
[0015] FIG. 3 is an exemplary embodiment of a mobile device deploying an application-execution hijacking detection application according to the present disclosure.
[0016] FIG. 4 is an exemplary block diagram of an operational flow of an application-execution hijacking detection system.
[0017] FIG. 5 is an exemplary block diagram of an alternative operational flow of an application-execution hijacking detection system.
[0018] FIG. 6 is a flowchart of an exemplary method for detecting application-execution hijacking malware by applying a guard page to a base address of a loaded module.
[0019] FIG. 7 is a flowchart of an exemplary method for detecting application-execution hijacking malware by applying a guard page to an import table of a loaded module.
[0020] FIG. 8 is a flowchart of an exemplary method for detecting application-execution hijacking malware by applying a hardware breakpoint to a base address of a loaded module.
[0021] FIG. 9 is a flowchart of an exemplary method for detecting application-execution hijacking malware by applying a guard page to a process environment block of a loaded module.
DETAILED DESCRIPTION
[0022] Various embodiments of the disclosure relate to a network appliance, such as an application-execution hijacking detection system (AEH) system for example, where the network appliance comprises a dynamic analysis server. According to one embodiment of the disclosure, information from received network traffic is analyzed to determine whether at least a portion of the received network traffic is likely to be associated with malware. A portion of the received network traffic, (hereinafter “object(s)”), that is determined to likely be associated with malware is deemed “suspicious.” The dynamic analysis server comprises virtual execution logic to automatically analyze one or more objects while the object(s) executes within a virtual machine (VM). In particular, the dynamic analysis server comprises event logic to analyze whether attempts have been made to access protected (guarded) pages of loaded modules so as to detect a potential AEH attack. In one embodiment, instead of implementing virtual execution logic, an AEH detection application may be configured so as to communicate the output of DLL/kernel logic directly into an application running on a mobile device, for example. It is envisioned that deployments other than VM-based deployments may also be used, including but not limited to runtime system deployments and the like.
[0023] Herein, according to one embodiment of the disclosure, the dynamic analysis server is configured to monitor and store access events of guarded page areas of any of various loaded modules. Any time a read, write or execute operation (“access event”) is performed on such guarded page areas, the access event is analyzed to determine whether it is malicious (and therefore associated with a malware attack), or non-malicious. For example, if the access source is from the heap, then there is a high likelihood that the access event is malicious. As used herein, the heap refers to any portion of memory where dynamically allocated memory resides. More specifically, in the context of loaded modules, the memory type is a “MEM_IMAGE” type. Conversely, if the memory type at any address is not the “MEM_IMAGE” type, then the address is from the heap, and therefore malicious. It is envisioned that upon a finding of maliciousness, an alert may be generated to communicate details of the access event, including for example the access source and corresponding memory type. In some embodiments, determining that an access event is malicious may result in the termination of the respective application, process and/or operation.
I. Terminology
[0024] In the following description, certain terminology is used to describe features of the invention. For example, in certain situations, term “logic” is representative of hardware, firmware and/or software that is configured to perform one or more functions. As hardware, logic may include circuitry having data processing or storage functionality. Examples of such circuitry may include, but are not limited or restricted to a microprocessor, one or more processor cores, a programmable gate array, a microcontroller, an application specific integrated circuit, wireless receiver, transmitter and/or transceiver circuitry, semiconductor memory, or combinatorial logic.
[0025] Logic may be software in the form of one or more software modules, such as executable code in the form of an executable application, an application programming interface (API), a subroutine, a function, a procedure, an applet, a servlet, a routine, source code, object code, a shared library/dynamic load library, or one or more instructions. These software modules may be stored in any type of a suitable non-transitory storage medium, or transitory storage medium (e.g., electrical, optical, acoustical or other form of propagated signals such as carrier waves, infrared signals, or digital signals). Examples of non-transitory storage medium may include, but are not limited or restricted to a programmable circuit; a semiconductor memory; non-persistent storage such as volatile memory (e.g., any type of random access memory “RAM”); persistent storage such as non-volatile memory (e.g., read-only memory “ROM”, power-backed RAM, flash memory, phase-change memory, etc.), a solid-state drive, hard disk drive, an optical disc drive, or a portable memory device. As firmware, the executable code is stored in persistent storage.
[0026] The term “object” generally refers to a collection of data, whether in transit (e.g., over a network) or at rest (e.g., stored), often having a logical structure or organization that enables it to be classified for purposes of analysis. During analysis, for example, the object may exhibit a set of expected characteristics and, during processing, a set of expected behaviors. The object may also exhibit a set of unexpected characteristics and a set of unexpected behaviors that may evidence an exploit and potentially allow the object to be classified as an exploit.
[0027] Examples of objects may include one or more flows or a self-contained element within a flow itself. A “flow” generally refers to related packets that are received, transmitted, or exchanged within a communication session. For convenience, a packet is broadly referred to as a series of bits or bytes having a prescribed format, which may include packets, frames, or cells.
[0028] As an illustrative example, an object may include a set of flows such as (1) a sequence of transmissions in accordance with a particular communication protocol (e.g., User Datagram Protocol (UDP); Transmission Control Protocol (TCP); or Hypertext Transfer Protocol (HTTP); etc.), or (2) inter-process communications (e.g., Remote Procedure Call “RPC” or analogous processes, etc.). Similar, as another illustrative example, the object may be a self-contained element, where different types of such objects may include an executable file, non-executable file (such as a document or a dynamically link library), a Portable Document Format (PDF) file, a JavaScript file, Zip file, a Flash file, a document (for example, a Microsoft Office® document), an electronic mail (email), downloaded web page, an instant messaging element in accordance with Session Initiation Protocol (SIP) or another messaging protocol, or the like.
[0029] According to one embodiment, the term “malware” may be construed broadly as any code or activity that initiates a malicious attack and/or operations associated with anomalous or unwanted behavior. For instance, malware may correspond to a type of malicious computer code that executes an exploit to take advantage of a vulnerability, for example, to harm or co-opt operation of a network device or misappropriate, modify or delete data. Malware may also correspond to an exploit, namely information (e.g., executable code, data, command(s), etc.) that attempts to take advantage of a vulnerability in software and/or an action by a person gaining unauthorized access to one or more areas of a network device to cause the network device to experience undesirable or anomalous behaviors. The undesirable or anomalous behaviors may include a communication-based anomaly or an execution-based anomaly, which, for example, could (1) alter the functionality of an network device executing application software in an atypical manner (a file is opened by a first process where the file is configured to be opened by a second process and not the first process); (2) alter the functionality of the network device executing that application software without any malicious intent; and/or (3) provide unwanted functionality which may be generally acceptable in another context. Additionally, malware may be code that initiates unwanted behavior which may be, as one example, uploading a contact list from an endpoint device to cloud storage without receiving permission from the user.
[0030] The term “shellcode” refers to a small piece of executable code that resides in data (e.g., is injected into data), is used as a payload of malware, or, in some cases, contains a shell command to execute an exploit.
[0031] The term “transmission medium” is a physical or logical communication path between two or more network devices (e.g., any devices with data processing and network connectivity such as, for example, a security appliance, a server, a mainframe, a computer such as a desktop or laptop, netbook, tablet, firewall, smart phone, router, switch, bridge, etc.). For instance, the communication path may include wired and/or wireless segments. Examples of wired and/or wireless segments include electrical wiring, optical fiber, cable, bus trace, or a wireless channel using infrared, radio frequency (RF), or any other wired/wireless signaling mechanism.
[0032] In certain instances, the term “detected” is used herein to represent that there is a prescribed level of confidence (or probability) on the presence of an exploit within an object under analysis.
[0033] The term “pattern” should be construed as a predefined grouping of instructions. A pattern may appear in memory, such as memory allocated in a virtual execution environment for use by an application being executed by a virtual machine. In some embodiments, the length of the pattern may correspond to the operating system of the network device which is undergoing analysis. For example, a pattern may consist of four bytes when the network device is running a 32-bit operating system (this may be referred to as a double word, or “DWORD”). Therefore, the DWORD may contain up to four (4) instructions, which may be four (4) NOP instructions, for example. Alternatively, a pattern may consist of eight bytes when the network device is running a 64-bit operating system (this may be referred to as a quad word, or “QWORD”). Therefore, the QWORD may contain up to eight (8) instructions, which may be eight (8) NOP instructions, for example.
[0034] The terms “network device” or “network appliance” should be construed as any electronic device with the capability of connecting to a network. Such a network may be a public network such as the Internet or a private network such as a wireless data telecommunication network, wide area network, a type of local area network (LAN), or a combination of networks. Examples of a network device may also include, but are not limited or restricted to mobile devices, such as a laptop, a mobile phone, a tablet, a computer, etc. or any other relatively portable device.
[0035] The term “computerized” generally represents that any corresponding operations are conducted by hardware in combination with software and/or firmware. Also, the terms “compare” or “comparison” generally mean determining if a match (e.g., a certain level of correlation) is achieved between two items where one of the items may include a particular signature pattern.
[0036] Lastly, the terms “or” and “and/or” as used herein are to be interpreted as inclusive or meaning any one or any combination. Therefore, “A, B or C” or “A, B and/or C” mean “any of the following: A; B; C; A and B; A and C; B and C; A, B and C.” An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.
[0037] As this invention is susceptible to embodiments of many different forms, it is intended that the present disclosure is to be considered as an example of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.
II. Application-Execution Hijacking Detection System
[0038] A. General Architecture of Network Appliance Deploying Application-Execution Hijacking Detection Logic
[0039] Referring to FIG. 1A , an exemplary logical representation of an AEH detection environment 102 communicatively coupled to a network 110 via a network interface 120 is shown. The AEH detection environment 102 comprises a server device 105, an optional firewall 115, a client device 125 and an AEH detection system 100 communicatively coupled to the network 110 via a network interface 120. The AEH system 100 is further communicatively coupled to an analysis network 195. It is envisioned that the analysis network 195 may be configured to store and access data regarding malware attacks across a number of objects, including for example, web-based, email-based, and file-based threats. Moreover, it is envisioned that the analysis network 195 may be configured to store historical information regarding previously analyzed and/or known malware attacks. The analysis network 195 may also be periodically or aperiodically updated so as to store information regarding new malware attacks, reports, alerts, and/or corresponding features, for example.
[0040] Herein, according to the embodiment illustrated in FIG. 1A , the AEH detection system 100 comprises a network appliance that is adapted to analyze information associated with network traffic routed over a communication network 110 between at least one server device 105 and at least one client device 125. The communication network 110 may include a public network such as the Internet, in which case an optional firewall 115 (represented by dashed lines) may be interposed in the communication path between the public network and the client device 125. Alternatively, the communication network 110 may be a private network such as a wireless data telecommunication network, wide area network, a type of local area network (LAN), or a combination of networks.
[0041] As shown, the AEH detection system 100 may be communicatively coupled with the communication network 110 via a network interface 120. In general, the network interface 120 operates as a data-capturing device (sometimes referred to as a “tap” or “network tap”) that is configured to receive data propagating to/from the client device 125 and provide at least some of this data to the AEH detection system 100. Alternatively, it should be understood that the AEH detection system 100 may be positioned behind the firewall 115 and in-line with client device 125.
[0042] According to one embodiment of the disclosure, the network interface 120 is capable of receiving and routing objects associated with network traffic to the AEH detection system 100. The network interface 120 may provide the entire object or certain content within the object, for example, one or more files or packets that are part of a set of flows, packet payloads, or the like. In some embodiments, although not shown, network interface 120 may be contained within the AEH detection system 100.
[0043] It is contemplated that, for any embodiments where the AEH detection system 100 is implemented as a dedicated appliance or a dedicated computer system, the network interface 120 may include an assembly integrated into the appliance or computer system that includes a network interface card and related logic (not shown) for connecting to the communication network 110 to non-disruptively “tap” network traffic propagating through firewall 115 and provide either a duplicate copy of at least a portion of the network traffic or at least a portion the network traffic itself to the dynamic analysis server 130 and an optional static analysis server, if included within the AEH detection system 100. In other embodiments, the network interface 120 can be integrated into an intermediary device in the communication path (e.g., firewall 115, router, switch or other networked network device, which in some embodiments may be equipped with Switched Port Analyzer “SPAN” ports) or can be a standalone component, such as an appropriate commercially available network tap. In virtual environments, a virtual tap (vTAP) can be used to duplicate files from virtual networks.
[0044] As further shown in FIG. 1A , the AEH detection system 100 comprises the dynamic analysis server 130, rule-matching logic 150, and reporting logic 160. In some embodiments, an optional static analysis server may be provided within the AEH detection system 100 so as to perform static scanning on a particular object, namely heuristics, exploit signature checks and/or vulnerability signature checks for example. The optional static analysis server and the dynamic analysis server 130 may be one or more software modules executed by the same processor or different processors, where these different processors may be located within the same processor package (e.g., different processor cores) and/or located at remote or even geographically remote locations that are communicatively coupled (e.g., by a dedicated communication link) or a network.
[0045] Herein, the dynamic analysis server 130 comprises a virtual machine manager 140, a database 145 and one or more virtual machines (VMs) VM1-VMN (N≥1) that may be configured to perform in-depth dynamic analysis with respect to one or more suspicious objects. For instance, the dynamic analysis server 130 may simulate transmission and/or receipt of packets or other objects by a destination device comprising the virtual machines to determine whether certain guarded areas of loaded modules are being accessed in an effort to hijack a particular application.
[0046] According to one embodiment, each of the VMs (e.g., VM1-VMN) within the dynamic analysis server 130 may be configured with a software profile corresponding to a software image stored within the database 145 that is communicatively coupled with the virtual machine manager 140. Alternatively, the VMs (e.g., VM1-VMN) may be configured according to a prevalent software configuration, software configuration used by a network device within a particular enterprise network (e.g., client device 125), or an environment that is associated with the object to be processed, including software such as a web browser application, PDF™ reader application, or the like.
[0047] However, for a known vulnerability, the VMs (e.g., VM1-VMN) may be more narrowly configured to profiles associated with vulnerable modules. For example, if the access source comprises a certain memory type, VM1-VMN may be configured for faster processing and corresponding log file generation. Similarly, when relevant, if the access source is attempting to access a guarded page of its own module, then VM1-VMN may be configured accordingly.
[0048] In general, the dynamic analysis server 130 is adapted to execute one or more VMs (e.g., VM1-VMN) to detect an application-execution hijacking attempt by simulating the execution of an object under analysis within a run-time environment as expected by the type of object. For example, the dynamic analysis server 130 analyzes the received network traffic and determines which application is suitable for executing an object of the received network traffic within one or more VMs, namely VM1, and/or VMN.
[0049] Each of the VMs (VM1-VMN) comprise event logic 135 that is configured so as to detect and/or store all access events, however the event logic 135 may be more narrowly tailored to only focus on access events with respect to guarded areas. The event logic 135 comprises Dynamic Link Library (DLL)/kernel logic 138 that is configured to respond to the occurrence, during computation for example, of exceptions. As used herein, “exceptions” generally refer to anomalous or exceptional conditions requiring special processing that may change the normal flow of a program's execution. It is envisioned that when an attempt is made to access a guarded area, an exception is generated and appropriately handled by the DLL/kernel logic 138. Preferably, the DLL/kernel logic 138 is configured to handle all exceptions that may occur in the event that a guarded area is accessed. In general, the DLL/kernel logic 138 may be considered a library that contains code and data that may be used by more than one programs simultaneously to promote code reuse and efficient memory usage. By using the DLL/kernel logic 138, a program may be modularized into separate components, known as modules. Each module may be loaded into a main program at run time, if that module is loaded. Consequently, as used herein, the DLL/kernel logic 138 utilizes this modular nature to detect access events in conjunction with the AEH detection system 100 to ultimately determine whether the access events are malicious or not.
[0050] In one embodiment, the event logic 135 may be configured to generate a log file corresponding to the access events, with special focus being paid to guarded page areas. It is envisioned that the log file may comprise any suitable file format. Once generated, the log file may be communicated to the rule-matching logic 150 so that certain detection logic 155 may be applied thereon.
[0051] In one embodiment, the detection logic 155 is configured to apply certain rules on the generated log file. Once the rules are applied, the result is communicated to the reporting logic 160. If maliciousness is found, an alert 190 is generated. The alert 190 may comprise details with respect to the object, such as, by way of non-limiting example, the source of a particular access event, and/or its memory type. In one embodiment, the DLL/kernel logic 138 may be configured to directly block one or more malicious objects by terminating the application and/or process that has been attacked, rather than generating a log file, using the optional process-handling logic 180, for example. It is envisioned that the rules may also be configured so as to perform a probabilistic analysis with respect to some or all of the data associated with the generated log file. For example, the occurrence of an access event may indicate to some level of probability, often well less than 100%, that the access event comprises a certain exploit or exhibits certain elements associated with malware. In one embodiment, the rule-matching logic 150 may be configured to take certain action, including for example, generating an alert 190 if the probability exceeds a prescribed value, for example.
[0052] Referring now to FIG. 1B , an exemplary embodiment of a representation of the AEH detection system of FIG. 1A is shown. In one embodiment, a network appliance 106 comprises a housing 103, which is made entirely or partially of a rigid material (e.g., hardened plastic, metal, glass, composite or any combination thereof) that protect circuitry within the housing 103, namely one or more processors 109 that are coupled to communication interface logic 112 via a first transmission medium 116. Communication interface logic 112 enables communications with other AEH detection systems 100 and/or the analysis network 195 of FIG. 1A , for example. According to one embodiment of the disclosure, communication interface logic 112 may be implemented as a physical interface including one or more ports for wired connectors. Additionally, or in the alternative, communication interface logic 112 may be implemented with one or more radio units for supporting wireless communications with other electronic devices.
[0053] Processor(s) 109 may further be coupled to persistent storage 122 via a second transmission medium 119. According to one embodiment of the disclosure, persistent storage 122 may include the AEH detection system 100, which in one embodiment comprises (a) dynamic analysis server 130; (b) rule-matching logic 150; (c) optional process handling logic 180; and reporting logic 160. It is envisioned that one or more of these systems (or logic units) could be implemented externally from the AEH detection system 100 without extending beyond the spirit and scope of the present disclosure.
[0054] B. General Architecture of a Mobile Device Deploying an Application-Execution Hijacking Detection Application
[0055] Referring to FIG. 2 , a plurality of mobile devices 230A-230C deploying an AEH detection application communicatively coupled to an analysis network 205 is shown. In general, a network environment 200 is shown, wherein a router 215 is communicatively coupled to analysis network 205 and Internet 210. The router is also communicatively coupled to an optional firewall 220, which itself may be communicatively coupled to a network switch 225. As shown, the plurality of mobile devices 230A-230C may also be communicatively coupled to the analysis network 205 and Internet 210 using any transmission medium, including without limitation, wireless and hardwired connection schemes. It is envisioned that an exemplary AEH detection application 231A-231C corresponding to each of the mobile devices may be installed to detect application-execution hijacking malware. Of course, although only three mobile devices 230A-230C are shown in FIG. 2 , any number of devices may have the exemplary AEH detection application 231A-231C loaded thereon. In one embodiment, the AEH detection application may be a downloaded from an app store, website, etc., and thus stored and made locally available with respect to a mobile device.
[0056] Referring to FIG. 3 , a mobile device may be configured to deploy the AEH detection application 231 of FIG. 2 . As shown in FIG. 3 , for illustrative purposes, the network device 300 is represented as a mobile device (e.g., smartphone, tablet, laptop computer, netbook, etc.). The mobile device 300 includes a display screen 302, one or more processors 310, a receiver and/or transmitter (e.g. transceiver) such as an antenna 355, and communication interface logic 305. In one embodiment, the AEH detection application 231 comprises exploit detection logic 315, rule-matching logic 330, reporting logic 345, and user interface logic 350.
[0057] As shown, the AEH detection application 231 is substantially similar to the AEH detection environment 102 of FIG. 1 , except that instead of implementing VMs, the AEH detection application 231 communicates the output of the DLL/kernel logic 315 directly into the AEH detection application 231 running on the mobile device 300. After the output of the DLL/kernel logic 315 is loaded, a log file is generated comprising access events, again with special attention being paid to access events corresponding to guarded page areas. It is envisioned that the log file may be customized so as to only focus on certain criteria. For example, the log file may be filtered according to a particular access source, the memory type being accessed, and in some instances, whether the access source is from the heap. Once the log file is generated, it is communicated to the reporting logic 340, comprising the alert generation logic 345, which may generate an alert and/or route the alert to the analysis network 205 via the communication interface logic 305, for further analysis. In addition, the alert may be routed to the Internet 210 using communication interface logic 305 for further analysis by a network administrator, for example. The reporting logic 340 may issue an alert or report (e.g., an email message, text message, display screen image, etc.) to security administrators or the user, for example, communicating the urgency in handling one or more predicted attacks using the user interface logic 350. The AEH detection application 231 may trigger a further analysis of the object to verify the behavior of the object as an exploit. It is envisioned that the generated alert or report may also comprise instructions so as to prevent one or more predicted malware attacks.
II. Application-Execution Hijacking Detection Methods
[0058] FIG. 4 is a flowchart of an exemplary method for detecting AEH malware by applying any of various protection mechanisms, including by way of non-limiting example, applying a page guard to an element of a loaded module so as to establish a protected region. Specifically, as shown at block 405, a page guard is applied to an element of a loaded module, such as by way of non-limiting example, a base address, import table (IT), and/or a process environment block. In general, page guards (also referred to as a “guard page” or “PAGE_GUARD”) provide an alarm for memory page access. Page guards may be used to monitor the growth of large dynamic data structures. For example, certain operating systems use page guards to implement automatic stack checking.
[0059] It is to be understood that to create a page guard, the PAGE_GUARD page protection modifier may be set with respect to a particular page. This value may be specified, along with other page protection modifiers, by way of non-limiting example, in various functions such as VirtualAlloc. The PAGE_GUARD modifier may also be used with any other page protection modifiers. In one embodiment, if a code attempts to access an address within a guard page, the system may raise an exception or any other type of violation. Although the principles described herein are especially relevant to the Microsoft® Windows® operating system, many other operating systems and platforms, including without limitation, Apple OS®, iOS®, Android®, Linux®, etc. may also be utilized. At block 410, access events comprising read, write and/or execute operations are monitored and stored, and particular attention is paid with respect to the source of such access attempts. In the event that a guarded area is accessed, an exception is generated at block 415 by the event logic as discussed herein. At block 420, the dynamic analysis server as discussed herein generate a log file comprising access events. At block 440, detection logic is applied to the log file to determine whether an access event is malicious or not. At block 460, after applying the detection logic as discussed in more detail below, a report/alert may be generated. The report/alert may be communicated to the user or a network administrator, for example, and/or stored for further analysis by the analysis network.
[0060] FIG. 5 is an exemplary block diagram of an alternative operational flow of an AEH detection system that is substantially similar to the flow described in FIG. 4 , except that instead of generating an output file, the potentially malicious object and/or corresponding operation is terminated. For example, at block 505, a page guard is applied to an element of a loaded module, such as by way of non-limiting example, a base address, import table (IT), and/or a process environment block. At block 510, access events are monitored and stored, and particular attention is paid to the source of such access attempts. At block 520, if the access source is determined to be non-malicious, no alert is generated. At block 530, if the access source is indeed malicious, an alert may be generated. Furthermore, if the access source is malicious, the corresponding object and/or process may be terminated, and therefore prevented from executing, as shown at block 535. As stated above, it is envisioned that a probabilistic analysis may also be used in determining whether or not an alert should be generated. For example, the occurrence of an access event may indicate to some level of probability, often well less than 100%, that the access event comprises a certain exploit or exhibits certain elements associated with malware. In one embodiment, the rule-matching logic 150 may be configured to take certain action, including for example, generating an alert if the probability exceeds a prescribed value, for example.
[0061] FIGS. 6-9 are flowcharts of exemplary methods for detecting AEH malware, that may be implemented using the rule-matching logic as discussed herein so as to establish a protected region.
[0062] Specifically, FIG. 6 shows an exemplary method for detecting AEH malware by applying any of various protection mechanisms such as, by way of non-limiting example, applying a page guard to the base address of a loaded module so as to establish a protected region. At block 605, a loaded module is identified. At block 610, a page guard is applied to the base address of the loaded module as discussed herein, although any number of methods may be used. At block 615, rule-matching logic is configured to determine whether a guarded page is being accessed. If the result of this query is “no”, then there is a high likelihood that the access attempt is not malicious. If the result at block 615 is “yes”, then a second query is presented at block 625.
[0063] Specifically, at block 625, the rule-matching logic determines whether the access source is from the heap. In one embodiment, exceptions may comprise context information including for example, values in certain registers at the time the exception was generated that correspond to the address of a source instruction that attempted to access a page guarded area. Once the address of the source instruction is known, a plurality of methods may be used to determine if the address is from the heap. For example, the operating system may provide an API that is configured so as to retrieve information corresponding to the memory at any address. It is envisioned that the API may return a structure that includes information such as memory type. If the memory type is “MEM_IMAGE” then the address is from a loaded module. If the memory type is not “MEM_IMAGE” type, then it is from the heap, and likely malicious. If the result at block 625 is “no”, then there is a high likelihood that the access attempt is not malicious. On the other hand, if the result at block 625 is “yes”, then there is a high likelihood that the access attempt is indeed malicious. In some embodiments, if it is determined that an access attempt is malicious, then an alert may be generated and communicated as discussed herein.
[0064] FIG. 7 is a flowchart of an exemplary method for detecting application-execution hijacking malware by applying a guard page to an import table (IT) of a loaded module. In general, the IT is used as a lookup table when an application is calling a function in a different module. Accordingly, at block 705, a loaded module is identified, and at block 710, a protection mechanism such as a page guard is applied to the IAT of the loaded module as discussed herein, although any number of methods may be used so as to establish a protected region. As indicated at block 710, however, the instant method is only applicable with respect to scriptable DLLs that provide a scripting environment to applications, such as, by way of non-limiting example “jscript”, “vbscript”, and “flash.ocx”. At block 715, the rule-matching logic determines whether a guarded page is being accessed. If the result of this query is “no”, then there is a high likelihood that the access attempt is not malicious. If the result at block 715 is “yes”, then a second query is analyzed at block 725. Specifically, the rule-matching logic determines whether the access source is from the heap. If the result of this query is “yes”, then there is a high likelihood that the access attempt is malicious. If the result of this query is “no”, then a third query is presented at block 740. Specifically, at block 740, the rule-matching logic is configured to determine whether the access source is from the same loaded module, and accessing its own import table. If the result of this query is “no”, then there is a high likelihood that the access attempt is not malicious. On the other hand, if the result of this query is “yes”, then there is a high likelihood than the access attempt is malicious, as indicated at block 735.
[0065] FIG. 8 is a flowchart of an exemplary method for detecting AEH malware by applying a hardware breakpoint to a base address of a loaded module. At block 805, a loaded module is identified. At block 810, a hardware breakpoint is applied to the base address of the loaded module. Unlike software breakpoints, hardware breakpoints may be configured to establish breakpoints that are initiated when any instruction attempts to read, write, and/or execute a specific memory address. It should be appreciated, however, that hardware breakpoints have certain limitations, including for example the limited number of hardware breakpoints that may be active simultaneously. In some embodiments, for example, only four hardware may be active at the same time.
[0066] At block 815, the rule-matching logic determines whether a hardware breakpoint is being accessed. If the result of this query is “no”, then there is a high likelihood that the access attempt is not malicious. If the result at block 815 is “yes”, then a second query is analyzed at block 825. Specifically, the rule-matching logic determines whether the access source is from the heap. If the result at block 825 is “no”, then there is a high likelihood that the access attempt is not malicious. On the other hand, if the result at block 825 is “yes”, then there is a high likelihood that the access attempt is indeed malicious. In some embodiments, if it is determined that an access attempt is malicious, then an alert may be generated as discussed herein.
[0067] FIG. 9 is a flowchart of an exemplary method for detecting application-execution hijacking malware by applying a protection mechanism such as a page guard to a process environment block of a loaded module. It should be understood that the process environment block (PEB) is a data structure that is internally utilized by an operating system, most of whose fields are not intended for use by anything other than the operating system. Conventionally, the PEB comprises data structures that apply across a whole process, including global context, startup parameters, data structures for the program image loader, the program image base address, and synchronization objects used to provide mutual exclusion for process-wide data structures, for example.
[0068] Consequently, at block 905, a loaded module is identified. At block 910, a protection mechanism, such as a page guard is applied to the process environment block of the loaded module as discussed herein, although any number of methods may be used so as to establish a protected region. At block 915, the rule-matching logic determines whether a guarded page is being accessed. If the result of this query is “no”, then there is a high likelihood that the access attempt is not malicious. If the result at block 915 is “yes”, then a second query is analyzed at block 925. Specifically, the rule-matching logic determines whether the access source is from the heap. In one embodiment, the operating system may provide an API that is configured so as to retrieve information corresponding to the memory at any address. For example, the API may return an output structure that includes information such as the memory address. Similarly, the PEB may be configured so as to provide a list of all of the loaded modules, including, for example, DLLs. The list of all of the loaded modules from the PEB may be analyzed and compared with the output structure to determine if a particular address is from the heap, and therefore malicious. If the result at block 925 is “no”, then there is a high likelihood that the access attempt is not malicious. On the other hand, if the result at block 925 is “yes”, then there is a high likelihood that the access attempt is malicious. In some embodiments, if it is determined that an AEH attack is present, then an alert may be generated as discussed herein.
[0069] It should be understood that unless otherwise indicated, the principles described herein are not exclusive to any particular operating system, and thus, systems and methods may be implemented in and/or executed using many operating systems and platforms, including without limitation, Windows®, Apple OS®, iOS®, Android®, etc.
[0070] In the foregoing description, the invention is described with reference to specific exemplary embodiments thereof. However, it will be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended claims.
Claims
Certificate of Correction present
The claims shown below may not include correction changes. Use the corrected PDF for authoritative text.
What is claimed is:
1. An electronic device, comprising:
one or more hardware processors; and
a non-transitory computer-readable storage medium communicatively coupled to the one or more hardware processors, the non-transitory computer-readable storage medium having stored thereon logic that, upon execution by the one or more hardware processors, performs operations comprising:
identifying a loaded module,
applying a protection mechanism to an element of the loaded module so as to establish a protected region, wherein the element of the loaded module is one of a base address of the loaded module, an import table of the loaded module or a process environment block of the loaded module,
determining whether an access source is attempting to access the protected region,
determining whether the access source is from the heap, and
determining the access source is malicious based on determining the access source is attempting to access the protected region and is from the heap.
2. The electronic device of claim 1, wherein the execution by the one or more hardware processors performs operations further comprising generating an alert so as to notify a user or a network administrator of a probable application-execution hijacking attack.
3. The electronic device of claim 1, wherein the execution by the one or more processors performs operations further comprising terminating the loaded module so as to prevent an application-execution hijacking attack.
4. The electronic device of claim 1, wherein the execution by the one or more processors performs operations further comprising generating a log file.
5. The electronic device of claim 1, wherein the loaded module includes executable code.
6. An electronic device, comprising:
one or more hardware processors; and
a non-transitory computer-readable storage medium communicatively coupled to the one or more hardware processors, the non-transitory computer-readable storage medium having stored thereon logic that, upon execution by the one or more hardware processors, performs operations comprising:
identifying a loaded module,
applying a protection mechanism to an import table of the loaded module so as to establish a protected region,
determining whether an access source is attempting to access the protected region,
determining whether the access source is from the heap,
determining whether the access source is from the loaded module and accessing its own import address table, and
determining the access source is malicious based on determining the access source is (i) attempting to access the protected region, (ii) from the heap, and (iii) accessing its own import address table.
7. The electronic device of claim 5, wherein the loaded module comprises one or more dynamic-link libraries (DLLs) that provide a scripting environment to applications.
8. The electronic device of claim 6, wherein the loaded module includes executable code.
9. A system comprising:
a dynamic analysis server comprising one or more hardware processors, a non-transitory computer-readable storage medium and one or more virtual machines that are configured to execute event logic with respect to a loaded module, wherein the one or more virtual machines are communicatively coupled to a virtual machine manager and a database;
rule-matching logic comprising detection logic configured to be executable by the one or more hardware processors to determine whether (1) an access source is attempting to access a protected region, and (2) the access source is from the heap; and
reporting logic comprising alert generating logic that is configured to generate an alert so as to notify a user or a network administrator of a probable application-execution hijacking attack.
10. The system of claim 7, further comprising process handling logic that is configured to terminate a potentially malicious loaded module.
11. The system of claim 7, wherein the detection logic is configured to determine whether a protected page is being accessed, and whether the access source is from the heap.
12. The system of claim 9, wherein the detection logic is configured to determine whether the loaded module is accessing its own import table.
13. The system of claim 9, wherein the loaded module includes executable code.
14. The system of claim 9, wherein further comprising dynamic-link library (DLL)/kernel logic that modularizes a software program into separate components.
15. A system comprising:
a mobile device configured to execute a malware detection application thereon, the detection application comprising:
exploit detection logic configured to execute certain event logic with respect to a loaded module;
rule-matching logic comprising detection logic configured to determine whether an access source is attempting to access a protected region and determine whether the access source is from the heap;
reporting logic comprising alert generating logic that is configured to generate an alert; and
user interface logic that is configured to notify a user or a network administrator of a probable application-execution hijacking attack.
16. The system of claim 11, wherein the exploit detection logic is configured to terminate the loaded module.
17. The system of claim 11, wherein the exploit detection logic is configured to generate an alert.
18. The system of claim 15, further comprising process handling logic that is configured to terminate a potentially malicious loaded module.
19. The system of claim 15, wherein the loaded module includes executable code.
20. The system of claim 15, wherein further comprising dynamic-link library (DLL)/kernel logic that modularizes a software program into separate components.
Patent Citations (583)
| Patent | Date | Inventor | Cited By |
|---|---|---|---|
| US4292580(A) | 1981-09-01 | Ott et al. | Applicant |
| US5175732(A) | 1992-12-01 | Hendel et al. | Applicant |
| US5440723(A) | 1995-08-01 | Arnold et al. | Applicant |
| US5490249(A) | 1996-02-01 | Miller | Applicant |
| US5657473(A) | 1997-08-01 | Killean et al. | Applicant |
| US5842002(A) | 1998-11-01 | Schnurer et al. | Applicant |
| US5978917(A) | 1999-11-01 | Chi | Applicant |
| US6088803(A) | 2000-07-01 | Tso et al. | Applicant |
| US6094677(A) | 2000-07-01 | Capek et al. | Applicant |
| US6108799(A) | 2000-08-01 | Boulay et al. | Applicant |
| US6269330(B1) | 2001-07-01 | Cidon et al. | Applicant |
| US6272641(B1) | 2001-08-01 | Ji | Applicant |
| US6279113(B1) | 2001-08-01 | Vaidya | Applicant |
| US6298445(B1) | 2001-10-01 | Shostack et al. | Applicant |
| US6357008(B1) | 2002-03-01 | Nachenberg | Applicant |
| US6424627(B1) | 2002-07-01 | Sørhaug et al. | Applicant |
| US6442696(B1) | 2002-08-01 | Wray et al. | Applicant |
| US6484315(B1) | 2002-11-01 | Ziese | Applicant |
| US6487666(B1) | 2002-11-01 | Shanklin et al. | Applicant |
| US6493756(B1) | 2002-12-01 | O'Brien et al. | Applicant |
| US6550012(B1) | 2003-04-01 | Villa et al. | Applicant |
| US6775657(B1) | 2004-08-01 | Baker | Applicant |
| US6831893(B1) | 2004-12-01 | Ben Nun et al. | Applicant |
| US6832367(B1) | 2004-12-01 | Choi et al. | Applicant |
| US6895550(B2) | 2005-05-01 | Kanchirayappa et al. | Applicant |
| US6898632(B2) | 2005-05-01 | Gordy et al. | Applicant |
| US6907396(B1) | 2005-06-01 | Muttik et al. | Applicant |
| US6941348(B2) | 2005-09-01 | Petry et al. | Applicant |
| US6971097(B1) | 2005-11-01 | Wallman | Applicant |
| US6981279(B1) | 2005-12-01 | Arnold et al. | Applicant |
| US7007107(B1) | 2006-02-01 | Ivchenko et al. | Applicant |
| US7028179(B2) | 2006-04-01 | Anderson et al. | Applicant |
| US7043757(B2) | 2006-05-01 | Hoefelmeyer et al. | Applicant |
| US7069316(B1) | 2006-06-01 | Gryaznov | Applicant |
| US7080407(B1) | 2006-07-01 | Zhao et al. | Applicant |
| US7080408(B1) | 2006-07-01 | Pak et al. | Applicant |
| US7093002(B2) | 2006-08-01 | Wolff et al. | Applicant |
| US7093239(B1) | 2006-08-01 | van der Made | Applicant |
| US7096498(B2) | 2006-08-01 | Judge | Applicant |
| US7100201(B2) | 2006-08-01 | Izatt | Applicant |
| US7107617(B2) | 2006-09-01 | Hursey et al. | Applicant |
| US7159149(B2) | 2007-01-01 | Spiegel et al. | Applicant |
| US7213260(B2) | 2007-05-01 | Judge | Applicant |
| US7231667(B2) | 2007-06-01 | Jordan | Applicant |
| US7240364(B1) | 2007-07-01 | Branscomb et al. | Applicant |
| US7240368(B1) | 2007-07-01 | Roesch et al. | Applicant |
| US7243371(B1) | 2007-07-01 | Kasper et al. | Applicant |
| US7249175(B1) | 2007-07-01 | Donaldson | Applicant |
| US7287278(B2) | 2007-10-01 | Liang | Applicant |
| US7308716(B2) | 2007-12-01 | Danford et al. | Applicant |
| US7328453(B2) | 2008-02-01 | Merkle, Jr. et al. | Applicant |
| US7346486(B2) | 2008-03-01 | Ivancic et al. | Applicant |
| US7356736(B2) | 2008-04-01 | Natvig | Applicant |
| US7386888(B2) | 2008-06-01 | Liang et al. | Applicant |
| US7392542(B2) | 2008-06-01 | Bucher | Applicant |
| US7418729(B2) | 2008-08-01 | Szor | Applicant |
| US7428300(B1) | 2008-09-01 | Drew et al. | Applicant |
| US7441272(B2) | 2008-10-01 | Durham et al. | Applicant |
| US7448084(B1) | 2008-11-01 | Apap et al. | Applicant |
| US7458098(B2) | 2008-11-01 | Judge et al. | Applicant |
| US7464404(B2) | 2008-12-01 | Carpenter et al. | Applicant |
| US7464407(B2) | 2008-12-01 | Nakae et al. | Applicant |
| US7467408(B1) | 2008-12-01 | O'Toole, Jr. | Applicant |
| US7478428(B1) | 2009-01-01 | Thomlinson | Applicant |
| US7480773(B1) | 2009-01-01 | Reed | Applicant |
| US7487543(B2) | 2009-02-01 | Arnold et al. | Applicant |
| US7496960(B1) | 2009-02-01 | Chen et al. | Applicant |
| US7496961(B2) | 2009-02-01 | Zimmer et al. | Applicant |
| US7519990(B1) | 2009-04-01 | Xie | Applicant |
| US7523493(B2) | 2009-04-01 | Liang et al. | Applicant |
| US7530104(B1) | 2009-05-01 | Thrower et al. | Applicant |
| US7540025(B2) | 2009-05-01 | Tzadikario | Applicant |
| US7546638(B2) | 2009-06-01 | Anderson et al. | Applicant |
| US7565550(B2) | 2009-07-01 | Liang et al. | Applicant |
| US7568233(B1) | 2009-07-01 | Szor et al. | Applicant |
| US7584455(B2) | 2009-09-01 | Ball | Applicant |
| US7603715(B2) | 2009-10-01 | Costa et al. | Applicant |
| US7607171(B1) | 2009-10-01 | Marsden et al. | Applicant |
| US7639714(B2) | 2009-12-01 | Stolfo et al. | Applicant |
| US7644441(B2) | 2010-01-01 | Schmid et al. | Applicant |
| US7657419(B2) | 2010-02-01 | van der Made | Applicant |
| US7676841(B2) | 2010-03-01 | Sobchuk et al. | Applicant |
| US7698548(B2) | 2010-04-01 | Shelest et al. | Applicant |
| US7707633(B2) | 2010-04-01 | Danford et al. | Applicant |
| US7712136(B2) | 2010-05-01 | Sprosts et al. | Applicant |
| US7730011(B1) | 2010-06-01 | Deninger et al. | Applicant |
| US7739740(B1) | 2010-06-01 | Nachenberg et al. | Applicant |
| US7779463(B2) | 2010-08-01 | Stolfo et al. | Applicant |
| US7784097(B1) | 2010-08-01 | Stolfo et al. | Applicant |
| US7832008(B1) | 2010-11-01 | Kraemer | Applicant |
| US7836502(B1) | 2010-11-01 | Zhao et al. | Applicant |
| US7849506(B1) | 2010-12-01 | Dansey et al. | Applicant |
| US7854007(B2) | 2010-12-01 | Sprosts et al. | Applicant |
| US7869073(B2) | 2011-01-01 | Oshima | Applicant |
| US7877803(B2) | 2011-01-01 | Enstone et al. | Applicant |
| US7904959(B2) | 2011-03-01 | Sidiroglou et al. | Applicant |
| US7908660(B2) | 2011-03-01 | Bahl | Applicant |
| US7930738(B1) | 2011-04-01 | Petersen | Applicant |
| US7937387(B2) | 2011-05-01 | Frazier et al. | Applicant |
| US7937761(B1) | 2011-05-01 | Bennett | Applicant |
| US7949849(B2) | 2011-05-01 | Lowe et al. | Applicant |
| US7996556(B2) | 2011-08-01 | Raghavan et al. | Applicant |
| US7996836(B1) | 2011-08-01 | McCorkendale et al. | Applicant |
| US7996904(B1) | 2011-08-01 | Chiueh et al. | Applicant |
| US7996905(B2) | 2011-08-01 | Arnold et al. | Applicant |
| US8006305(B2) | 2011-08-01 | Aziz | Applicant |
| US8010667(B2) | 2011-08-01 | Zhang et al. | Applicant |
| US8020206(B2) | 2011-09-01 | Hubbard et al. | Applicant |
| US8028338(B1) | 2011-09-01 | Schneider et al. | Applicant |
| US8042184(B1) | 2011-10-01 | Batenin | Applicant |
| US8045094(B2) | 2011-10-01 | Teragawa | Applicant |
| US8045458(B2) | 2011-10-01 | Alperovitch et al. | Applicant |
| US8069484(B2) | 2011-11-01 | McMillan et al. | Applicant |
| US8087086(B1) | 2011-12-01 | Lai et al. | Applicant |
| US8171553(B2) | 2012-05-01 | Aziz et al. | Applicant |
| US8176049(B2) | 2012-05-01 | Deninger et al. | Applicant |
| US8176480(B1) | 2012-05-01 | Spertus | Applicant |
| US8201246(B1) | 2012-06-01 | Wu et al. | Applicant |
| US8204984(B1) | 2012-06-01 | Aziz et al. | Applicant |
| US8214905(B1) | 2012-07-01 | Doukhvalov et al. | Applicant |
| US8220055(B1) | 2012-07-01 | Kennedy | Applicant |
| US8225288(B2) | 2012-07-01 | Miller et al. | Applicant |
| US8225373(B2) | 2012-07-01 | Kraemer | Applicant |
| US8233882(B2) | 2012-07-01 | Rogel | Applicant |
| US8234640(B1) | 2012-07-01 | Fitzgerald et al. | Applicant |
| US8234709(B2) | 2012-07-01 | Viljoen et al. | Applicant |
| US8239944(B1) | 2012-08-01 | Nachenberg et al. | Applicant |
| US8260914(B1) | 2012-09-01 | Ranjan | Applicant |
| US8266091(B1) | 2012-09-01 | Gubin et al. | Applicant |
| US8286251(B2) | 2012-10-01 | Eker et al. | Applicant |
| US8291499(B2) | 2012-10-01 | Aziz et al. | Applicant |
| US8307435(B1) | 2012-11-01 | Mann et al. | Applicant |
| US8307443(B2) | 2012-11-01 | Wang et al. | Applicant |
| US8312545(B2) | 2012-11-01 | Tuvell et al. | Applicant |
| US8321936(B1) | 2012-11-01 | Green et al. | Applicant |
| US8321941(B2) | 2012-11-01 | Tuvell et al. | Applicant |
| US8332571(B1) | 2012-12-01 | Edwards, Sr. | Applicant |
| US8365286(B2) | 2013-01-01 | Poston | Applicant |
| US8365297(B1) | 2013-01-01 | Parshin et al. | Applicant |
| US8370938(B1) | 2013-02-01 | Daswani et al. | Applicant |
| US8370939(B2) | 2013-02-01 | Zaitsev et al. | Applicant |
| US8375444(B2) | 2013-02-01 | Aziz et al. | Applicant |
| US8381299(B2) | 2013-02-01 | Stolfo et al. | Applicant |
| US8402529(B1) | 2013-03-01 | Green et al. | Applicant |
| US8464340(B2) | 2013-06-01 | Ahn et al. | Applicant |
| US8479174(B2) | 2013-07-01 | Chiriac | Applicant |
| US8479276(B1) | 2013-07-01 | Vaystikh et al. | Applicant |
| US8479291(B1) | 2013-07-01 | Bodke | Applicant |
| US8510827(B1) | 2013-08-01 | Leake et al. | Applicant |
| US8510828(B1) | 2013-08-01 | Guo et al. | Applicant |
| US8510842(B2) | 2013-08-01 | Amit et al. | Applicant |
| US8516478(B1) | 2013-08-01 | Edwards et al. | Applicant |
| US8516590(B1) | 2013-08-01 | Ranadive et al. | Applicant |
| US8516593(B2) | 2013-08-01 | Aziz | Applicant |
| US8522348(B2) | 2013-08-01 | Chen et al. | Applicant |
| US8528086(B1) | 2013-09-01 | Aziz | Applicant |
| US8533824(B2) | 2013-09-01 | Hutton et al. | Applicant |
| US8539582(B1) | 2013-09-01 | Aziz et al. | Applicant |
| US8549638(B2) | 2013-10-01 | Aziz | Applicant |
| US8555391(B1) | 2013-10-01 | Demir et al. | Applicant |
| US8561177(B1) | 2013-10-01 | Aziz et al. | Applicant |
| US8566476(B2) | 2013-10-01 | Shiffer et al. | Applicant |
| US8566946(B1) | 2013-10-01 | Aziz et al. | Applicant |
| US8584094(B2) | 2013-11-01 | Dadhia et al. | Applicant |
| US8584234(B1) | 2013-11-01 | Sobel et al. | Applicant |
| US8584239(B2) | 2013-11-01 | Aziz et al. | Applicant |
| US8595834(B2) | 2013-11-01 | Xie et al. | Applicant |
| US8627476(B1) | 2014-01-01 | Satish et al. | Applicant |
| US8635696(B1) | 2014-01-01 | Aziz | Applicant |
| US8682054(B2) | 2014-03-01 | Xue et al. | Applicant |
| US8682812(B1) | 2014-03-01 | Ranjan | Applicant |
| US8689333(B2) | 2014-04-01 | Aziz | Applicant |
| US8695096(B1) | 2014-04-01 | Zhang | Applicant |
| US8713294(B2) | 2014-04-01 | Gooding et al. | Applicant |
| US8713631(B1) | 2014-04-01 | Pavlyushchik | Applicant |
| US8713681(B2) | 2014-04-01 | Silberman et al. | Applicant |
| US8726392(B1) | 2014-05-01 | McCorkendale et al. | Applicant |
| US8739280(B2) | 2014-05-01 | Chess et al. | Applicant |
| US8776229(B1) | 2014-07-01 | Aziz | Applicant |
| US8782792(B1) | 2014-07-01 | Bodke | Applicant |
| US8789172(B2) | 2014-07-01 | Stolfo et al. | Applicant |
| US8789178(B2) | 2014-07-01 | Kejriwal et al. | Applicant |
| US8793278(B2) | 2014-07-01 | Frazier et al. | Applicant |
| US8793787(B2) | 2014-07-01 | Ismael et al. | Applicant |
| US8805947(B1) | 2014-08-01 | Kuzkin et al. | Applicant |
| US8806647(B1) | 2014-08-01 | Daswani et al. | Applicant |
| US8832829(B2) | 2014-09-01 | Manni et al. | Applicant |
| US8850570(B1) | 2014-09-01 | Ramzan | Applicant |
| US8850571(B2) | 2014-09-01 | Staniford et al. | Applicant |
| US8881234(B2) | 2014-11-01 | Narasimhan et al. | Applicant |
| US8881271(B2) | 2014-11-01 | Butler, II | Applicant |
| US8881282(B1) | 2014-11-01 | Aziz et al. | Applicant |
| US8898788(B1) | 2014-11-01 | Aziz et al. | Applicant |
| US8935779(B2) | 2015-01-01 | Manni et al. | Applicant |
| US8949257(B2) | 2015-02-01 | Shiffer et al. | Applicant |
| US8984638(B1) | 2015-03-01 | Aziz et al. | Applicant |
| US8990939(B2) | 2015-03-01 | Staniford et al. | Applicant |
| US8990944(B1) | 2015-03-01 | Singh et al. | Applicant |
| US8997219(B2) | 2015-03-01 | Staniford et al. | Applicant |
| US9009822(B1) | 2015-04-01 | Ismael et al. | Applicant |
| US9009823(B1) | 2015-04-01 | Ismael et al. | Applicant |
| US9027135(B1) | 2015-05-01 | Aziz | Applicant |
| US9071638(B1) | 2015-06-01 | Aziz et al. | Applicant |
| US9104867(B1) | 2015-08-01 | Thioux et al. | Applicant |
| US9106630(B2) | 2015-08-01 | Frazier et al. | Applicant |
| US9106694(B2) | 2015-08-01 | Aziz et al. | Applicant |
| US9118715(B2) | 2015-08-01 | Staniford et al. | Applicant |
| US9159035(B1) | 2015-10-01 | Ismael et al. | Applicant |
| US9171160(B2) | 2015-10-01 | Vincent et al. | Applicant |
| US9176843(B1) | 2015-11-01 | Ismael et al. | Applicant |
| US9189627(B1) | 2015-11-01 | Islam | Applicant |
| US9195829(B1) | 2015-11-01 | Goradia et al. | Applicant |
| US9197664(B1) | 2015-11-01 | Aziz et al. | Applicant |
| US9223972(B1) | 2015-12-01 | Vincent et al. | Applicant |
| US9225740(B1) | 2015-12-01 | Ismael et al. | Applicant |
| US9241010(B1) | 2016-01-01 | Bennett et al. | Applicant |
| US9251343(B1) | 2016-02-01 | Vincent et al. | Applicant |
| US9262635(B2) | 2016-02-01 | Paithane et al. | Applicant |
| US9268936(B2) | 2016-02-01 | Butler | Applicant |
| US9275229(B2) | 2016-03-01 | LeMasters | Applicant |
| US9282109(B1) | 2016-03-01 | Aziz et al. | Applicant |
| US9294501(B2) | 2016-03-01 | Mesdaq et al. | Applicant |
| US9300686(B2) | 2016-03-01 | Pidathala et al. | Applicant |
| US9306960(B1) | 2016-04-01 | Aziz | Applicant |
| US9306974(B1) | 2016-04-01 | Aziz et al. | Applicant |
| US9311479(B1) | 2016-04-01 | Manni et al. | Applicant |
| US9413781(B2) | 2016-08-01 | Cunningham et al. | Applicant |
| US2001/0005889(A1) | 2001-06-01 | Albrecht | Applicant |
| US2001/0047326(A1) | 2001-11-01 | Broadbent et al. | Applicant |
| US2002/0018903(A1) | 2002-02-01 | Kokubo et al. | Applicant |
| US2002/0038430(A1) | 2002-03-01 | Edwards et al. | Applicant |
| US2002/0091819(A1) | 2002-07-01 | Melchione et al. | Applicant |
| US2002/0095607(A1) | 2002-07-01 | Lin-Hendel | Applicant |
| US2002/0116627(A1) | 2002-08-01 | Tarbotton et al. | Applicant |
| US2002/0144156(A1) | 2002-10-01 | Copeland | Applicant |
| US2002/0162015(A1) | 2002-10-01 | Tang | Applicant |
| US2002/0166063(A1) | 2002-11-01 | Lachman et al. | Applicant |
| US2002/0169952(A1) | 2002-11-01 | DiSanto et al. | Applicant |
| US2002/0184528(A1) | 2002-12-01 | Shevenell et al. | Applicant |
| US2002/0188887(A1) | 2002-12-01 | Largman et al. | Applicant |
| US2002/0194490(A1) | 2002-12-01 | Halperin et al. | Applicant |
| US2003/0021728(A1) | 2003-01-01 | Sharpe et al. | Applicant |
| US2003/0074578(A1) | 2003-04-01 | Ford et al. | Applicant |
| US2003/0084318(A1) | 2003-05-01 | Schertz | Applicant |
| US2003/0101381(A1) | 2003-05-01 | Mateev et al. | Applicant |
| US2003/0115483(A1) | 2003-06-01 | Liang | Applicant |
| US2003/0188190(A1) | 2003-10-01 | Aaron et al. | Applicant |
| US2003/0191957(A1) | 2003-10-01 | Hypponen et al. | Applicant |
| US2003/0200460(A1) | 2003-10-01 | Morota et al. | Applicant |
| US2003/0212902(A1) | 2003-11-01 | van der Made | Applicant |
| US2003/0229801(A1) | 2003-12-01 | Kouznetsov et al. | Applicant |
| US2003/0237000(A1) | 2003-12-01 | Denton et al. | Applicant |
| US2004/0003323(A1) | 2004-01-01 | Bennett et al. | Applicant |
| US2004/0006473(A1) | 2004-01-01 | Mills et al. | Applicant |
| US2004/0015712(A1) | 2004-01-01 | Szor | Applicant |
| US2004/0019832(A1) | 2004-01-01 | Arnold et al. | Applicant |
| US2004/0047356(A1) | 2004-03-01 | Bauer | Applicant |
| US2004/0083408(A1) | 2004-04-01 | Spiegel et al. | Applicant |
| US2004/0088581(A1) | 2004-05-01 | Brawn et al. | Applicant |
| US2004/0093513(A1) | 2004-05-01 | Cantrell et al. | Applicant |
| US2004/0111531(A1) | 2004-06-01 | Staniford et al. | Applicant |
| US2004/0117478(A1) | 2004-06-01 | Triulzi et al. | Applicant |
| US2004/0117624(A1) | 2004-06-01 | Brandt et al. | Applicant |
| US2004/0128355(A1) | 2004-07-01 | Chao et al. | Applicant |
| US2004/0133777(A1) | 2004-07-01 | Kiriansky | Examiner |
| US2004/0165588(A1) | 2004-08-01 | Pandya | Applicant |
| US2004/0236963(A1) | 2004-11-01 | Danford et al. | Applicant |
| US2004/0243349(A1) | 2004-12-01 | Greifeneder et al. | Applicant |
| US2004/0249911(A1) | 2004-12-01 | Alkhatib et al. | Applicant |
| US2004/0255161(A1) | 2004-12-01 | Cavanaugh | Applicant |
| US2004/0268147(A1) | 2004-12-01 | Wiederin et al. | Applicant |
| US2005/0005159(A1) | 2005-01-01 | Oliphant | Applicant |
| US2005/0021740(A1) | 2005-01-01 | Bar et al. | Applicant |
| US2005/0033960(A1) | 2005-02-01 | Vialen et al. | Applicant |
| US2005/0033989(A1) | 2005-02-01 | Poletto et al. | Applicant |
| US2005/0050148(A1) | 2005-03-01 | Mohammadioun et al. | Applicant |
| US2005/0086523(A1) | 2005-04-01 | Zimmer et al. | Applicant |
| US2005/0091513(A1) | 2005-04-01 | Mitomo et al. | Applicant |
| US2005/0091533(A1) | 2005-04-01 | Omote et al. | Applicant |
| US2005/0091652(A1) | 2005-04-01 | Ross et al. | Applicant |
| US2005/0108562(A1) | 2005-05-01 | Khazan et al. | Applicant |
| US2005/0114663(A1) | 2005-05-01 | Cornell et al. | Applicant |
| US2005/0125195(A1) | 2005-06-01 | Brendel | Applicant |
| US2005/0149726(A1) | 2005-07-01 | Joshi et al. | Applicant |
| US2005/0157662(A1) | 2005-07-01 | Bingham et al. | Applicant |
| US2005/0183143(A1) | 2005-08-01 | Anderholm et al. | Applicant |
| US2005/0201297(A1) | 2005-09-01 | Peikari | Applicant |
| US2005/0210533(A1) | 2005-09-01 | Copeland et al. | Applicant |
| US2005/0238005(A1) | 2005-10-01 | Chen et al. | Applicant |
| US2005/0240781(A1) | 2005-10-01 | Gassoway | Applicant |
| US2005/0262562(A1) | 2005-11-01 | Gassoway | Applicant |
| US2005/0265331(A1) | 2005-12-01 | Stolfo | Applicant |
| US2005/0283839(A1) | 2005-12-01 | Cowburn | Applicant |
| US2006/0010495(A1) | 2006-01-01 | Cohen et al. | Applicant |
| US2006/0015416(A1) | 2006-01-01 | Hoffman et al. | Applicant |
| US2006/0015715(A1) | 2006-01-01 | Anderson | Applicant |
| US2006/0015747(A1) | 2006-01-01 | Van de Ven | Applicant |
| US2006/0021029(A1) | 2006-01-01 | Brickell et al. | Applicant |
| US2006/0021054(A1) | 2006-01-01 | Costa et al. | Applicant |
| US2006/0031476(A1) | 2006-02-01 | Mathes et al. | Applicant |
| US2006/0047665(A1) | 2006-03-01 | Neil | Applicant |
| US2006/0070130(A1) | 2006-03-01 | Costea et al. | Applicant |
| US2006/0075496(A1) | 2006-04-01 | Carpenter et al. | Applicant |
| US2006/0095968(A1) | 2006-05-01 | Portolani et al. | Applicant |
| US2006/0101516(A1) | 2006-05-01 | Sudaharan et al. | Applicant |
| US2006/0101517(A1) | 2006-05-01 | Banzhof et al. | Applicant |
| US2006/0117385(A1) | 2006-06-01 | Mester et al. | Applicant |
| US2006/0123477(A1) | 2006-06-01 | Raghavan et al. | Applicant |
| US2006/0143709(A1) | 2006-06-01 | Brooks et al. | Applicant |
| US2006/0150249(A1) | 2006-07-01 | Gassen et al. | Applicant |
| US2006/0161983(A1) | 2006-07-01 | Cothrell et al. | Applicant |
| US2006/0161987(A1) | 2006-07-01 | Levy-Yurista | Applicant |
| US2006/0161989(A1) | 2006-07-01 | Reshef et al. | Applicant |
| US2006/0164199(A1) | 2006-07-01 | Gilde et al. | Applicant |
| US2006/0173992(A1) | 2006-08-01 | Weber et al. | Applicant |
| US2006/0179147(A1) | 2006-08-01 | Tran et al. | Applicant |
| US2006/0184632(A1) | 2006-08-01 | Marino et al. | Applicant |
| US2006/0191010(A1) | 2006-08-01 | Benjamin | Applicant |
| US2006/0221956(A1) | 2006-10-01 | Narayan et al. | Applicant |
| US2006/0236393(A1) | 2006-10-01 | Kramer et al. | Applicant |
| US2006/0242709(A1) | 2006-10-01 | Seinfeld et al. | Applicant |
| US2006/0248519(A1) | 2006-11-01 | Jaeger et al. | Applicant |
| US2006/0248582(A1) | 2006-11-01 | Panjwani et al. | Applicant |
| US2006/0251104(A1) | 2006-11-01 | Koga | Applicant |
| US2006/0288417(A1) | 2006-12-01 | Bookbinder et al. | Applicant |
| US2007/0006288(A1) | 2007-01-01 | Mayfield et al. | Applicant |
| US2007/0006313(A1) | 2007-01-01 | Porras et al. | Applicant |
| US2007/0011174(A1) | 2007-01-01 | Takaragi et al. | Applicant |
| US2007/0016951(A1) | 2007-01-01 | Piccard et al. | Applicant |
| US2007/0019286(A1) | 2007-01-01 | Kikuchi | Applicant |
| US2007/0033645(A1) | 2007-02-01 | Jones | Applicant |
| US2007/0038943(A1) | 2007-02-01 | FitzGerald et al. | Applicant |
| US2007/0064689(A1) | 2007-03-01 | Shin et al. | Applicant |
| US2007/0074169(A1) | 2007-03-01 | Chess et al. | Applicant |
| US2007/0094730(A1) | 2007-04-01 | Bhikkaji et al. | Applicant |
| US2007/0101435(A1) | 2007-05-01 | Konanka et al. | Applicant |
| US2007/0128855(A1) | 2007-06-01 | Cho et al. | Applicant |
| US2007/0142030(A1) | 2007-06-01 | Sinha et al. | Applicant |
| US2007/0143827(A1) | 2007-06-01 | Nicodemus et al. | Applicant |
| US2007/0156895(A1) | 2007-07-01 | Vuong | Applicant |
| US2007/0157180(A1) | 2007-07-01 | Tillmann et al. | Applicant |
| US2007/0157306(A1) | 2007-07-01 | Elrod et al. | Applicant |
| US2007/0168988(A1) | 2007-07-01 | Eisner et al. | Applicant |
| US2007/0171824(A1) | 2007-07-01 | Ruello et al. | Applicant |
| US2007/0174915(A1) | 2007-07-01 | Gribble et al. | Applicant |
| US2007/0192500(A1) | 2007-08-01 | Lum | Applicant |
| US2007/0192858(A1) | 2007-08-01 | Lum | Applicant |
| US2007/0198275(A1) | 2007-08-01 | Malden et al. | Applicant |
| US2007/0208822(A1) | 2007-09-01 | Wang et al. | Applicant |
| US2007/0220607(A1) | 2007-09-01 | Sprosts et al. | Applicant |
| US2007/0240218(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240219(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240220(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240222(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0250930(A1) | 2007-10-01 | Aziz et al. | Applicant |
| US2007/0256132(A2) | 2007-11-01 | Oliphant | Applicant |
| US2007/0271446(A1) | 2007-11-01 | Nakamura | Applicant |
| US2008/0005782(A1) | 2008-01-01 | Aziz | Applicant |
| US2008/0018122(A1) | 2008-01-01 | Zierler et al. | Applicant |
| US2008/0028463(A1) | 2008-01-01 | Dagon et al. | Applicant |
| US2008/0040710(A1) | 2008-02-01 | Chiriac | Applicant |
| US2008/0046781(A1) | 2008-02-01 | Childs et al. | Applicant |
| US2008/0066179(A1) | 2008-03-01 | Liu | Applicant |
| US2008/0072326(A1) | 2008-03-01 | Danford et al. | Applicant |
| US2008/0077793(A1) | 2008-03-01 | Tan et al. | Applicant |
| US2008/0080518(A1) | 2008-04-01 | Hoeflin et al. | Applicant |
| US2008/0086720(A1) | 2008-04-01 | Lekel | Applicant |
| US2008/0098476(A1) | 2008-04-01 | Syversen | Applicant |
| US2008/0120722(A1) | 2008-05-01 | Sima et al. | Applicant |
| US2008/0134178(A1) | 2008-06-01 | Fitzgerald et al. | Applicant |
| US2008/0134334(A1) | 2008-06-01 | Kim et al. | Applicant |
| US2008/0141376(A1) | 2008-06-01 | Clausen et al. | Applicant |
| US2008/0184367(A1) | 2008-07-01 | McMillan et al. | Applicant |
| US2008/0184373(A1) | 2008-07-01 | Traut et al. | Applicant |
| US2008/0189787(A1) | 2008-08-01 | Arnold et al. | Applicant |
| US2008/0201778(A1) | 2008-08-01 | Guo et al. | Applicant |
| US2008/0209557(A1) | 2008-08-01 | Herley et al. | Applicant |
| US2008/0215742(A1) | 2008-09-01 | Goldszmidt et al. | Applicant |
| US2008/0222729(A1) | 2008-09-01 | Chen et al. | Applicant |
| US2008/0263665(A1) | 2008-10-01 | Ma et al. | Applicant |
| US2008/0295172(A1) | 2008-11-01 | Bohacek | Applicant |
| US2008/0301810(A1) | 2008-12-01 | Lehane et al. | Applicant |
| US2008/0307524(A1) | 2008-12-01 | Singh et al. | Applicant |
| US2008/0313738(A1) | 2008-12-01 | Enderby | Applicant |
| US2008/0320594(A1) | 2008-12-01 | Jiang | Applicant |
| US2009/0003317(A1) | 2009-01-01 | Kasralikar et al. | Applicant |
| US2009/0007100(A1) | 2009-01-01 | Field et al. | Applicant |
| US2009/0013408(A1) | 2009-01-01 | Schipka | Applicant |
| US2009/0031423(A1) | 2009-01-01 | Liu et al. | Applicant |
| US2009/0036111(A1) | 2009-02-01 | Danford et al. | Applicant |
| US2009/0037835(A1) | 2009-02-01 | Goldman | Applicant |
| US2009/0044024(A1) | 2009-02-01 | Oberheide et al. | Applicant |
| US2009/0044274(A1) | 2009-02-01 | Budko et al. | Applicant |
| US2009/0064332(A1) | 2009-03-01 | Porras et al. | Applicant |
| US2009/0077666(A1) | 2009-03-01 | Chen et al. | Applicant |
| US2009/0083369(A1) | 2009-03-01 | Marmor | Applicant |
| US2009/0083855(A1) | 2009-03-01 | Apap et al. | Applicant |
| US2009/0089879(A1) | 2009-04-01 | Wang et al. | Applicant |
| US2009/0094697(A1) | 2009-04-01 | Provos et al. | Applicant |
| US2009/0113425(A1) | 2009-04-01 | Ports et al. | Applicant |
| US2009/0125976(A1) | 2009-05-01 | Wassermann et al. | Applicant |
| US2009/0126015(A1) | 2009-05-01 | Monastyrsky et al. | Applicant |
| US2009/0126016(A1) | 2009-05-01 | Sobko et al. | Applicant |
| US2009/0133125(A1) | 2009-05-01 | Choi et al. | Applicant |
| US2009/0144823(A1) | 2009-06-01 | Lamastra et al. | Applicant |
| US2009/0158430(A1) | 2009-06-01 | Borders | Applicant |
| US2009/0172815(A1) | 2009-07-01 | Gu et al. | Applicant |
| US2009/0187992(A1) | 2009-07-01 | Poston | Applicant |
| US2009/0193293(A1) | 2009-07-01 | Stolfo et al. | Applicant |
| US2009/0198651(A1) | 2009-08-01 | Shiffer et al. | Applicant |
| US2009/0198670(A1) | 2009-08-01 | Shiffer et al. | Applicant |
| US2009/0198689(A1) | 2009-08-01 | Frazier et al. | Applicant |
| US2009/0199274(A1) | 2009-08-01 | Frazier et al. | Applicant |
| US2009/0199296(A1) | 2009-08-01 | Xie et al. | Applicant |
| US2009/0228233(A1) | 2009-09-01 | Anderson et al. | Applicant |
| US2009/0241187(A1) | 2009-09-01 | Troyansky | Applicant |
| US2009/0241190(A1) | 2009-09-01 | Todd et al. | Applicant |
| US2009/0265692(A1) | 2009-10-01 | Godefroid et al. | Applicant |
| US2009/0271867(A1) | 2009-10-01 | Zhang | Applicant |
| US2009/0300415(A1) | 2009-12-01 | Zhang et al. | Applicant |
| US2009/0300761(A1) | 2009-12-01 | Park et al. | Applicant |
| US2009/0328185(A1) | 2009-12-01 | Berg et al. | Applicant |
| US2009/0328221(A1) | 2009-12-01 | Blumfield et al. | Applicant |
| US2010/0005146(A1) | 2010-01-01 | Drako et al. | Applicant |
| US2010/0011205(A1) | 2010-01-01 | McKenna | Applicant |
| US2010/0017546(A1) | 2010-01-01 | Poo et al. | Applicant |
| US2010/0030996(A1) | 2010-02-01 | Butler, II | Applicant |
| US2010/0031353(A1) | 2010-02-01 | Thomas et al. | Applicant |
| US2010/0037314(A1) | 2010-02-01 | Perdisci et al. | Applicant |
| US2010/0043073(A1) | 2010-02-01 | Kuwamura | Applicant |
| US2010/0054278(A1) | 2010-03-01 | Stolfo et al. | Applicant |
| US2010/0058474(A1) | 2010-03-01 | Hicks | Applicant |
| US2010/0064044(A1) | 2010-03-01 | Nonoyama | Applicant |
| US2010/0077481(A1) | 2010-03-01 | Polyakov et al. | Applicant |
| US2010/0083376(A1) | 2010-04-01 | Pereira et al. | Applicant |
| US2010/0115621(A1) | 2010-05-01 | Staniford et al. | Applicant |
| US2010/0132038(A1) | 2010-05-01 | Zaitsev | Applicant |
| US2010/0154056(A1) | 2010-06-01 | Smith et al. | Applicant |
| US2010/0180344(A1) | 2010-07-01 | Malyshev et al. | Applicant |
| US2010/0192223(A1) | 2010-07-01 | Ismael et al. | Applicant |
| US2010/0220863(A1) | 2010-09-01 | Dupaquis et al. | Applicant |
| US2010/0235831(A1) | 2010-09-01 | Dittmer | Applicant |
| US2010/0251104(A1) | 2010-09-01 | Massand | Applicant |
| US2010/0281102(A1) | 2010-11-01 | Chinta et al. | Applicant |
| US2010/0281541(A1) | 2010-11-01 | Stolfo et al. | Applicant |
| US2010/0281542(A1) | 2010-11-01 | Stolfo et al. | Applicant |
| US2010/0287260(A1) | 2010-11-01 | Peterson et al. | Applicant |
| US2010/0299754(A1) | 2010-11-01 | Amit et al. | Applicant |
| US2010/0306173(A1) | 2010-12-01 | Frank | Applicant |
| US2011/0004737(A1) | 2011-01-01 | Greenebaum | Applicant |
| US2011/0025504(A1) | 2011-02-01 | Lyon et al. | Applicant |
| US2011/0041179(A1) | 2011-02-01 | St Hlberg | Applicant |
| US2011/0047594(A1) | 2011-02-01 | Mahaffey et al. | Applicant |
| US2011/0047620(A1) | 2011-02-01 | Mahaffey et al. | Applicant |
| US2011/0055907(A1) | 2011-03-01 | Narasimhan et al. | Applicant |
| US2011/0078794(A1) | 2011-03-01 | Manni et al. | Applicant |
| US2011/0093951(A1) | 2011-04-01 | Aziz | Applicant |
| US2011/0099620(A1) | 2011-04-01 | Stavrou et al. | Applicant |
| US2011/0099633(A1) | 2011-04-01 | Aziz | Applicant |
| US2011/0099635(A1) | 2011-04-01 | Silberman et al. | Applicant |
| US2011/0113231(A1) | 2011-05-01 | Kaminsky | Applicant |
| US2011/0119445(A1) | 2011-05-01 | Gooding et al. | Applicant |
| US2011/0145918(A1) | 2011-06-01 | Jung et al. | Applicant |
| US2011/0145920(A1) | 2011-06-01 | Mahaffey et al. | Applicant |
| US2011/0145934(A1) | 2011-06-01 | Abramovici et al. | Applicant |
| US2011/0167493(A1) | 2011-07-01 | Song et al. | Applicant |
| US2011/0167494(A1) | 2011-07-01 | Bowen et al. | Applicant |
| US2011/0173213(A1) | 2011-07-01 | Frazier et al. | Applicant |
| US2011/0173460(A1) | 2011-07-01 | Ito et al. | Applicant |
| US2011/0219449(A1) | 2011-09-01 | St. Neitzel et al. | Applicant |
| US2011/0219450(A1) | 2011-09-01 | McDougal et al. | Applicant |
| US2011/0225624(A1) | 2011-09-01 | Sawhney et al. | Applicant |
| US2011/0225655(A1) | 2011-09-01 | Niemela et al. | Applicant |
| US2011/0247072(A1) | 2011-10-01 | Staniford et al. | Applicant |
| US2011/0265182(A1) | 2011-10-01 | Peinado et al. | Applicant |
| US2011/0289582(A1) | 2011-11-01 | Kejriwal et al. | Applicant |
| US2011/0302587(A1) | 2011-12-01 | Nishikawa et al. | Applicant |
| US2011/0307954(A1) | 2011-12-01 | Melnik et al. | Applicant |
| US2011/0307955(A1) | 2011-12-01 | Kaplan et al. | Applicant |
| US2011/0307956(A1) | 2011-12-01 | Yermakov et al. | Applicant |
| US2011/0314546(A1) | 2011-12-01 | Aziz et al. | Applicant |
| US2012/0023593(A1) | 2012-01-01 | Puder et al. | Applicant |
| US2012/0054869(A1) | 2012-03-01 | Yen et al. | Applicant |
| US2012/0066698(A1) | 2012-03-01 | Yanoo | Applicant |
| US2012/0079596(A1) | 2012-03-01 | Thomas et al. | Applicant |
| US2012/0084859(A1) | 2012-04-01 | Radinsky et al. | Applicant |
| US2012/0096553(A1) | 2012-04-01 | Srivastava et al. | Applicant |
| US2012/0110667(A1) | 2012-05-01 | Zubrilin et al. | Applicant |
| US2012/0117652(A1) | 2012-05-01 | Manni et al. | Applicant |
| US2012/0121154(A1) | 2012-05-01 | Xue et al. | Applicant |
| US2012/0124426(A1) | 2012-05-01 | Maybee et al. | Applicant |
| US2012/0174186(A1) | 2012-07-01 | Aziz et al. | Applicant |
| US2012/0174196(A1) | 2012-07-01 | Bhogavilli et al. | Applicant |
| US2012/0174218(A1) | 2012-07-01 | McCoy et al. | Applicant |
| US2012/0198279(A1) | 2012-08-01 | Schroeder | Applicant |
| US2012/0210423(A1) | 2012-08-01 | Friedrichs et al. | Applicant |
| US2012/0222121(A1) | 2012-08-01 | Staniford et al. | Applicant |
| US2012/0255015(A1) | 2012-10-01 | Sahita et al. | Applicant |
| US2012/0255017(A1) | 2012-10-01 | Sallam | Applicant |
| US2012/0260342(A1) | 2012-10-01 | Dube et al. | Applicant |
| US2012/0266244(A1) | 2012-10-01 | Green et al. | Applicant |
| US2012/0278886(A1) | 2012-11-01 | Luna | Applicant |
| US2012/0297489(A1) | 2012-11-01 | DeQuevy | Applicant |
| US2012/0330801(A1) | 2012-12-01 | McDougal et al. | Applicant |
| US2012/0331553(A1) | 2012-12-01 | Aziz et al. | Applicant |
| US2013/0014259(A1) | 2013-01-01 | Gribble et al. | Applicant |
| US2013/0036472(A1) | 2013-02-01 | Aziz | Applicant |
| US2013/0047257(A1) | 2013-02-01 | Aziz | Applicant |
| US2013/0074185(A1) | 2013-03-01 | McDougal et al. | Applicant |
| US2013/0086684(A1) | 2013-04-01 | Mohler | Applicant |
| US2013/0097699(A1) | 2013-04-01 | Balupari et al. | Applicant |
| US2013/0097706(A1) | 2013-04-01 | Titonis et al. | Applicant |
| US2013/0111587(A1) | 2013-05-01 | Goel et al. | Applicant |
| US2013/0117852(A1) | 2013-05-01 | Stute | Applicant |
| US2013/0117855(A1) | 2013-05-01 | Kim et al. | Applicant |
| US2013/0139264(A1) | 2013-05-01 | Brinkley et al. | Applicant |
| US2013/0160125(A1) | 2013-06-01 | Likhachev et al. | Applicant |
| US2013/0160127(A1) | 2013-06-01 | Jeong et al. | Applicant |
| US2013/0160130(A1) | 2013-06-01 | Mendelev et al. | Applicant |
| US2013/0160131(A1) | 2013-06-01 | Madou et al. | Applicant |
| US2013/0167236(A1) | 2013-06-01 | Sick | Applicant |
| US2013/0174214(A1) | 2013-07-01 | Duncan | Applicant |
| US2013/0185789(A1) | 2013-07-01 | Hagiwara et al. | Applicant |
| US2013/0185795(A1) | 2013-07-01 | Winn et al. | Applicant |
| US2013/0185798(A1) | 2013-07-01 | Saunders et al. | Applicant |
| US2013/0191915(A1) | 2013-07-01 | Antonakakis et al. | Applicant |
| US2013/0196649(A1) | 2013-08-01 | Paddon et al. | Applicant |
| US2013/0227691(A1) | 2013-08-01 | Aziz et al. | Applicant |
| US2013/0246370(A1) | 2013-09-01 | Bartram et al. | Applicant |
| US2013/0247186(A1) | 2013-09-01 | LeMasters | Applicant |
| US2013/0263260(A1) | 2013-10-01 | Mahaffey et al. | Applicant |
| US2013/0291109(A1) | 2013-10-01 | Staniford et al. | Applicant |
| US2013/0298243(A1) | 2013-11-01 | Kumar et al. | Applicant |
| US2013/0318038(A1) | 2013-11-01 | Shiffer et al. | Applicant |
| US2013/0318073(A1) | 2013-11-01 | Shiffer et al. | Applicant |
| US2013/0325791(A1) | 2013-12-01 | Shiffer et al. | Applicant |
| US2013/0325792(A1) | 2013-12-01 | Shiffer et al. | Applicant |
| US2013/0325871(A1) | 2013-12-01 | Shiffer et al. | Applicant |
| US2013/0325872(A1) | 2013-12-01 | Shiffer et al. | Applicant |
| US2014/0032875(A1) | 2014-01-01 | Butler | Applicant |
| US2014/0053260(A1) | 2014-02-01 | Gupta et al. | Applicant |
| US2014/0053261(A1) | 2014-02-01 | Gupta et al. | Applicant |
| US2014/0130158(A1) | 2014-05-01 | Wang et al. | Applicant |
| US2014/0137180(A1) | 2014-05-01 | Lukacs et al. | Applicant |
| US2014/0169762(A1) | 2014-06-01 | Ryu | Applicant |
| US2014/0179360(A1) | 2014-06-01 | Jackson et al. | Applicant |
| US2014/0181131(A1) | 2014-06-01 | Ross | Applicant |
| US2014/0189687(A1) | 2014-07-01 | Jung et al. | Applicant |
| US2014/0189866(A1) | 2014-07-01 | Shiffer et al. | Applicant |
| US2014/0189882(A1) | 2014-07-01 | Jung et al. | Applicant |
| US2014/0237600(A1) | 2014-08-01 | Silberman et al. | Applicant |
| US2014/0280245(A1) | 2014-09-01 | Wilson | Applicant |
| US2014/0283037(A1) | 2014-09-01 | Sikorski et al. | Applicant |
| US2014/0283063(A1) | 2014-09-01 | Thompson et al. | Applicant |
| US2014/0328204(A1) | 2014-11-01 | Klotsche et al. | Applicant |
| US2014/0337836(A1) | 2014-11-01 | Ismael | Applicant |
| US2014/0344926(A1) | 2014-11-01 | Cunningham et al. | Applicant |
| US2014/0351935(A1) | 2014-11-01 | Shao et al. | Applicant |
| US2014/0351941(A1) | 2014-11-01 | Teller et al. | Applicant |
| US2014/0380473(A1) | 2014-12-01 | Bu et al. | Applicant |
| US2014/0380474(A1) | 2014-12-01 | Paithane et al. | Applicant |
| US2015/0007312(A1) | 2015-01-01 | Pidathala et al. | Applicant |
| US2015/0096022(A1) | 2015-04-01 | Vincent et al. | Applicant |
| US2015/0096023(A1) | 2015-04-01 | Mesdaq et al. | Applicant |
| US2015/0096024(A1) | 2015-04-01 | Haq et al. | Applicant |
| US2015/0096025(A1) | 2015-04-01 | Ismael | Applicant |
| US2015/0180886(A1) | 2015-06-01 | Staniford et al. | Applicant |
| US2015/0186645(A1) | 2015-07-01 | Aziz et al. | Applicant |
| US2015/0220735(A1) | 2015-08-01 | Paithane et al. | Applicant |
| US2015/0372980(A1) | 2015-12-01 | Eyada | Applicant |
| US2016/0044000(A1) | 2016-02-01 | Cunningham | Applicant |
| US2016/0127393(A1) | 2016-05-01 | Aziz et al. | Applicant |
| GB2439806(A) | 2008-01-01 | Applicant | |
| GB2490431(A) | 2012-10-01 | Applicant | |
| WO2/23805(A2) | 2002-03-01 | Applicant | |
| WO206928 | 2003-11-01 | Applicant | |
| WO2007117636(A2) | 2007-10-01 | Applicant | |
| WO2008041950(A2) | 2008-04-01 | Applicant | |
| WO2011084431(A2) | 2011-07-01 | Applicant | |
| WO2011/112348(A1) | 2011-09-01 | Applicant | |
| WO2012/075336(A1) | 2012-06-01 | Applicant | |
| WO2012145066(A1) | 2012-10-01 | Applicant | |
| WO2013/067505(A1) | 2013-05-01 | Applicant |
Non-Patent Literature (75)
- “Mining Specification of Malicious Behavior”—Jha et al, UCSB, Sep. 2007 https://www.cs.ucsb.edu/.about.chris/research/doc/esec07.sub.--mining.pdf-.Applicant
- “Network Security: NetDetector—Network Intrusion Forensic System (NIFS) Whitepaper”, (“NetDetector Whitepaper”), (2003).Applicant
- “Packet”, Microsoft Computer Dictionary, Microsoft Press, (Mar. 2002), 1 page.Applicant
- “When Virtual is Better Than Real”, IEEEXplore Digital Library, available at, http://ieeexplore.ieee.org/xpl/articleDetails.isp?reload=true&arnumbe- r=990073, (Dec. 7, 2013).Applicant
- Abdullah, et al., Visualizing Network Data for Intrusion Detection, 2005 IEEE Workshop on Information Assurance and Security, pp. 100-108.Applicant
- Adetoye, Adedayo , et al., “Network Intrusion Detection & Response System”, (“Adetoye”), (Sep. 2003).Applicant
- AltaVista Advanced Search Results. “attack vector identifier”. Http://www.altavista.com/web/results?Itag=ody&pg=aq&aqmode=aqa=Event+Orch- estrator . . . , (Accessed on Sep. 15, 2009).Applicant
- AltaVista Advanced Search Results. “Event Orchestrator”. Http://www.altavista.com/web/results?Itag=ody&pg=aq&aqmode=aqa=Event+Orch- esrator . . . , (Accessed on Sep. 3, 2009).Applicant
- Apostolopoulos, George; hassapis, Constantinos; “V-eM: A cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation”, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126.Applicant
- Aura, Tuomas, “Scanning electronic documents for personally identifiable information”, Proceedings of the 5th ACM workshop on Privacy in electronic society. ACM, 2006.Applicant
- Baecher, “The Nepenthes Platform: An Efficient Approach to collect Malware”, Springer-verlag Berlin Heidelberg, (2006), pp. 165-184.Applicant
- Baldi, Mario; Risso, Fulvio; “A Framework for Rapid Development and Portable Execution of Packet-Handling Applications”, 5th IEEE International Symposium Processing and Information Technology, Dec. 21, 2005, pp. 233-238.Applicant
- Bayer, et al., “Dynamic Analysis of Malicious Code”, J Comput Virol, Springer-Verlag, France., (2006), pp. 67-77.Applicant
- Boubalos, Chris , “extracting syslog data out of raw pcap dumps, seclists.org, Honeypots mailing list archives”, available at http://seclists.org/honeypots/2003/q2/319 (“Boubalos”), (Jun. 5, 2003).Applicant
- Chaudet, C. , et al., “Optimal Positioning of Active and Passive Monitoring Devices”, International Conference on Emerging Networking Experiments and Technologies, Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology, CoNEXT '05, Toulousse, France, (Oct. 2005), pp. 71-82.Applicant
- Chen, P. M. and Noble, B. D., “When Virtual is Better Than Real, Department of Electrical Engineering and Computer Science”, University of Michigan (“Chen”) (2001).Applicant
- Cisco “Intrusion Prevention for the Cisco ASA 5500-x Series” Data Sheet (2012).Applicant
- Cisco, Configuring the Catalyst Switched Port Analyzer (SPAN) (“Cisco”), (1992-2003).Applicant
- Clark, John, Sylvian Leblanc,and Scott Knight. “Risks associated with usb hardware trojan devices used by insiders.” Systems Conference (SysCon), 2011 IEEE International. IEEE, 2011.Applicant
- Cohen, M.I. , “PyFlag—An advanced network forensic framework”, Digital investigation 5, Elsevier, (2008), pp. S112-S120.Applicant
- Costa, M. , et al., “Vigilante: End-to-End Containment of Internet Worms”, SOSP '05, Association for Computing Machinery, Inc., Brighton U.K., (Oct. 23-26, 2005).Applicant
- Crandall, J.R. , et al., “Minos:Control Data Attack Prevention Orthogonal to Memory Model”, 37th International Symposium on Microarchitecture, Portland, Oregon, (Dec. 2004).Applicant
- Deutsch, P. , “Zlib compressed data format specification version 3.3” RFC 1950, (1996).Applicant
- Distler, “Malware Analysis: An Introduction”, SANS Institute InfoSec Reading Room, SANS Institute, (2007).Applicant
- Dunlap, George W. , et al., “ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay”, Proceeding of the 5th Symposium on Operating Systems Design and Implementation, USENIX Association, (“Dunlap”), (Dec. 9, 2002).Applicant
- Excerpt regarding First Printing Date for Merike Kaeo, Designing Network Security (“Kaeo”), (2005).Applicant
- Filiol, Eric , et al., “Combinatorial Optimisation of Worm Propagation on an Unknown Network”, International Journal of Computer Science 2.2 (2007).Applicant
- FireEye Malware Analysis & Exchange Network, Malware Protection System, FireEye Inc., 2010.Applicant
- FireEye Malware Analysis, Modern Malware Forensics, FireEye Inc., 2010.Applicant
- FireEye v.6.0 Security Target, pp. 1-35, Version 1.1, FireEye Inc., May 2011.Applicant
- Gibler, Clint, et al. AndroidLeaks: automatically detecting potential privacy leaks in android applications on a large scale. Springer Berlin Heidelberg, 2012.Applicant
- Goel, et al., Reconstructing System State for Intrusion Analysis, Apr. 2008 SIGOPS Operating Systems Review, vol. 42 Issue 3, pp. 21-28.Applicant
- Gregg Keizer: “Microsoft's HoneyMonkeys Show Patching Windows Works”, Aug. 8, 2005, XP055143386, Retrieved from the Internet: URL:http://www.informationweek.com/microsofts-honeymonkeys-show-patching-windows-works/d/d-d/1035069? [retrieved on Jun. 1, 2016].Applicant
- Heng Yin et al, Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis, Research Showcase © CMU, Carnegie Mellon University, 2007.Applicant
- Hjelmvik, Erik , “Passive Network Security Analysis with NetworkMiner”, (IN)Secure, Issue 18, (Oct. 2008), pp. 1-100.Applicant
- Idika et al., A-Survey-of-Malware-Detection-Techniques, Feb. 2, 2007, Department of Computer Science, Purdue University.Applicant
- IEEE Xplore Digital Library Sear Results for “detection of unknown computer worms”. Http//ieeexplore.ieee.org/searchresult.jsp?SortField=Score&SortOrder=desc- &ResultC . . . , (Accessed on Aug. 28, 2009).Applicant
- Isohara, Takamasa, Keisuke Takemori, and Ayumu Kubota. “Kernel-based behavior analysis for android malware detection.” Computational intelligence and Security (CIS), 2011 Seventh International Conference on. IEEE, 2011.Applicant
- Kaeo, Merike , “Designing Network Security”, (“Kaeo”), (Nov. 2003).Applicant
- Kevin A Roundy et al: “Hybrid Analysis and Control of Malware”, Sep. 15, 2010, Recent Advances in Intrusion Detection, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 317-338, XP019150454 ISBN:978-3-642-15511-6.Applicant
- Kim, H. , et al., “Autograph: Toward Automated, Distributed Worm Signature Detection”, Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, (Aug. 2004), pp. 271-286.Applicant
- King, Samuel T., et al., “Operating System Support for Virtual Machines”, (“King”) (2003).Applicant
- Krasnyansky, Max , et al., Universal TUN/TAP driver, available at https://www.kernel.org/doc/Documentation/networking/tuntap.txt (2002) (“Krasnyansky”).Applicant
- Kreibich, C. , et al., “Honeycomb-Creating Intrusion Detection Signatures Using Honeypots”, 2nd Workshop on Hot Topics in Networks (HotNets-11), Boston, USA, (2003).Applicant
- Kristoff, J. , “Botnets, Detection and Mitigation: DNS-Based Techniques”, NU Security Day, (2005), 23 pages.Applicant
- Leading Colleges Select FireEye to Stop Malware-Related Data Breaches, FireEye Inc., 2009.Applicant
- Li et al., A VMM-Based System Call Interposition Framework for Program Monitoring, Dec. 2010, IEEE 16th International Conference on Parallel and Distributed Systems, pp. 706-711.Applicant
- Liljenstam, Michael , et al., “Simulating Realistic Network Traffic for Worm Warning System Design and Testing”, Institute for Security Technology studies, Dartmouth College (“Liljenstam”), (Oct. 27, 2003).Applicant
- Lindorfer, Martina, Clemens Kolbitsch, and Paolo Milani Comparetti. “Detecting environment-sensitive malware.” Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2011.Applicant
- Lok Kwong et al: “DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis”, Aug. 10, 2012, XP055158513, Retrieved from the Internet: URL:https://www.usenix.org/system/files/conference/usenixsecurity12/sec12- -final107.pdf [retrieved on Dec. 15, 2014].Applicant
- Marchette, David J., “Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint”, (“Marchette”), (2001).Applicant
- Margolis, P.E. , “Random House Webster's ‘Computer & Internet Dictionary 3rd Edition’”, ISBN 0375703519, (Dec. 1998).Applicant
- Moore, D , et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, INFOCOM, vol. 3, (Mar. 30-Apr. 3, 2003), pp. 1901-1910.Applicant
- Morales, Jose A., et al., ““Analyzing and exploiting network behaviors of malware.””, Security and Privacy in Communication Networks. Springer Berlin Heidelberg, 2010. 20-34.Applicant
- Mori, Detecting Unknown Computer Viruses, 2004, Springer-Verlag Berlin Heidelberg.Applicant
- Natvig, Kurt , “SANDBOXII: Internet”, Virus Bulletin Conference, (“Natvig”), (Sep. 2002).Applicant
- NetBIOS Working Group. Protocol Standard for a NetBIOS Service on a TCP/UDP transport: Concepts and Methods. STD 19, RFC 1001, Mar. 1987.Applicant
- Newsome, J. , et al., “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”, In Proceedings of the 12th Annual Network and Distributed System Security, Symposium (NDSS '05), (Feb. 2005).Applicant
- Newsome, J. , et al., “Polygraph: Automatically Generating Signatures for Polymorphic Worms”, In Proceedings of the IEEE Symposium on Security and Privacy, (May 2005).Applicant
- Nojiri, D. , et al., “Cooperation Response Strategies for Large Scale Attack Mitigation”, DARPA Information Survivability Conference and Exposition, vol. 1, (Apr. 22-24, 2003), pp. 293-302.Applicant
- Oberheide et al., CloudAV.sub.--N-Version Antivirus in the Network Cloud, 17th USENIX Security Symposium USENIX Security '08 Jul. 28-Aug. 1, 2008 San Jose, CA.Applicant
- Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Roonald Perez, Leendert van Doorn, John Linwood Griffin, Stefan Berger., sHype: Secure Hypervisor Appraoch to Trusted Virtualized Systems (Feb. 2, 2005) (“Sailer”).Applicant
- Silicon Defense, “Worm Containment in the Internal Network”, (Mar. 2003), pp. 1-25.Applicant
- Singh, S. , et al., “Automated Worm Fingerprinting”, Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, California, (Dec. 2004).Applicant
- Spitzner, Lance , “Honeypots: Tracking Hackers”, (“Spizner”), (Sep. 17, 2002).Applicant
- The Sniffers's Guide to Raw Traffic available at: yuba.stanford.edu/.about.casado/pcap/section1.html, (Jan. 6, 2014).Applicant
- Thomas H. Ptacek, and Timothy N. Newsham , “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, Secure Networks, (“Ptacek”), (Jan. 1998).Applicant
- U.S. Pat. No. 8,171,553 filed Apr. 20, 2006, Inter Parties Review Decision dated Jul. 10, 2015.Applicant
- U.S. Pat. No. 8,291,499 filed Mar. 16, 2012, Inter Parties Review Decision dated Jul. 10, 2015.Applicant
- Venezia, Paul , “NetDetector Captures Intrusions”, InfoWorld Issue 27, (“Venezia”), (Jul. 14, 2003).Applicant
- Wahid et al., Characterising the Evolution in Scanning Activity of Suspicious Hosts, Oct. 2009, Third International Conference on Network and System Security, pp. 344-350.Applicant
- Whyte, et al., “DNS-Based Detection of Scanning Works in an Enterprise Network”, Proceedings of the 12th Annual Network and Distributed System Security Symposium, (Feb. 2005), 15 pages.Applicant
- Williamson, Matthew M., “Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code”, ACSAC Conference, Las Vegas, NV, USA, (Dec. 2002), pp. 1-9.Applicant
- Yuhei Kawakoya et al: “Memory behavior-based automatic malware unpacking in stealth debugging environment”, Malicious and Unwanted Software (Malware), 2010 5th International Conference on, IEEE, Piscataway, NJ, USA, Oct. 19, 2010, pp. 39-46, XP031833827, ISBN:978-1-4244-8-9353-1.Applicant
- Zhang et al., The Effects of Threading, Infection Time, and Multiple-Attacker Collaboration on Malware Propagation, Sep. 2009, IEEE 28th International Symposium on Reliable Distributed Systems, pp. 73-82.Applicant