US 9,954,890 B1Grant

Systems and methods for analyzing PDF documents

Issue Date:2018-04-24

•61 Claims

•8 Drawing Sheets

Abstract

A system and method for detecting malicious activity within a Portable Document Format (PDF) document. The system includes a parser and one or more virtual machines. The parser that, when executed by a hardware processor, examines one or more portions of the PDF document to determine if one or more suspicious characteristics indicative of malicious network content are included in the one or more examined portions of the PDF document. The examined portion(s) in total are less than an entirety of the PDF document. The virtual machine(s) are adapted to receive the PDF document in response to the one or more examined portions of the PDF document being determined to include one or more suspicious characteristics indicative of malicious network content. The virtual machine(s) to process at least the one or more examined portions of the PDF document so as to determine whether the PDF document includes malicious network content.

Metadata

Assignee

FireEye, Inc.

Inventors

Stuart Gresley Staniford
Ashar Aziz

Application Information

Application Number:US 15/256,367

Filing Date:2016-09-02

Priority Date:2008-11-03

Art Unit:2493

Classifications

IPC:

H04L29/06G06F21/56

Field of Search:

G06F 21/562G06F 21/566H04L 63/1408H04L 63/145

Patent Drawings (8 sheets)

Description

CROSS REFERENCE TO RELATED APPLICATIONS

[0001] This application is a continuation of U.S. patent application Ser. No. 14/673,292 filed Mar. 30, 2015, now U.S. Pat. No. 9,438,622 issued Sep. 6, 2016, entitled “Systems and Methods for Analyzing Malicious PDF Network Content, which is a continuation of U.S. patent application Ser. No. 13/011,344 filed on Jan. 21, 2011, now U.S. Pat. No. 8,997,219 issued Mar. 31, 2015, which is a continuation-in-part of U.S. patent application Ser. No. 12/263,971 entitled “Systems and Methods for Detecting Malicious Network Content” and filed on Nov. 3, 2008, now U.S. Pat. No. 8,850,571 issued Sep. 30, 2014. This application is also related to co-pending U.S. patent application Ser. No. 11/409,355 entitled “Heuristic Based Capture with Replay to Virtual Machine” and filed on Apr. 20, 2006, which is a continuation-in-part of U.S. patent application Ser. No. 11/152,286 entitled “Computer Worm Defense System and Method” and filed on Jun. 13, 2005, which claims the priority benefit of U.S. Provisional Patent Application Ser. No. 60/579,910 entitled “Computer Worm Defense System and Method” and filed on Jun. 14, 2004. U.S. patent application Ser. No. 11/409,355 is also a continuation-in-part of U.S. patent application Ser. No. 11/096,287 entitled “System and Method of Detecting Computer Worms” and filed on Mar. 31, 2005, which claims the priority benefit of U.S. Provisional Patent Application Ser. No. 60/559,198 entitled “System and Method of Detecting Computer Worms” and filed on Apr. 1, 2004. U.S. patent application Ser. No. 11/409,355 is also a continuation-in-part of U.S. patent application Ser. No. 11/151,812 entitled “System and Method of Containing Computer Worms” and filed on Jun. 13, 2005, which claims the priority benefit of U.S. Provisional Patent Application No. 60/579,953 entitled “System and Method of Containing Computer Worms” and filed on Jun. 14, 2004. Each of the aforementioned patent applications are incorporated by reference herein.

BACKGROUND

1. Field

[0002] The present invention relates generally to network security and more particularly to detecting malicious network content.

2. Discussion of Related Art

[0003] Presently, malicious network content (e.g., malicious software or malware) can attack various devices via a communication network. For example, malware may include any program or file that is harmful to a computer user, such as bots, computer viruses, worms, Trojan horses, adware, spyware, or any programming that gathers information about a computer user or otherwise operates without permission.

[0004] Adware is a program configured to direct advertisements to a computer or a particular user. In one example, adware identifies the computer and/or the user to various websites visited by a browser on the computer. The website may then use the adware to either generate pop-up advertisements or otherwise direct specific advertisements to the user's browser. Spyware is a program configured to collect information regarding the user, the computer, and/or a user's network habits. In an example, spyware may collect information regarding the names and types of websites that the user browses and then transmit the information to another computer. Adware and spyware are often added to the user's computer after the user browses to a website that hosts the adware and/or spyware. The user is often unaware that these programs have been added and are similarly unaware of the adware and/or spyware's function.

[0005] Various processes and devices have been employed to prevent the problems that malicious network content can cause. For example, computers often include antivirus scanning software that scans a particular client device for viruses. Computers may also include spyware and/or adware scanning software. The scanning may be performed manually or based on a schedule specified by a user associated with the particular computer, a system administrator, and so forth. Unfortunately, by the time a virus or spyware is detected by the scanning software, some damage on the particular computer or loss of privacy may have already occurred.

[0006] In some instances, malicious network content comprises a bot. A bot is a software robot configured to remotely control all or a portion of a digital device (e.g., a computer) without authorization by the digital device's legitimate owner. Bot related activities include bot propagation and attacking other computers on a network. Bots commonly propagate by scanning nodes (e.g., computers or other digital devices) available on a network to search for a vulnerable target. When a vulnerable computer is scanned, the bot may install a copy of itself. Once installed, the new bot may continue to seek other computers on a network to infect. A bot may also be propagated by a malicious web site configured to exploit vulnerable computers that visit its web pages.

[0007] A bot may also, without the authority of the infected computer user, establish a command and control communication channel to receive instructions. Bots may receive command and control communication from a centralized bot server or another infected computer (e.g., via a peer-to-peer (P2P) network established by a bot on the infected computer). When a plurality of bots (i.e., a botnet) act together, the infected computers (i.e., zombies) can perform organized attacks against one or more computers on a network, or engage in criminal enterprises. In one example, bot infected computers may be directed to flood another computer on a network with excessive traffic in a denial-of-service attack. In another example, upon receiving instructions, one or more bots may direct the infected computer to transmit spam across a network. In a third example, bots may host illegal businesses such as pharmaceutical websites that sell pharmaceuticals without a prescription.

[0008] Malicious network content may be distributed over a network via web sites, e.g., servers operating on a network according to an HTTP standard. Malicious network content distributed in this manner may be actively downloaded and installed on a user's computer, without the approval or knowledge of the user, simply by accessing the web site hosting the malicious network content. The web site hosting the malicious network content may be referred to as a malicious web site. The malicious network content may be embedded within data associated with web pages hosted by the malicious web site. For example, a web page may include JavaScript code, and malicious network content may be embedded within the JavaScript code. In this example, the malicious network content embedded within the JavaScript code may be obfuscated such that it is not apparent until the JavaScript code is executed that the JavaScript code contains malicious network content. Therefore, the malicious network content may attack or infect a user's computer before detection by antivirus software, firewalls, intrusion detection systems, or the like.

[0009] Beginning on or about 2009, it became a widespread practice for the authors of bots to use malicious documents in the Portable Document Format (PDF) of Adobe Systems Inc. to propagate web borne attacks. Malicious PDF documents were hosted on web servers controlled by criminals, and then links to them created from many other websites. Innocent users could therefore accidentally, without realizing, browse a website which would cause a malicious PDF to be loaded into their browser, and from their into a PDF reader, which it would then exploit in order to gain control of the user's computer account, or entire computer. From there, malicious bot software would be installed.

SUMMARY

[0010] According to some embodiments, one embodiment of the present invention may be directed to methods detecting malicious portable document format (PDF) network content may include at least the steps of (a) examining at least a portion of received PDF network content to determine if one or more suspicious characteristics indicative of malicious network content are included in the at least a portion of PDF network content; and (b) wherein if the at least a portion of PDF network content is determined to include one or more suspicious characteristics indicative of malicious network content, providing the at least a portion of PDF network content to one or more virtual machines to verify the inclusion of malicious network content in the at least a portion of PDF network content. Other embodiments are further described and set forth in the claims below.

BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG. 1 is a diagram of an exemplary malicious network content detection environment 100.

[0012] FIG. 2 illustrates an exemplary analysis environment.

[0013] FIG. 3 illustrates an exemplary method for detecting malicious network content.

[0014] FIG. 4 illustrates another exemplary method for detecting malicious network content.

[0015] FIG. 5 illustrates an exemplary controller.

[0016] FIG. 6 illustrates an exemplary malicious PDF network content detection environment.

[0017] FIG. 7 illustrates an exemplary method for detecting malicious PDF network content.

DETAILED DESCRIPTION

[0018] Network content may include any data transmitted over a network (i.e., network data). Network data may include text, software, images, audio, or other digital data. An example of network content includes web content, or any network data that may be transmitted using a Hypertext Transfer Protocol (HTTP), HyperText Markup Language (HTML) protocol, or be transmitted in a manner suitable for display on a web browser software application. Another examples of network content includes email messages, which may be transmitted using an email protocol such as Simple Mail Transfer Protocol (SMTP), Post Office Protocol version 3 (POP3), or Internet Message Access Protocol (IMAP4). A further example of network content includes Instant Messages, which may be transmitted using an Instant Messaging protocol such as Session Initiation Protocol (SIP) or Extensible Messaging and Presence Protocol (XMPP). In addition, network content may include any network data that is transferred using other data transfer protocols, such as File Transfer Protocol (FTP). We distinguish network content from network protocol header information used for addressing, routing, and otherwise delivering the network content.

[0019] To detect malicious network content (e.g., malicious web content) being transmitted over a communication network to a computing device, a virtual machine may be used to simulate the receipt and processing of network content on the receiving system. A determination may be made as to whether the network content is malicious based on a response of the virtual machine to the network content. Sometimes, suspicious network content is determined to be non-malicious. Processing the suspicious network content in a virtual machine is an important step to determine whether the suspicious network content is in fact malicious and prevent a false assumption that the suspicious network content is malicious. False positives in detecting malicious network content may be avoided by processing suspicious network content in a virtual machine and detecting malicious network content by analyzing the virtual machine's response to the suspicious network content.

[0020] In the prior art, a proxy may be used in the network between the computing device and a web server hosting the malicious network content. The proxy may intercept a request for network content issued by a web browser executing on the computing device. The proxy may then issue the request to the web server as a proxy on behalf of the computing device. The proxy may receive a response to the request from the web server. The proxy may then process a data exchange including the request and response on a virtual machine and evaluate the virtual machine's response to the data exchange to detect malicious network content. If no malicious network content is detected, the proxy may forward the requested network content to the computing device from which the original request originated.

[0021] Because each data exchange is processed using a virtual machine, this approach is highly computation intensive, and is not scalable for large numbers of computing devices on a network. Also, because the requested network content is not delivered to the computing device until after it has been determined that the requested network content does not include malicious network content, a significant delay is introduced between the request for network content and the delivery of the requested network content.

[0022] Provos et al. (N. Provos, P. Mavrommatis, M. A. Rajab, and F. Monrose, “All your iFRAMEs Point to Us,” Google Technical Report Provos-2008a, Feb. 4, 2008) reported on an analysis of web malware using a large web repository and corpus of malicious URLs. Provos et al. collected data for the analysis by first using a machine-learning framework in a pre-processing phase to extract features from web pages in the web repository and translate the features into a likelihood score. Next, a virtual machine was used in a verification phase to verify candidates identified by the machine-learning framework. Approximately 0.1% of the web pages in the web repository were processed by the virtual machine in the verification phase. Provos et al. noted that exhaustive inspection of each URL in the repository is prohibitively expensive. The system used by Provos et al. relied on a crawler proceeding gradually through the web to gather data in the repository for inspection, and could not inspect and select web pages in transit in the network for examination in a virtual machine.

[0023] FIG. 1 is a diagram of an exemplary malicious network content detection environment 100. The malicious network content detection environment 100 comprises a server device 105, a client device 110, and a tap 115 (also known as “a data access component”), each coupled to a communication network 120. In various embodiments, there may be multiple server devices 105 and multiple client devices 110. The tap 115 is further coupled to a malicious network content detection system 125. The malicious network content detection system 125 may monitor exchanges of network content (e.g., web content) rather than intercepting and holding the network content until after determining whether the network content includes malicious network content. The malicious network content detection system 125 may be configured to inspect exchanges of network content over the communication network 120, identify suspicious network content, and analyze the suspicious network content using a virtual machine to detect malicious network content. In this way, the malicious network content detection system 125 may be computationally efficient and scalable as data traffic volume and a number of computing devices communicating over the communication network 120 increase. Therefore, the malicious network content detection system 125 may not become a bottleneck in the malicious network content detection environment 100.

[0024] The communication network 120 may include a public computer network such as the Internet, or a private computer network such as a wireless telecommunication network, wide area network, or local area network, or a combination of networks. Though the communication network 120 may include any type of network and be used to communicate different types of data, communications of web data may be discussed below for purposes of example.

[0025] The server device 105 and the client device 110 may include digital devices. Some examples of digital devices include computers, servers, laptops, personal digital assistants, and cellular telephones. The server device 105 may be configured to transmit network data over the communication network 120 to the client device 110. The client device 110 may be configured to receive the network data from the server device 105. The network data may include network content, such as web pages transmitted using a network communications protocol (e.g., Hypertext Transfer Protocol, or HTTP). In various embodiments, the server device 105 may include a web server configured to provide network content. The client device 110 may include a web browser configured to retrieve and/or display network content.

[0026] The tap 115 may include a digital data tap configured to monitor network data and provide a copy of the network data to the malicious network content detection system 125. Network data may comprise signals and data that are transmitted over the communication network 120 including data flows from the server device 105 to the client device 110. In one example, the tap 115 monitors and copies the network data without an appreciable decline in performance of the server device 105, the client device 110, or the communication network 120. The tap 115 may copy any portion of the network data. For example, the tap 115 may receive and copy any number of data packets from the network data.

[0027] In some embodiments, the network data may be organized into one or more data flows and provided to the malicious network content detection system 125. In various embodiments, the tap 115 may sample the network data based on a sampling scheme. Data flows may then be reconstructed based on the network data samples.

[0028] The tap 115 may also capture metadata from the network data. The metadata may be associated with the server device 105 and/or the client device 110. For example, the metadata may identify the server device 105 and/or the client device 110. In some embodiments, the server device 105 transmits metadata, which is captured by the tap 115. In other embodiments, a heuristic module 130 (described herein) may determine the server device 105 and the client device 110 by analyzing data packets within the network data in order to generate the metadata.

[0029] The malicious network content detection system 125 may include a digital device, software, or a combination thereof that receives network data from the tap 115. The malicious network content detection system 125 includes a heuristic module 130, a heuristics database 135, a scheduler 140, a virtual machine pool 145, and an analysis environment 150. In some embodiments, the tap 115 may be contained within the malicious network content detection system 125.

[0030] The heuristic module 130 receives the copy of the network data from the tap 115 and applies heuristics to the data to determine if the network data might contain suspicious network content. The heuristics applied by the heuristic module 130 may be based on data and/or rules stored in the heuristics database 135. In one example, the heuristic module 130 flags network data as suspicious after applying a heuristic analysis. The network data may then be buffered and organized into a data flow. The data flow may then be provided to the scheduler 140. In some embodiments, the suspicious network data is provided directly to the scheduler 140 without buffering or organizing the data flow. In other embodiments, a notification of a group of data flows (e.g., a set of related web page requests and responses) may be sent to the scheduler 140 for later retrieval by the virtual machine.

[0031] The heuristic module 130 may perform one or more heuristic analyses on the network data. The heuristic module 130 may retain data packets belonging to a particular data flow previously copied by the tap 115. In one example, the heuristic module 130 receives data packets from the tap 115 and stores the data packets within a buffer or other memory. Once the heuristic module 130 receives a predetermined number of data packets from a particular data flow, the heuristic module 130 performs the heuristics and/or probability analysis.

[0032] In some embodiments, the heuristic module 130 performs a heuristic analysis on a set of data packets belonging to a data flow and then stores the data packets within a buffer or other memory. The heuristic module 130 may then continue to receive new data packets belonging to the same data flow. Once a predetermined number of new data packets belonging to the same data flow are received, the heuristic analysis may be performed upon the combination of buffered and new data packets to determine a likelihood of suspicious network content.

[0033] In some embodiments, an optional buffer receives the flagged network data from the heuristic module 130. The buffer may be used to store and organize the flagged network data into one or more data flows before providing the one or more data flows to the scheduler 140. In various embodiments, the buffer is used to store network data until the network data is provided to the scheduler 140. In one example, the buffer stores the network data to allow other components of the malicious network content detection system 125 time to complete functions or otherwise clear data congestion.

[0034] In some embodiments, the heuristic module 130 may maintain copies of network content data of potential interest to virtual machines and provide the network content data on request (e.g., when a web browser later executes inside a virtual machine and requests entities that were transmitted on the network earlier). The length of time that the heuristic module 130 keeps this data in memory may be based on how suspicious the data is, how much workload the system is under, and/or other factors.

[0035] The scheduler 140 may identify the client device 110 and retrieve a virtual machine associated with the client device 110. A virtual machine is software that is configured to mimic the performance of a device (e.g., the client device 110). The virtual machine may be retrieved from the virtual machine pool 145. Furthermore, the scheduler 140 may identify a web browser running on the client device 110, and retrieve a virtual machine associated with the web browser.

[0036] In some embodiments, the heuristic module 130 transmits the metadata identifying the client device 110 to the scheduler 140. In other embodiments, the scheduler 140 receives one or more data packets of the network data from the heuristic module 130 and analyzes the one or more data packets to identify the client device 110. In yet other embodiments, the metadata may be received from the tap 115.

[0037] The scheduler 140 may retrieve and configure the virtual machine to mimic the pertinent performance characteristics of the client device 110. In one example, the scheduler 140 configures the characteristics of the virtual machine to mimic only those features of the client device 110 that are affected by the network data copied by the tap 115. The scheduler 140 may determine the features of the client device 110 that are affected by the network data by receiving and analyzing the network data from the tap 115. Such features of the client device 110 may include ports that are to receive the network data, select device drivers that are to respond to the network data, and any other devices coupled to or contained within the client device 110 that can respond to the network data. In other embodiments, the heuristic module 130 may determine the features of the client device 110 that are affected by the network data by receiving and analyzing the network data from the tap 115. The heuristic module 130 may then transmit the features of the client device to the scheduler 140.

[0038] The virtual machine pool 145 may be configured to store one or more virtual machines. The virtual machine pool 145 may include software and/or a storage medium capable of storing software. In one example, the virtual machine pool 145 stores a single virtual machine that can be configured by the scheduler 140 to mimic the performance of any client device 110 on the communication network 120. The virtual machine pool 145 may store any number of distinct virtual machines that can be configured to simulate the performance of a wide variety of client devices 110.

[0039] The analysis environment 150 simulates the receipt and/or display of the network content from the server device 105 after the network content is received by the client device 110 to analyze the effects of the network content upon the client device 110. The analysis environment 150 may identify the effects of malware or malicious network content by analyzing the simulation of the effects of the network content upon the client device 110 that is carried out on the virtual machine. There may be multiple analysis environments 150 to simulate multiple streams of network content. The analysis environment 150 is further discussed with respect to FIG. 2.

[0040] Although FIG. 1 depicts data transmitted from the server device 105 to the client device 110, either device can transmit and receive data from the other. Similarly, although only two devices are depicted, any number of devices can send and/or receive data across the communication network 120. Moreover, the tap 115 can monitor and copy data transmitted from multiple devices without appreciably affecting the performance of the communication network 120 or the devices coupled to the communication network 120.

[0041] FIG. 2 illustrates an exemplary analysis environment 150. The analysis environment 150 includes a replayer 205, a virtual switch 210, and a virtual machine 215. The replayer 205 receives network content that has been flagged by the heuristic module 130 and provides the network content to the virtual machine 215 via the virtual switch 210 (i.e., replays the network content) in the analysis environment 150. In some embodiments, the replayer 205 mimics the behavior of the server device 105 in transmitting the flagged network content. There may be any number of replayers 205 simulating the transmission of network content between the server device 105 and the client device 110. In a further embodiment, the replayer 205 dynamically modifies session variables, as is appropriate, to emulate a “live” client or server of the protocol sequence being replayed. In one example, dynamic variables that may be dynamically substituted include dynamically assigned ports, transaction IDs, and any other variable that is dynamic to each protocol session.

[0042] The virtual switch 210 may include software that is capable of forwarding packets of flagged network content to the virtual machine 215. In one example, the replayer 205 simulates the transmission of the data flow by the server device 105. The virtual switch 210 simulates the communication network 120, and the virtual machine 215 simulates the client device 110. The virtual switch 210 may route the data packets of the data flow to the correct ports of the virtual machine 215.

[0043] In some embodiments, requests for data from client software in the virtual machine 215 (e.g., a web browser) may be proxied by the replayer to the heuristic module 130 where the data has been cached, and a response from the heuristic module 130 may then be proxied back to the client software executing in the virtual machine 215.

[0044] The virtual machine 215 includes a representation of the client device 110 that may be provided to the analysis environment 150 by the scheduler 140. In one example, the scheduler 140 retrieves an instance of the virtual machine 215 from the virtual machine pool 145 and configures the virtual machine 215 to mimic a client device 110. The configured virtual machine 215 is then provided to the analysis environment 150 where it may receive flagged network content from the virtual switch 210.

[0045] As the analysis environment 150 simulates the transmission and reception of the network content, behavior of the virtual machine 215 can be closely monitored for unauthorized activity. If the virtual machine 215 crashes, performs illegal operations, performs abnormally, or allows access of data to an unauthorized entity (e.g., an unauthorized computer user, a bot, etc.), the analysis environment 150 may react. In one example, the analysis environment 150 may transmit a command to the client device 110 to stop accepting the network content or data flows from the server device 105.

[0046] In some embodiments, the analysis environment 150 monitors and analyzes the behavior of the virtual machine 215 in order to determine a specific type of malware or malicious network content. The analysis environment 150 may also generate computer code configured to eliminate new viruses, worms, bots, adware, spyware, or other malware or malicious network content. In various embodiments, the analysis environment 150 generates computer code configured to repair damage performed by malware or malicious network content. By simulating the transmission and reception of suspicious network content and analyzing the response of the virtual machine 215, the analysis environment 150 may identify known and previously unidentified malware and malicious network content before a computer system is damaged or compromised.

[0047] FIG. 3 illustrates an exemplary method 300 for detecting malicious network content. In step 305, a packet of network content is intercepted or copied. The packet may be intercepted and/or copied from a network data transmission between the server device 105 and an intended destination (e.g., the client device 110), such as by the tap 115. Alternatively, the packet may be intercepted and/or copied from a network data transmission between the client device 110 and an intended destination (e.g., the server device 105). The packet may include a request for data, such as network content, or data provided in response to a request.

[0048] In step 310, a packet of network content is inspected. The heuristic module 130 may utilize one or more heuristics to inspect the packet of network content for suspicious network content which indicates the potential presence of malicious network content or malware within the packet.

[0049] A packet of network content may be part of a data flow which includes additional packets of network content. For example, the packet of network content may represent a portion of a web page, while other related packets in the data flow represent additional portions of the web page. The packet of network content may be stored along with the other related packets of network content comprising the data flow, such that multiple packets of network content within the data flow may be inspected in a sequence or in parallel. The malicious network content detection system may store the packets of network content and all or a portion of a data flow. The data flow and data packets may be stored for any length of time, from a few seconds to minutes, tens of minutes, or more, for analysis at any time.

[0050] To facilitate longer storage times for data flows over a high data rate communication network, large data objects comprised of numerous data packets may be truncated to a small subset of representative data packets. Data object truncation is particularly useful where network communication bandwidth is mostly utilized by a small percentage of large data objects, such as video. For example, video data may be truncated to a few data packets, such as the first few data packets. An extent to which the large data objects are truncated may be adaptive based on available memory, data bandwidth, type of data objects, and other factors. An amount of memory allocated to storing a data flow may also be dependent upon a characteristic of the data flow, such as data type. In an example, octet streams, text streams, HTML streams, and miscellaneous binary streams may be allocated 1 megabyte (MB). Images and PDF files may be allocated 384 kilobytes (kB). Video, audio, and most other data types may be allocated 128 kB. The memory allocated to storing each data flow type may be adjusted, periodically or dynamically, to improve analysis throughput while maintaining accuracy in detection of malicious network content and working within memory limitations.

[0051] In step 315, a suspicious characteristic of the network content is identified. The heuristic module 130 may identify the suspicious characteristic of the network content as a result of inspecting the network content in step 310. When a characteristic of the packet, such as a sequence of characters or keyword, is identified that meets the conditions of a heuristic used in step 310, a suspicious characteristic or “feature” of the network content is identified. The identified features may be stored for reference and analysis. In some embodiments, the entire packet may be inspected and multiple features may be identified before proceeding to the next step. In some embodiments, features may be determined as a result of an analysis across multiple packets comprising the network content.

[0052] Keywords used by heuristics may be chosen by performing an approximate Bayesian probability analysis of all the keywords in an HTML specification using a corpus of malicious network content and a corpus of non-malicious network content. The approximate Bayesian probability analysis may be based on the principles of the Bayesian theorem and/or naïve Bayesian classification. For instance, a probability P_mthat the keyword appears in malicious network content may be computed using the corpus of malicious network content, while a probability P_nthat the keyword appears in non-malicious network content may be computed using the corpus of non-malicious network content. A given keyword may be determined to be a suspicious characteristic for being associated with malicious network content if a score based on a computed ratio P_m/P_nexceeds a threshold of suspicion. The threshold of suspicion may be a value greater than 1, 10, 30, 60, 100, or some other number indicating how much more likely the suspicious characteristic is to indicate malicious network content than to indicate non-malicious network content.

[0053] In step 320, a score related to a probability that the suspicious characteristic identified in step 315 indicates malicious network content is determined. An approximate Bayesian probability analysis may be used to determine the score. In various embodiments, the approximate Bayesian probability analysis may be performed in real-time or using a look-up table based on a previously performed approximate Bayesian probability analysis.

[0054] For example, the approximate Bayesian probability analysis may be performed to determine a relative probability score that a particular feature is associated with the presence of malicious network content in a packet by comparing a corpus of malicious network content and a corpus of regular, non-malicious network content. A feature may include a characteristic of the packet, such as a sequence of characters or keyword, that meets the conditions of a heuristic used in step 310. The feature may also include a characteristic involving more than one packet inspected in sequence or in parallel. An example of a feature may include the character sequence “eval(unescape(”, which indicates a JavaScript “unescape” command nested within a JavaScript “eval” command argument. Further examples of features are described below with respect to step 445 in method 400. A probability P_f|mthat the feature is present in a packet of malicious network content is computed by analyzing the corpus of malicious network content. A probability P_f|nthat the feature is present in a packet of non-malicious network content is computed by analyzing the corpus of non-malicious network content. A malicious probability score is computed as the base two logarithm of a relative probability factor P_m|fthat the feature is associated with malicious network content. The malicious probability score is computed by computing the ratio of the base two logarithm (log₂) of the probability that the feature is present in a packet of malicious network content and the base two logarithm of the probability that the feature is present in a packet of non-malicious network content. The relative probability factor P_m|fmay be expressed as follows:
log₂(P_m|f)=log₂(P_f|m)/log₂(P_f|n) Equation 1

[0055] The size of the result log₂(P_m|f) (i.e., malicious probability score) may indicate the probability that the suspicious network content includes malicious network content. For example, a result of eleven may indicate that the feature is approximately two thousand times more likely to appear in malicious network content than in non-malicious network content. Likewise, a value of twelve may indicate that the feature is approximately four thousand times more likely to appear in malicious network content.

[0056] In some embodiments, the malicious corpus and/or the non-malicious corpus may be continuously updated in response to monitored network data traffic, and the malicious probability scores associated with the features may be continuously updated in response to the updates to the corpuses. In other embodiments, the corpuses may be created and used in advance to store pre-computed malicious probability scores in a look-up table for reference when features are identified. The features associated with significant probabilities of malicious network content may change as the corpuses change.

[0057] In step 325, malicious network content is identified or flagged if the malicious probability score of a feature computed in step 320 satisfies an analysis threshold. The analysis threshold may be greater than 1, 10, 30, 60, 100, 1000, 2000, or higher. The analysis threshold may be preset, or may be variable based on operating conditions of the malicious network content detection system 125. If the malicious probability score does not satisfy the analysis threshold, no action may be taken with regard to the feature associated with the malicious probability score. Otherwise, the analysis may proceed to the next step, such as step 330 for analysis through processing by a virtual machine, such as the virtual machine 215. In some embodiments, the malicious probability scores of all features computed in step 320 may be compared against the analysis threshold to assign a priority level to each feature and/or the packet as a whole. The priority level may be computed based on a variety of factors, such as the number of features identified in the packet, the highest malicious probability score of a feature in the packet, an average malicious probability score of the features in the packet, a mean malicious probability score of the features in the packet, and the like.

[0058] The analysis threshold may be adaptive or be frequently updated based on operating conditions of the malicious network content detection system 125. For example, the threshold value may be dynamically revised according to a quantity of packets of network content to be inspected. As a quantity of data packets which are intercepted and/or copied from the network data transmission in step 310 increases, a quantity of data packets to be inspected may also increase. This may increase a computational load and leave less computational bandwidth available for more detailed analysis of the data packets. Consequently, the threshold may be increased to compensate for the decrease in available computational bandwidth for more detailed analysis. As another example, the threshold value may be dynamically revised according to an availability of one or more virtual machines to be used for the more detailed analysis. The threshold value may be set such that only features which have a significant probability of indicating malicious network content are processed using a virtual machine. For example, out of over one thousand features, less than fifty may be considered significant.

[0059] There may be multiple dynamically adaptive thresholds, which may be synchronized with each other. For example, the scheduler 140 may use a threshold to determine whether a virtual machine should be dispatched to process a queued suspicious network content. The scheduler 140's threshold may increase due to lack of available computational resources for the analysis environment 150 to execute virtual machines. The heuristic module 130 may use another threshold to determine whether heuristics should be applied to an identified feature. The heuristic module 130's threshold may be based on the malicious probability score for the identified feature. As the scheduler 140's threshold increases, the heuristic module 130's threshold may also increase. This is because flagging suspicious network content based on running heuristics on identified features may be irrelevant and an inefficient use of computational resources if the scheduler 140 will not process the suspicious network content in a virtual machine due to an increased threshold in the scheduler 140.

[0060] After suspicious network content has been flagged at step 325 for further analysis, the entire stored data flow including the suspicious network content may be reanalyzed. Each feature may be given a higher malicious probability score by virtue that one feature in the data flow has been found to have a malicious probability score greater than the threshold. A priority level for each feature found in the data flow may also be increased. Furthermore, all data packets and data flows associated with any domains associated with suspicious network content may be cached and given higher priorities and malicious probability scores than they would otherwise. The scheduler 140 may execute the virtual machine to process each flagged suspicious network content in the data flow individually, in priority order, in their original sequence of presentation, or in some other order. The virtual machine may process the suspicious network content until pre-empted by a higher priority suspicious network content.

[0061] In step 330, a virtual machine is executed to process the suspicious network content. The virtual machine may effectively replay the suspicious network content in a web browser executing on the virtual machine. The heuristic module 130 may provide the packet containing the suspicious network content to the scheduler 140, along with a list of the features present in the packet and the malicious probability scores associated with each of those features. Alternatively, the heuristic module 130 may provide a pointer to the packet containing the suspicious network content to the scheduler 140 such that the scheduler 140 may access the packet via a memory shared with the heuristic module 130. In another embodiment, the heuristic module 130 may provide identification information regarding the packet to the scheduler 140 such that the scheduler 140, replayer 205, or virtual machine may query the heuristic module 130 for data regarding the packet as needed.

[0062] The heuristic module 130 may also provide a priority level for the packet and/or the features present in the packet. The scheduler 140 may then load and configure a virtual machine from the virtual machine pool 145, and dispatch the virtual machine to the analysis environment 150 to process the suspicious network content. The virtual machine may be configured to execute for a minimum amount of processing, or for a minimum period of time, such as approximately 45 seconds. After the minimum period of time passes, the virtual machine may be pre-empted by the scheduler 140 to dispatch another virtual machine. Multiple virtual machines may be run simultaneously.

[0063] The scheduler 140 may choose which feature to process first according to the priority levels provided by the heuristic module 130. The scheduler 140 may cause another virtual machine already processing or analyzing another feature or packet, or set of packets, in the analysis environment 150 to terminate prior to dispatching the loaded virtual machine. For example, this may occur if computational resources are occupied with other virtual machines processing other features and therefore are not available to execute the loaded virtual machine. The scheduler 140 may choose which virtual machine(s) to terminate based on the priority levels of the features being processed by the virtual machine, how much time the virtual machine has already spent executing, or other reasons.

[0064] The scheduler 140 may reprioritize suspicious network content already in queue to be processed by virtual machines based on newly identified suspicious network content. For example, already queued suspicious network content may be reprioritized if there is a domain identified in common with the newly identified suspicious network content. Numerous incidents of suspicious network content associated with a single domain may increase the priority of all suspicious network content associated with the domain.

[0065] The replayer 205 in the analysis environment 150 may keep track of network content requested by the virtual machine. If suspicious network content already in the scheduler 140's queue is requested and processed by the virtual machine while processing other previously dispatched suspicious network content, and the queued suspicious network content is not found to be malicious, then the scheduler 140 may delete the queued suspicious network content from the queue. In this way, computational requirements can be reduced because an item of suspicious network content may only be processed in a virtual machine once, rather than each time a reference to the item of suspicious network content is made by another item of suspicious network content.

[0066] In step 335, malicious network content is detected by analyzing the virtual machine response to the suspicious network content. The analysis environment 150 may be configured to monitor the virtual machine for indications that the suspicious network content is in fact malicious network content. The analysis environment 150 may monitor the virtual machine for unusual memory accesses, unusual spawning of executable processes, unusual network transmissions, crashes, unusual changes in performance, and the like. The analysis environment may flag the suspicious network content as malicious network content according to the observed behavior of the virtual machine.

[0067] If a virtual machine processes suspicious network content for greater than a predetermined amount of time without any malicious network content being detected, the scheduler 140 may terminate the virtual machine to free up computational resources. The predetermined amount of time may be variable, according to a queue of suspicious network content that is awaiting processing by a virtual machine, the probability that the suspicious network content may be malicious network content, the feature being evaluated by the virtual machine, available computational resources, and the like. For example, the predetermined amount of time may be 45 seconds, two minutes, twenty minutes, or any other length of time.

[0068] If the suspicious network content is determined to be malicious network content, the malicious network content detection system 125 may report the malicious network content and/or log the malicious network content for future reference. For example, the malicious network content detection system 125 may generate an alert for a network content packet detected to include malicious network content. The malicious network content detection system 125 may report the malicious network content to an entity responsible for the client device 105. If the malicious network content was determined to originate from the server device 105, the client device 110 may be instructed not to continue network transmissions with the server device 105. If a party responsible for the server device 105 is known, the malicious network content detection system 125 may report the malicious network content to the party responsible for the server device 105. The server device 105 may be added to a list of malicious network content providers, and future network transmissions originating from the server device 105 may be blocked from reaching their intended destinations.

[0069] FIG. 4 illustrates another exemplary method 400 for detecting malicious network content. The method 400 may be performed by the heuristic module 130. In the method 400, a packet of network content is inspected to identify features which may indicate the presence of malicious network content. The method 400 may include the use of a single pass parser and/or an augmented finite state machine, which may maintain a stack of states. The method 400 may begin processing a data packet starting with a character after a character sequence “HTTP” has been identified.

[0070] In step 405, a data character is read from the data packet. The data character read may be subsequent to the character sequence “HTTP” or a data character previously read in a prior iteration of step 405. A pointer may be incremented to indicate the next data character to read in the method 400.

[0071] In step 410, the data character read in step 405 is evaluated to determine if the data character may indicate the start of a possible keyword or a possible feature as described with respect to method 300, or a different kind of data (e.g., JavaScript content embedded in HTML content). The data character may include a left angled bracket (i.e., “<”), for example. If the data character read may indicate the start of a keyword or a feature, the method may proceed to step 415. Otherwise, the method may proceed to step 420.

[0072] In step 415, a new state is pushed onto the stack of states to indicate that the method 400 has encountered the start of a keyword or feature. The new state may be an InKeyword state to indicate that the method is in the midst of processing a keyword. Depending on the character read, a different new state may be pushed onto the stack. A string of data characters may be stored, starting with the most recent character read or the next character to be read. The method 400 then proceeds to step 440.

[0073] In step 420, the data character read in step 405 is evaluated to determine if the data character may indicate the end of a keyword or a feature as described with respect to method 300. The data character may include a right angled bracket (i.e., “>”), for example. If the data character read may indicate the end of a keyword or a feature, the method may proceed to step 425. Otherwise, the method may proceed to step 440.

[0074] In step 425, heuristics to be applied to the data packet are identified and applied based on a character string read, which may start with the data character identified in step 410 and end with the data character identified in step 420. The heuristic module 300 may store the character string. The character string may be compared against a database of character strings stored in the heuristics database 135 to determine one or more heuristics that may be applied to the data packet based on the keyword. In some embodiments, a list of results of applying heuristics may be created. The list of results may be stored so that the list may be referenced in step 445.

[0075] Some examples of a heuristic that may be applied to the packet include keyword matches. Some keywords may be associated more with malicious network content than non-malicious network content, and their presence in a packet of network content may be an indication that the packet contains suspicious network content.

[0076] In one exemplary heuristic, an object filename's extension following a period may be examined. For example, a filename ending in the characters “.ini”, “.anr”, or “.htm” may be determined to be suspicious. Also, a filename generally associated with one filetype but associated with a different filetype in the reference may be determined to be suspicious. For example, a filename ending in “.jpg” which is not referring to an image file may be determined to be suspicious.

[0077] In other exemplary heuristics, content of web pages may be analyzed to determine whether network content is suspicious. For example, presence of small iframes, such as an iframe in which the width and/or height is 0 or 1 pixel, in a web page may be determined to be suspicious.

[0078] Further examples of heuristics may be associated with JavaScript code sequences. When an “eval(unescape( . . . ))” JavaScript command sequence, which includes an “unescape” command nested within the argument of an “eval” command, is detected in the data packet, the heuristic may evaluate the command sequence to identify suspicious network content. The “eval(unescape( . . . ))” command sequence may be used to obfuscate malicious network content so that the malicious network content is not easily detected in the network data transmission, and may therefore indicate suspicious network content.

[0079] Another example of a heuristic is a length of the argument of the “unescape” or other JavaScript function from a starting character to an ending character. The length may be determined by counting a number of characters, or measuring a length of time, between the opening parenthesis and the closing parenthesis after “unescape” or other function name. A greater number of characters between the parentheses may indicate that an obfuscated body to the command is being used.

[0080] Bi-gram detection is another exemplary heuristic that may be employed in JavaScript or other types of network content. In bi-gram detection, character transitions within the network content are analyzed. A table of conditional probabilities may be generated and updated continuously as data is evaluated. The table of conditional probabilities indicates the probability of each second character appearing after each first character. The conditional probability of a second character C₂given the first character C₁may be written as P(C₂|C₁). The heuristic may identify when a string of unusual character transitions occurs according to the table of conditional probabilities. Thresholds for the length of the string of unusual character transitions, combined with the values of the conditional probabilities that flags the character transitions as being unusual, may be set a priori based on an approximate Bayesian probability analysis using a corpus of malicious network content and a corpus of non-malicious network content. Alternatively, the thresholds may be adjusted in near real time as the table of conditional probabilities is updated. For example, a long string of unusual character transitions may indicate the presence of malicious network content in a JavaScript “eval(unescape( . . . ))” clause.

[0081] The use of domain profiles is another exemplary heuristic that may be used to reduce a rate of false positives from other heuristics. The domain profiles heuristic may be used in conjunction with other heuristics in order to increase throughput and reduce computational requirements for detecting malicious network content. Each network domain with which monitored network content is exchanged may be cataloged and annotated with a list of the features present in network content associated with the network domain. A typical network domain may be approximately constant in the features present in associated network content. When a feature is identified by another heuristic, the feature may be looked up in the list of features associated with the network domain. If the feature is listed as being associated with the network domain, and malicious network content was not previously detected due to identification of the feature in network content associated with the domain, a virtual machine may not be executed to process the network content containing the feature associated with the network domain. If, on the other hand, the feature was not previously detected or associated with the network domain, the network content may be identified as being suspicious and processed by a virtual machine.

[0082] A list of domains or web sites containing malicious network content may be maintained. The list of sources of malicious network content may be hosted on the computer network and accessible by clients on the computer network. The heuristic module 130 may access the list of domains and web sites containing malicious network content to supplement the information provided by the domain profiles heuristic. For example, the threshold for network content associated with a web site on a list of malicious network content sources may be set to be lower and/or the priority of a suspicious network content may be set higher than for other network content. When malicious network content is detected, the list of domains may be notified or updated with the information for reference by others.

[0083] In step 430, if a state is being exited, the state being exited is popped from the stack of states. The state being exited is the most recent state pushed onto the stack of states. For example, if the state being exited is the InKeyword state, the InKeyword state is popped from the stack of states to indicate that the method is no longer in the midst of reading a keyword. If a state is not being exited, a state may not be popped from the stack, and multiple states may be stored on the stack. In some embodiments, up to 32 states may be present on the stack of states at one time. For example, JavaScript may have embedded HTML, and therefore multiple states may be active at one time to account for nested features. In various embodiments, there may be more than 60 states associated with data packets being analyzed for malicious network content.

[0084] In step 435, a new state is pushed onto the stack of states to indicate that the method is now in the midst of a new state. The new state may be determined by the last keyword that was read, or a character indicating a new kind of content. For example, the new state may be an InBetweenKeyword state to indicate that the method is awaiting another keyword to process. In some embodiments, the new state may be an InJavaScript state to indicate that the method is in the midst of reading a JavaScript segment. The state may impact which heuristics are identified and applied to the packet of web data in step 445. For example, a first heuristic may be chosen if a first state is active, whereas a second heuristic may be chosen if a second state is active.

[0085] In step 440, the count of characters read in step 405 is evaluated to determine if the data character may lie at the end of a packet. If the data character lies at the end of the packet, the method may proceed to step 445. Otherwise, the method may proceed to step 405.

[0086] In step 445, the list of results produced by applying the heuristics in step 425 for the features in the data packet are referenced to determine which features in the data packet are to be processed using a virtual machine. Malicious probability scores for each feature may be compared against a threshold to determine whether the feature indicates suspicious network content. The features associated with the data packet may be ranked in priority order. The features may be used to prioritize whether to refer the data packet, and associated content, to a virtual machine in the order identified in step 425, in the priority order determined by their respective malicious probability scores, or in some other order.

[0087] FIG. 5 illustrates an exemplary controller 500. The controller 500 may comprise the malicious network content detection system 125 according to some embodiments. The controller 500 comprises at least a processor 505, a memory system 510, and a storage system 515, which are all coupled to a bus 520. The controller 500 may also comprise a communication network interface 525, an input/output (I/O) interface 530, and a display interface 535. The communication network interface 525 may couple with the communication network 120 via a communication medium 540. In some embodiments, the controller 500 may couple to a tap, such as the tap 115, which in turn couples with the communication network 120. The bus 520 provides communications between the communications network interface 525, the processor 505, the memory system 510, the storage system 515, the I/O interface 530, and the display interface 535.

[0088] The communications network interface 525 may communicate with other digital devices (not shown) via the communications medium 540. The processor 505 executes instructions. The memory system 510 permanently or temporarily stores data. Some examples of the memory system 510 are RAM and ROM. The storage system 515 also permanently or temporarily stores data. Some examples of the storage system 515 are hard disks and disk drives. The I/O interface 530 may include any device that can receive input and provide output to a user. The I/O interface 530 may include, but is not limited to, a keyboard, a mouse, a touchscreen, a keypad, a biosensor, a compact disc (CD) drive, a digital versatile disc (DVD) drive, or a floppy disk drive. The display interface 535 may include an interface configured to support a display, monitor, or screen. In some embodiments, the controller 500 comprises a graphical user interface to be displayed to a user over a monitor in order to allow the user to control the controller 500.

[0089] According to other embodiments, malicious network content may also include malicious portable document format (PDF) network content. It will be understood that the term “malicious PDF network content” may be understood to include portable document format (PDF) files located on one or more server devices 105 and made available for distribution via the communication network 120 to one or more client devices 110.

[0090] Generally speaking, the tap 115 may be adapted to intercept requests to obtain PDF network content received from a web browser, PDF reader application, or any other application, module, or engine requesting such PDF network content, associated with a client device 110. In some embodiments, the tap 115 may be disposed between one or more client devices 110 and one or more server devices 105 and direct requests to obtain PDF network content into the malicious network content detection system 600, which will be described in greater detail infra with reference to FIG. 6. It will be understood that the tap 115 may also be disposed between two or more server devices 105 and provide mechanisms for intercepting PDF network content exchanged between two or more server devices 105.

[0091] As background, PDF network content, such as a PDF document may include a fixed-layout document, that when parsed by a PDF reader application (not shown), produce a visual representation of the data included in the PDF document. The data within a PDF document is arranged in a hierarchical manner beginning with a header, a body portion that includes information indicative of one or more objects, a cross-reference table, also known as an “XREF” table, and a trailer. The header includes information indicative of the PDF specification version number to which the document adheres. The version number may be utilized to determine the PDF document reader version that is best adapted to parse the PDF document.

[0092] The XREF table includes offset information indicative of the position of objects within the PDF document. As such, the XREF table allows the PDF reader application to parse or walk individual portions (e.g., pages) of the PDF document without a need to parse or walk the entire PDF document. Lastly, the trailer of the PDF document allows the PDF reader application to efficiently locate the XREF table along with any other pertinent objects that may be utilized by the PDF reader application to construct the visual representation.

[0093] The body may contain one or more objects that comprise the contents of the PDF document. Generally speaking, the objects of a PDF document may include, but are not limited to, Boolean operators, numbers, names, strings, arrays, dictionaries, streams, and combinations thereof. The body may also include transparent objects such as metadata, security features, and the like.

[0094] Objects of a PDF document may be broadly categorized as either direct or indirect. It will be understood that direct objects may not reference other objects. Conversely, indirect object may make reference to one or more objects, which may include both direct and/or indirect objects. The PDF document may also include interactive elements such as AcroForm elements and XML Forms Data Format (XFDF elements). Both AcroForm and XFDF elements allow the inclusion of JavaScript code, also known as JavaScript API.

[0095] It will be understood that malware may be adapted to utilize JavaScript code to exploit vulnerabilities present within both PDF reader applications and web browser applications. It will further be understood that PDF reader applications and web browser applications may cooperate with one another via a plug-in. For example, when a web browser requests a PDF document, the PDF reader application is automatically launched to parse the PDF document. If the PDF document includes one or more objects that reference JavaScript code, the JavaScript codes called during parsing may construct virtual operating systems within the web browser for performing one or more functions associated with the JavaScript code.

[0096] While plug-in cooperation between the PDF reader application and web browser application provides significant benefits such as cross-platform compatibility (i.e., agnostic to the operating system of the client device 110), numerous vulnerabilities may be created within the web browser, which may expose the client device 110 to different types of malware, viruses, and the like.

[0097] In some embodiments, JavaScript code may exploit one or more vulnerabilities of the web browser application by loading memory allocated for operation of the PDF reader application with malicious code, often commonly referred to as “heap spray.” The heap spray may be adapted to prepare the memory allocated for the PDF reader application with shellcode. Once prepared, the vulnerable JavaScript code is called to trigger the vulnerability, execute the shellcode, and ultimately deliver a payload. It will be understood that the term “payload” may include any deleterious effect caused by malicious network content to the client device 110. It is noteworthy that the deleterious effects caused by malicious network content are far too numerous to include individually, but would be readily appreciated by one of ordinary skill in the art with the present disclosure before them. Non-limiting examples of deleterious effects include consumption of memory, overwriting or corruption of system or program files, and the like.

[0098] As with HTML documents, suspicious characteristics indicative of malicious network content included with a PDF document may be determined by way of the heuristic module 130 as previously described supra with reference to FIG. 1. As such, the heuristics module 130 may utilize any one (or combination) of heuristic methodologies located with the heuristics database 135.

[0099] Referring now to FIG. 6, in some embodiments, suspicious characteristics indicative of malicious network content included with a PDF document may be determined by way of a malicious network content detection system 600. The malicious network content detection system 600 may include each of the components of malicious network content detection system 125 (see FIG. 1) along with one or more additional modules such as a PDF parser 605. The PDF parser 605 may be adapted to examine received (e.g., intercepted) PDF network content to determine if one or more suspicious characteristics indicative of malicious network content are included in the PDF network content. It will be understood that the term “examine” may be understood to include walking, parsing, inspecting, viewing, compiling, reading, extracting, decoding, and/or combinations thereof.

[0100] The malicious network content detection system 600 may be adapted to determine suspicious characteristics indicative of malicious network content by way of methods disclosed with regard to HTML files, such as the exemplary method 400 for detecting malicious network content described above with regard to FIG. 4. Additionally, the PDF parser 605 may be adapted to determine one or more suspicious characteristics indicative of malicious network content that are unique to PDF network content. For example, the PDF parser 605 may be adapted to examine the body of PDF network content to located objects that include specific types of JavaScript code. Some non-limiting examples of JavaScript code that are commonly utilized to exploit vulnerabilities in web browser applications include eval( ), util.printf( ), and media.newPlayer( ).

[0101] Moreover, creators of PDF network content malware may attempt to obfuscate JavaScript code references to malware by splitting the JavaScript code into a plurality of objects that when referenced by the PDF reader application may be combined to execute the malicious code. Therefore, the PDF parser 605 may be adapted to determine obfuscated malicious JavaScript code divided across multiple objects utilizing the getField( ) function.

[0102] In additional embodiments, the PDF parser 605 may be adapted to determine malicious JavaScript code that is encrypted in to PDF network content utilizing software stream ciphers such as RC4 and AES encryption.

[0103] While the above examples contemplate the adaptability of the PDF parser 605 to determine suspicious content such as JavaScript code, the PDF parser 605 may be adapted to determine additional types of malware associated with other objects including, but not limited to, embedded Flash stream objects. For example, a Flash file may include ActionScript virtual machine instructions that are adapted to set up a heap spray with shellcode. In an additional example, malicious code may be incorporated into the PDF network content via one or more Tagged Image File Format (TIFF) vulnerabilities. It will be understood that some TIFF vulnerabilities may not utilize heap spray functionalities.

[0104] While not an exclusive list, the following features may be indicative of PDF network content having malicious network content: PDFBadVersion (determines if the PDF specification version number associated with the PDF network content is correct), PDFHeader1_0 (examines the header information of the PDF network document for errors, also known as malformed header information), PDFNameJS (examines the PDF document for PDF objects that include names incorporating JS that are indicative of JavaScript code), PDFNameJavaScript (examines the PDF document for PDF objects that include names incorporating JavaScript that are indicative of JavaScript code), PDFBadFileStart (examines the PDF network content for an improper file start signature), PDFNameOpenAction (examines the PDF network content for PDF objects that cause Javascript functionality to be run on the initial loading of the PDF content), PDFCouldNotParse (determines if the PDF parser is unable to properly parse the PDF network content), and/or combinations thereof. The PDF parser 605 may utilize the aforementioned features to determine one or more suspicious characteristics included in the PDF network content.

[0105] It will be understood that because one or more portions (e.g., pages) of PDF network content may be assembled without need to walk or parse the entire PDF network content, the PDF parser 605 may be adapted to evaluate only the portion(s) of the PDF network content that has been requested by the client device 110.

[0106] Regardless of the type or amount of suspicious characteristics located by the PDF parser 605, if one or more suspicious characteristics are determined to be included in at least a portion of the PDF network content, the at least a portion of PDF network content may be provided to one or more virtual machines for verification of malicious network content.

[0107] The one or more virtual machines may be selected from the virtual machine pool 145 based, in part, upon the particular PDF specification version number included in the header of the PDF network content being analyzed. In some embodiments, the one or more virtual machines may each include one or more augmented finite state machines. Each of these augmented finite state machines may include different configurations of computer readable instructions such as operating system instructions, web browser instructions, PDF reader application instructions, plug-in instructions for operatively coupling one or more web browsers to a PDF reader application, along with any additional types of computer readable instructions adapted to verify the inclusion of malicious network content in PDF network content.

[0108] In some embodiments, the use of a plurality (i.e., two or more) of augmented finite state machines may allows for PDF network content to be processed across various system configurations (i.e., permutations of operating system instructions, web browser instructions, and PDF reader application instructions). As such, PDF network content that may not exploit vulnerabilities within one type of web browser application may be verified to exploit vulnerabilities within additional types of web browser applications. These types of multi-faceted analyses are more likely to verify the presence of malicious network content within PDF network content that exploit vulnerabilities of specific versions of programs and/or applications.

[0109] Each of the augmented finite state machines includes an analysis environment 150 to simulate the receipt, compiling, execution, and/or display of the PDF network content from the server device 105 to analyze the effects of the PDF network content upon the client device 110. For example, the analysis environment 150 may include a web browser requesting the PDF network content from a server device 105. The web browser causes the PDF reader application to parse the PDF network content. If the PDF network content does, in fact, include malicious code (e.g., JavaScript, Flash, etc.), one or more of the vulnerabilities of the web browser application or the PDF reader application may be exploited by the malicious code to deliver a payload. The effects of the payload may be directly or indirectly observed within the analysis environment 150.

[0110] It will be understood that an exemplary analysis environment 150 is described supra in greater detail with reference to FIG. 2 and may be adapted for observing the effects of parsing PDF network content determined to include one or more suspicious characteristics.

[0111] In some embodiments, the malicious network content detection system 600 may be further adapted to index PDF network content verified to include malicious network content by associating the PDF network content with an identifier indicative of one or more domains from which the PDF network content was obtained and storing the associated PDF network content as a record that resides with one or more databases operatively coupled to one or more server devices 105.

[0112] The database may be utilized by the malicious network content detection system 600 to compare PDF network content determined to include one or more suspicious characteristics to the index of PDF network content previously verified to include malicious network. Additionally, all PDF network documents residing on domains determined to have hosted PDF network content verified to include malicious network content may be automatically reviewed without further examination of the PDF network content for suspicious characteristics.

[0113] Referring now to FIG. 7, an exemplary method 700 for detecting malicious PDF network content is shown. The method 700 may include the step 705 of intercepting a request for at least a portion of PDF network content via a tap 115 operatively associated therewith. It will be understood that the tap 115 may intercept the at least a portion of PDF network content before the at least a portion of PDF network is received by the web browser application.

[0114] Next, the method 700 may include the step 710 of examining the at least a portion of PDF network content to determine if one or more suspicious features and/or characteristics indicative of malicious network content are included in the at least a portion of PDF network content. As stated previously, examining may include utilizing heuristics or a PDF parser to determine the presence of specific features and/or specific vulnerable JavaScript code included with the at least a portion of PDF network content.

[0115] The method 700 may also include the step 715 of providing the at least a portion of PDF network content to one or more virtual machines (also known as augmented finite state machines).

[0116] Next, the inclusion of malicious network content in the at least a portion of PDF network content may be verified by executing or compiling the at least a portion of PDF network content in the one or more virtual machines in step 720. The compiling of the at least a portion of PDF network content causes vulnerable JavaScript code to execute any malicious network content associated therewith.

[0117] The method 700 then may include the step 725 of observing the performance of the one or more virtual machines to determine if the at least a portion of PDF network content, in fact, includes malicious network content. Observations of performance indicative of the execution of malicious network content include, but are not limited to the generation of heap spray within the memory allocated to the PDF reader application, the execution of shellcode, consumption of memory, overwriting or corruption of system or program files, and the like.

[0118] Lastly, the method 730 may include the step of preventing the delivery of the at least a portion of PDF network content verified to include malicious network to the client device from which the request was received.

[0119] The embodiments discussed herein are illustrative. As these embodiments are described with reference to illustrations, various modifications or adaptations of the methods and/or specific structures described may become apparent to those skilled in the art.

[0120] The above-described modules may be comprised of instructions that are stored on storage media (e.g., computer readable media). The instructions may be retrieved and executed by a processor (e.g., the processor 505). Some examples of instructions include software, program code, and firmware. Some examples of storage media comprise memory devices and integrated circuits. The instructions are operational when executed by the processor to direct the processor to operate in accordance with embodiments of the present invention. Those skilled in the art are familiar with instructions, processor(s), and storage media.

[0121] In the foregoing specification, the invention is described with reference to specific embodiments thereof, but those skilled in the art will recognize that the invention is not limited thereto. Various features and aspects of the above-described invention can be used individually or jointly. Further, the invention can be utilized in any number of environments and applications beyond those described herein without departing from the broader spirit and scope of the specification. The specification and drawings are, accordingly, to be regarded as illustrative rather than restrictive. It will be recognized that the terms “comprising,” “including,” and “having,” as used herein, are specifically intended to be read as open-ended terms of art.

Claims

What is claimed is:

1. A system comprising:

a hardware processor; and

a memory device coupled to the processor, the memory device comprises

a parser that, when executed by the hardware processor, examines one or more portions of a Portable Document Format (PDF) document to determine if one or more suspicious characteristics indicative of malicious network content are included in the one or more examined portions of the PDF document, wherein the one or more examined portions of the PDF document comprise less than an entirety of the PDF document, and

one or more virtual machines to receive the PDF document in response to the one or more examined portions of the PDF document being determined to include one or more suspicious characteristics indicative of malicious network content, the one or more virtual machines to process at least the one or more examined portions of the PDF document so as to determine whether the PDF document includes malicious network content.

2. The system of claim 1, wherein the PDF document is received by the system over a communication network.

3. The system of claim 2, wherein a body portion of the PDF document is examined and the entirety of the PDF document is not examined prior to providing the PDF document to the one or more virtual machines.

4. The system of claim 3, wherein at least one of a header, a cross-reference table, or a trailer of the PDF document is not examined prior to providing the PDF document to the one or more virtual machines.

5. The system of claim 2 being communicatively coupled to a digital data tap being a device connected to the communication network to intercept the PDF document being transmitted from a web server and to provide at least the PDF document to the system.

6. The system of claim 5, wherein the digital data tap being configured to monitor network data over the communication network and provide the PDF document within the network data as the PDF document to the parser being executed by the hardware processor.

7. The system of claim 1, wherein the parser examines the one or more portions of the PDF document by at least:

examining one or more of a header section, a body section, a trailer section, or a cross-reference table section of the PDF document; and

providing the PDF document to the one or more virtual machines to verify the inclusion of malicious network content in the PDF document when one or more of the body section, the header section, the trailer section or the cross-reference table section of the PDF document is determined to include one or more suspicious characteristics indicative of malicious network content.

8. The system of claim 7, wherein the cross-reference table allows a PDF reader application to parse pages of the PDF document without a need of parsing the PDF document in its entirety.

9. The system of claim 7, wherein the cross-reference table of the PDF document includes offset information indicative of a portion of objects within content of the PDF document.

10. The system of claim 9, wherein the body of the PDF document includes one or more objects included as part of the content of the PDF document.

11. The system of claim 1, wherein the one or more virtual machines are configured based on one or more specification version numbers of the PDF document.

12. The system of claim 11, wherein a specification version number of the one or more specification version numbers is used to identify a reader application version to be run in a virtual machine of the one or more virtual machines.

13. The system of claim 1, wherein the one or more examined portions of the PDF document comprises a body section and a header section of the PDF document received over a communication network.

14. The system of claim 1, wherein a determination by the parser if the one or more suspicious characteristics indicative of malicious network content are included in the one or more examined portions of the PDF document, comprises:

determining a score associated with the one or more suspicious characteristics for the PDF document, the score indicative of a probability that the PDF document includes malicious network content; and

identifying the PDF document as suspicious if the score satisfies a threshold value.

15. The system of claim 1, wherein the parser, when executed by the processor, examines the PDF document by at least applying heuristics to determine if at least one suspicious characteristic indicative of malicious network content is included in the PDF document.

16. The system of claim 1, wherein the memory further comprises a module that, when executed by the processor, prevents the delivery of the PDF document verified to include malicious network content to a web browser application from which the delivery was requested.

17. The system of claim 1, wherein the parser examines the one or more portions of the PDF document by at least

examining a header section of the PDF document and the entirety of the PDF document is not examined prior to providing the PDF document to the one or more virtual machines; and

when the header section of the PDF document is determined to include one or more suspicious characteristics indicative of malicious network content, providing the PDF document to the one or more virtual machines to verify the inclusion of malicious network content in the PDF document.

18. The system of claim 1, wherein the parser examines the one or more portions of the PDF document by at least

examining a body section of the PDF document; and

when the body section of the PDF document is determined to include one or more suspicious characteristics indicative of malicious network content, providing the PDF document to the one or more virtual machines to verify the inclusion of malicious network content in the PDF document.

19. The system of claim 1, wherein the one or more virtual machines are configured based on at least data associated with the PDF document in response to the one or more examined portions of the PDF document being determined to include one or more suspicious characteristics indicative of malicious network content.

20. The system of claim 1, wherein the PDF document is included as part of an HTML document.

21. The system of claim 1, wherein the parser, upon execution by the processor, examines the PDF document by decoding content within the PDF document prior to parsing content within the PDF document.

22. The system of claim 1, wherein the parser is configured to determine the one or more suspicious characteristics including examining the one or more examined portions of the PDF document for a specific type or types of JavaScript code.

23. The system of claim 1, wherein the one or more virtual machines process at least the one or more examined portions of the PDF document using both a PDF reader application and a web browser application.

24. The system of claim 23, wherein the PDF reader application and the web browser application cooperate with each other via a plug-in.

25. The system of claim 1, wherein a first virtual machine of the one or more virtual machines processes at least the one or more examined portions of the PDF document using a PDF reader application and at least a second application operating in cooperation with the PDF reader application.

26. The system of claim 25, wherein the second application operates in cooperation with the PDF reader application via a plug-in.

27. The system of claim 26, wherein the second application includes a web browser application.

28. A non-transitory computer readable storage medium storing software that, upon execution by a processor, detects malware within a Portable Document Format (PDF) document, the non-transitory computer readable storage medium comprising:

a parser that, when executed by the processor, examines one or more portions of the PDF document to determine if one or more suspicious characteristics indicative of malicious network content are included in the one or more examined portions of the PDF document, wherein the one or more examined portions of the PDF document comprise less than an entirety of the PDF document, and

29. The non-transitory computer readable storage medium of claim 28, wherein the parser determines if the one or more suspicious characteristics indicative of malicious network content are included in the one or more examined portions of the PDF document by at least:

identifying the PDF document as suspicious if the score satisfies a threshold value.

30. The non-transitory computer readable storage medium of claim 28, wherein the PDF document is received by the system over a communication network.

31. The non-transitory computer readable storage medium of claim 28, wherein at least one of a header, a cross-reference table, or a trailer of the PDF document is not examined prior to providing the PDF document to the one or more virtual machines.

32. The non-transitory computer readable storage medium of claim 28, wherein an examination of the one or more portions of the PDF document by the parser, when executed by the processor, further comprises:

examining at least one of a header section or a body section of the PDF document; and

when the body section or the header section of the PDF document is determined to include one or more suspicious characteristics indicative of malicious network content, providing the PDF document to the one or more virtual machines to verify the inclusion of malicious network content in the PDF document.

33. The non-transitory computer readable storage medium of claim 28, wherein the parser examines a body portion of the PDF document and the entirety of the PDF document is not examined prior to providing the PDF document to the one or more virtual machines.

34. The non-transitory computer readable storage medium of claim 28 wherein the parser, when executed by the processor, examines the PDF document by at least applying heuristics to determine if at least one suspicious characteristic indicative of malicious network content is included in the PDF document.

35. The non-transitory computer readable storage medium of claim 28, wherein the medium further comprises a module that, when executed by the processor, prevents the delivery of the PDF document verified to include malicious network content to a web browser application from which the delivery was requested.

36. The non-transitory computer readable storage medium of claim 28, wherein the one or more virtual machines are configured based on at least data associated with the PDF document in response to the one or more examined portions of the PDF document being determined to include one or more suspicious characteristics indicative of malicious network content.

37. The non-transitory computer readable storage medium of claim 36, wherein the one or more virtual machines are configured based on one or more specification version numbers of the PDF document.

38. The non-transitory computer readable storage medium of claim 37, wherein a specification version number of the one or more specification version numbers is used to identify a specific reader application version to be run in a virtual machine of the one or more virtual machines.

39. The non-transitory computer readable storage medium of claim 28, wherein the one or more examined portions of the PDF document comprises a body section and a header section of the PDF document.

40. The non-transitory computer readable storage medium of claim 28, wherein the parser examines a header of the PDF document and the entirety of the PDF document is not examined prior to providing the PDF document to the one or more virtual machines.

41. The non-transitory computer readable storage medium of claim 28, wherein a first virtual machine of the one or more virtual machines processes at least the one or more examined portions of the PDF document using a PDF reader application and at least a second application operating in cooperation with the PDF reader application.

42. The non-transitory computer readable storage medium of claim 41, wherein the second application operates in cooperation with the PDF reader application via a plug-in.

43. The non-transitory computer readable storage medium of claim 42, wherein the second application includes a web browser application.

44. The non-transitory computer readable storage medium of claim 28, wherein the PDF document is included as part of an HTML document.

45. The non-transitory computer readable storage medium of claim 28, wherein the parser, upon execution by the processor, examines the PDF document by decoding content within the PDF document prior to parsing content within the PDF document.

46. The non-transitory computer readable storage medium of claim 28, wherein the parser is configured to determine the one or more suspicious characteristics including examining the one or more examined portions of the PDF document for a specific type or types of JavaScript code.

47. A computerized method, comprising:

examining, by a parser executed by a hardware processor, one or more portions of a Portable Document Format (PDF) document to determine if one or more suspicious characteristics indicative of malicious network content are included in the one or more examined portions of the PDF document, wherein the one or more examined portions of the PDF document comprise less than an entirety of the PDF document, and

upon the one or more examined portions of the PDF document being determined to include one or more suspicious characteristics indicative of malicious network content, receiving the PDF document by one or more virtual machines to process at least the one or more examined portions of the PDF document so as to determine whether the PDF document includes malicious network content.

48. The method of claim 47, wherein the examining of the one or more portions of the PDF document comprises:

identifying the PDF document as suspicious if the score satisfies a threshold value.

49. The method of claim 47, wherein prior to the examining of the one or more portions of the PDF document, the method further comprises

receiving the PDF document over a communication network.

50. The method of claim 47, wherein the examining of the one or more portions of the PDF document excludes from an examination of at least one of a header, a cross-reference table, or a trailer of the PDF document prior to providing the PDF document to the one or more virtual machines.

51. The method of claim 47, the examining of the one or more portions of the PDF document comprises:

examining at least one of a header section or a body section of the PDF document; and

52. The method of claim 47 wherein the examining of the one or more portions of the PDF document comprises examining the PDF document by at least applying heuristics to determine if at least one suspicious characteristic indicative of malicious network content is included in the PDF document.

53. The method of claim 47 further comprising:

preventing the delivery of the PDF document verified to include malicious network content to a web browser application from which the delivery was requested.

54. The method of claim 47, wherein the one or more virtual machines are configured based on at least data associated with the PDF document in response to the one or more examined portions of the PDF documents being determined to include the one or more suspicious characteristics.

55. The method of claim 54, wherein the one or more virtual machines are configured based on one or more specification version numbers of the PDF document.

56. The method of claim 55, wherein a specification version number of the one or more specification version numbers is used to identify a specific reader application version to be run in a virtual machine of the one or more virtual machines.

57. The method of claim 47, wherein the one or more examined portions of the PDF document comprises a body section and a header section of the PDF document.

58. The method of claim 47, wherein the examining of the one or more portions of the PDF document comprises examining a header of the PDF document and the entirety of the PDF document is not examined prior to the PDF document being received by the one or more virtual machines.

59. The method of claim 47, wherein prior to examining the one or more portions of the PDF document, the method further comprising receiving the PDF document from a web server via a network.

60. The method of claim 59, wherein prior to receiving of the PDF document, monitoring network data being transmitted over the network between the web server and a client device and intercepting the PDF document being sent to the client device from the web server.

61. The method of claim 60, wherein the intercepting of the PDF document includes providing a copy of the PDF document as the PDF document to the parser.

Patent Citations (529)

Patent	Date	Inventor	Cited By
US4292580(A)	1981-09-01	Ott et al.	Applicant
US5175732(A)	1992-12-01	Hendel et al.	Applicant
US5440723(A)	1995-08-01	Arnold et al.	Applicant
US5490249(A)	1996-02-01	Miller	Applicant
US5537540(A)	1996-07-01	Miller et al.	Applicant
US5603027(A)	1997-02-01	Ohkami	Applicant
US5657473(A)	1997-08-01	Killean et al.	Applicant
US5842002(A)	1998-11-01	Schnurer et al.	Applicant
US5978917(A)	1999-11-01	Chi	Applicant
US6088803(A)	2000-07-01	Tso et al.	Applicant
US6094677(A)	2000-07-01	Capek et al.	Applicant
US6108799(A)	2000-08-01	Boulay et al.	Applicant
US6118382(A)	2000-09-01	Hibbs et al.	Applicant
US6269330(B1)	2001-07-01	Cidon et al.	Applicant
US6272641(B1)	2001-08-01	Ji	Applicant
US6279113(B1)	2001-08-01	Vaidya	Applicant
US6298445(B1)	2001-10-01	Shostack et al.	Applicant
US6357008(B1)	2002-03-01	Nachenberg	Applicant
US6417774(B1)	2002-07-01	Hibbs et al.	Applicant
US6424627(B1)	2002-07-01	Sørhaug et al.	Applicant
US6442696(B1)	2002-08-01	Wray et al.	Applicant
US6484315(B1)	2002-11-01	Ziese	Applicant
US6487666(B1)	2002-11-01	Shanklin et al.	Applicant
US6493756(B1)	2002-12-01	O'Brien et al.	Applicant
US6550012(B1)	2003-04-01	Villa et al.	Applicant
US6700497(B2)	2004-03-01	Hibbs et al.	Applicant
US6775657(B1)	2004-08-01	Baker	Applicant
US6831893(B1)	2004-12-01	Ben Nun et al.	Applicant
US6832367(B1)	2004-12-01	Choi et al.	Applicant
US6895550(B2)	2005-05-01	Kanchirayappa et al.	Applicant
US6898632(B2)	2005-05-01	Gordy et al.	Applicant
US6907396(B1)	2005-06-01	Muttik et al.	Applicant
US6941348(B2)	2005-09-01	Petry et al.	Applicant
US6971097(B1)	2005-11-01	Wallman	Applicant
US6981279(B1)	2005-12-01	Arnold et al.	Applicant
US6995665(B2)	2006-02-01	Appelt et al.	Applicant
US7007107(B1)	2006-02-01	Ivchenko et al.	Applicant
US7028179(B2)	2006-04-01	Anderson et al.	Applicant
US7043757(B2)	2006-05-01	Hoefelmeyer et al.	Applicant
US7069316(B1)	2006-06-01	Gryaznov	Applicant
US7080407(B1)	2006-07-01	Zhao et al.	Applicant
US7080408(B1)	2006-07-01	Pak et al.	Applicant
US7093002(B2)	2006-08-01	Wolff et al.	Applicant
US7093239(B1)	2006-08-01	van der Made	Applicant
US7096498(B2)	2006-08-01	Judge	Applicant
US7100201(B2)	2006-08-01	Izatt	Applicant
US7107617(B2)	2006-09-01	Hursey et al.	Applicant
US7159149(B2)	2007-01-01	Spiegel et al.	Applicant
US7213260(B2)	2007-05-01	Judge	Applicant
US7231667(B2)	2007-06-01	Jordan	Applicant
US7240364(B1)	2007-07-01	Branscomb et al.	Applicant
US7240368(B1)	2007-07-01	Roesch et al.	Applicant
US7243371(B1)	2007-07-01	Kasper et al.	Applicant
US7249175(B1)	2007-07-01	Donaldson	Applicant
US7251215(B1)	2007-07-01	Turner et al.	Applicant
US7287278(B2)	2007-10-01	Liang	Applicant
US7308716(B2)	2007-12-01	Danford et al.	Applicant
US7328453(B2)	2008-02-01	Merkle, Jr. et al.	Applicant
US7346486(B2)	2008-03-01	Ivancic et al.	Applicant
US7356736(B2)	2008-04-01	Natvig	Applicant
US7386888(B2)	2008-06-01	Liang et al.	Applicant
US7392542(B2)	2008-06-01	Bucher	Applicant
US7418729(B2)	2008-08-01	Szor	Applicant
US7428300(B1)	2008-09-01	Drew et al.	Applicant
US7441272(B2)	2008-10-01	Durham et al.	Applicant
US7448084(B1)	2008-11-01	Apap et al.	Applicant
US7458098(B2)	2008-11-01	Judge et al.	Applicant
US7464404(B2)	2008-12-01	Carpenter et al.	Applicant
US7464407(B2)	2008-12-01	Nakae et al.	Applicant
US7467408(B1)	2008-12-01	O'Toole, Jr.	Applicant
US7478428(B1)	2009-01-01	Thomlinson	Applicant
US7480773(B1)	2009-01-01	Reed	Applicant
US7487543(B2)	2009-02-01	Arnold et al.	Applicant
US7496960(B1)	2009-02-01	Chen et al.	Applicant
US7496961(B2)	2009-02-01	Zimmer et al.	Applicant
US7516488(B1)	2009-04-01	Kienzle et al.	Applicant
US7519990(B1)	2009-04-01	Xie	Applicant
US7523493(B2)	2009-04-01	Liang et al.	Applicant
US7530104(B1)	2009-05-01	Thrower et al.	Applicant
US7540025(B2)	2009-05-01	Tzadikario	Applicant
US7546638(B2)	2009-06-01	Anderson et al.	Applicant
US7565550(B2)	2009-07-01	Liang et al.	Applicant
US7568233(B1)	2009-07-01	Szor et al.	Applicant
US7584455(B2)	2009-09-01	Ball	Applicant
US7603715(B2)	2009-10-01	Costa et al.	Applicant
US7607171(B1)	2009-10-01	Marsden et al.	Applicant
US7639714(B2)	2009-12-01	Stolfo et al.	Applicant
US7644441(B2)	2010-01-01	Schmid et al.	Applicant
US7657419(B2)	2010-02-01	van der Made	Applicant
US7676841(B2)	2010-03-01	Sobchuk et al.	Applicant
US7698548(B2)	2010-04-01	Shelest et al.	Applicant
US7707633(B2)	2010-04-01	Danford et al.	Applicant
US7712136(B2)	2010-05-01	Sprosts et al.	Applicant
US7730011(B1)	2010-06-01	Deninger et al.	Applicant
US7739740(B1)	2010-06-01	Nachenberg et al.	Applicant
US7779463(B2)	2010-08-01	Stolfo et al.	Applicant
US7784097(B1)	2010-08-01	Stolfo et al.	Applicant
US7832008(B1)	2010-11-01	Kraemer	Applicant
US7836502(B1)	2010-11-01	Zhao et al.	Applicant
US7849506(B1)	2010-12-01	Dansey et al.	Applicant
US7854007(B2)	2010-12-01	Sprosts et al.	Applicant
US7869073(B2)	2011-01-01	Oshima	Applicant
US7877803(B2)	2011-01-01	Enstone et al.	Applicant
US7904959(B2)	2011-03-01	Sidiroglou et al.	Applicant
US7908660(B2)	2011-03-01	Bahl	Applicant
US7930738(B1)	2011-04-01	Petersen	Applicant
US7937761(B1)	2011-05-01	Bennett	Applicant
US7949849(B2)	2011-05-01	Lowe et al.	Applicant
US7996556(B2)	2011-08-01	Raghavan et al.	Applicant
US7996836(B1)	2011-08-01	McCorkendale et al.	Applicant
US7996904(B1)	2011-08-01	Chiueh et al.	Applicant
US7996905(B2)	2011-08-01	Arnold et al.	Applicant
US8006305(B2)	2011-08-01	Aziz	Applicant
US8010667(B2)	2011-08-01	Zhang et al.	Applicant
US8020206(B2)	2011-09-01	Hubbard et al.	Applicant
US8028338(B1)	2011-09-01	Schneider et al.	Applicant
US8042184(B1)	2011-10-01	Batenin	Applicant
US8045094(B2)	2011-10-01	Teragawa	Applicant
US8045458(B2)	2011-10-01	Alperovitch et al.	Applicant
US8069484(B2)	2011-11-01	McMillan et al.	Applicant
US8087086(B1)	2011-12-01	Lai et al.	Applicant
US8171553(B2)	2012-05-01	Aziz et al.	Applicant
US8176049(B2)	2012-05-01	Deninger et al.	Applicant
US8176480(B1)	2012-05-01	Spertus	Applicant
US8201246(B1)	2012-06-01	Wu	Applicant
US8204984(B1)	2012-06-01	Aziz et al.	Applicant
US8214905(B1)	2012-07-01	Doukhvalov et al.	Applicant
US8220055(B1)	2012-07-01	Kennedy	Applicant
US8225288(B2)	2012-07-01	Miller et al.	Applicant
US8225373(B2)	2012-07-01	Kraemer	Applicant
US8233882(B2)	2012-07-01	Rogel	Applicant
US8234640(B1)	2012-07-01	Fitzgerald et al.	Applicant
US8234709(B2)	2012-07-01	Viljoen et al.	Applicant
US8239944(B1)	2012-08-01	Nachenberg et al.	Applicant
US8260914(B1)	2012-09-01	Ranjan	Applicant
US8266091(B1)	2012-09-01	Gubin et al.	Applicant
US8286251(B2)	2012-10-01	Eker et al.	Applicant
US8291499(B2)	2012-10-01	Aziz et al.	Applicant
US8307435(B1)	2012-11-01	Mann et al.	Applicant
US8307443(B2)	2012-11-01	Wang et al.	Applicant
US8312545(B2)	2012-11-01	Tuvell et al.	Applicant
US8321936(B1)	2012-11-01	Green et al.	Applicant
US8321941(B2)	2012-11-01	Tuvell et al.	Applicant
US8332571(B1)	2012-12-01	Edwards, Sr.	Applicant
US8365286(B2)	2013-01-01	Poston	Applicant
US8365297(B1)	2013-01-01	Parshin et al.	Applicant
US8370938(B1)	2013-02-01	Daswani	Examiner
US8370939(B2)	2013-02-01	Zaitsev et al.	Applicant
US8375444(B2)	2013-02-01	Aziz et al.	Applicant
US8381299(B2)	2013-02-01	Stolfo et al.	Applicant
US8402529(B1)	2013-03-01	Green et al.	Applicant
US8464340(B2)	2013-06-01	Ahn et al.	Applicant
US8479174(B2)	2013-07-01	Chiriac	Applicant
US8479276(B1)	2013-07-01	Vaystikh et al.	Applicant
US8479291(B1)	2013-07-01	Bodke	Applicant
US8510827(B1)	2013-08-01	Leake et al.	Applicant
US8510828(B1)	2013-08-01	Guo et al.	Applicant
US8510842(B2)	2013-08-01	Amit et al.	Applicant
US8516478(B1)	2013-08-01	Edwards et al.	Applicant
US8516590(B1)	2013-08-01	Ranadive et al.	Applicant
US8516593(B2)	2013-08-01	Aziz	Applicant
US8522348(B2)	2013-08-01	Chen et al.	Applicant
US8528086(B1)	2013-09-01	Aziz	Applicant
US8533824(B2)	2013-09-01	Hutton et al.	Applicant
US8539582(B1)	2013-09-01	Aziz et al.	Applicant
US8549638(B2)	2013-10-01	Aziz	Applicant
US8555391(B1)	2013-10-01	Demir et al.	Applicant
US8561177(B1)	2013-10-01	Aziz et al.	Applicant
US8566946(B1)	2013-10-01	Aziz et al.	Applicant
US8584094(B2)	2013-11-01	Dadhia et al.	Applicant
US8584234(B1)	2013-11-01	Sobel et al.	Applicant
US8584239(B2)	2013-11-01	Aziz et al.	Applicant
US8595834(B2)	2013-11-01	Xie et al.	Applicant
US8627476(B1)	2014-01-01	Satish et al.	Applicant
US8635696(B1)	2014-01-01	Aziz	Applicant
US8682054(B2)	2014-03-01	Xue et al.	Applicant
US8682812(B1)	2014-03-01	Ranjan	Applicant
US8689333(B2)	2014-04-01	Aziz	Applicant
US8695096(B1)	2014-04-01	Zhang	Applicant
US8713631(B1)	2014-04-01	Pavlyushchik	Applicant
US8713681(B2)	2014-04-01	Silberman et al.	Applicant
US8726392(B1)	2014-05-01	McCorkendale et al.	Applicant
US8739280(B2)	2014-05-01	Chess et al.	Applicant
US8776229(B1)	2014-07-01	Aziz	Applicant
US8782792(B1)	2014-07-01	Bodke	Applicant
US8789172(B2)	2014-07-01	Stolfo et al.	Applicant
US8789178(B2)	2014-07-01	Kejriwal et al.	Applicant
US8793787(B2)	2014-07-01	Ismael et al.	Applicant
US8805947(B1)	2014-08-01	Kuzkin et al.	Applicant
US8806647(B1)	2014-08-01	Daswani et al.	Applicant
US8832829(B2)	2014-09-01	Manni et al.	Applicant
US8850570(B1)	2014-09-01	Ramzan	Applicant
US8850571(B2)	2014-09-01	Staniford	Examiner
US8881234(B2)	2014-11-01	Narasimhan et al.	Applicant
US8881282(B1)	2014-11-01	Aziz et al.	Applicant
US8898788(B1)	2014-11-01	Aziz et al.	Applicant
US8935779(B2)	2015-01-01	Manni et al.	Applicant
US8984638(B1)	2015-03-01	Aziz et al.	Applicant
US8990939(B2)	2015-03-01	Staniford et al.	Applicant
US8990944(B1)	2015-03-01	Singh et al.	Applicant
US8997219(B2)	2015-03-01	Staniford	Examiner
US9009822(B1)	2015-04-01	Ismael et al.	Applicant
US9009823(B1)	2015-04-01	Ismael et al.	Applicant
US9027135(B1)	2015-05-01	Aziz	Applicant
US9071638(B1)	2015-06-01	Aziz et al.	Applicant
US9104867(B1)	2015-08-01	Thioux et al.	Applicant
US9106694(B2)	2015-08-01	Aziz et al.	Applicant
US9118715(B2)	2015-08-01	Staniford	Examiner
US9438622(B1)	2016-09-01	Staniford	Examiner
US2001/0005889(A1)	2001-06-01	Albrecht	Applicant
US2001/0047326(A1)	2001-11-01	Broadbent et al.	Applicant
US2002/0018903(A1)	2002-02-01	Kokubo et al.	Applicant
US2002/0038430(A1)	2002-03-01	Edwards et al.	Applicant
US2002/0091819(A1)	2002-07-01	Melchione et al.	Applicant
US2002/0095607(A1)	2002-07-01	Lin-Hendel	Applicant
US2002/0116627(A1)	2002-08-01	Tarbotton et al.	Applicant
US2002/0144156(A1)	2002-10-01	Copeland	Applicant
US2002/0162015(A1)	2002-10-01	Tang	Applicant
US2002/0166063(A1)	2002-11-01	Lachman et al.	Applicant
US2002/0169952(A1)	2002-11-01	DiSanto et al.	Applicant
US2002/0184528(A1)	2002-12-01	Shevenell et al.	Applicant
US2002/0188887(A1)	2002-12-01	Largman et al.	Applicant
US2002/0194490(A1)	2002-12-01	Halperin et al.	Applicant
US2003/0021728(A1)	2003-01-01	Sharpe et al.	Applicant
US2003/0074578(A1)	2003-04-01	Ford et al.	Applicant
US2003/0084318(A1)	2003-05-01	Schertz	Applicant
US2003/0101381(A1)	2003-05-01	Mateev et al.	Applicant
US2003/0115483(A1)	2003-06-01	Liang	Applicant
US2003/0188190(A1)	2003-10-01	Aaron et al.	Applicant
US2003/0191957(A1)	2003-10-01	Hypponen et al.	Applicant
US2003/0200460(A1)	2003-10-01	Morota et al.	Applicant
US2003/0212902(A1)	2003-11-01	van der Made	Applicant
US2003/0229801(A1)	2003-12-01	Kouznetsov et al.	Applicant
US2003/0237000(A1)	2003-12-01	Denton et al.	Applicant
US2004/0003323(A1)	2004-01-01	Bennett et al.	Applicant
US2004/0006473(A1)	2004-01-01	Mills et al.	Applicant
US2004/0015712(A1)	2004-01-01	Szor	Applicant
US2004/0019832(A1)	2004-01-01	Arnold et al.	Applicant
US2004/0047356(A1)	2004-03-01	Bauer	Applicant
US2004/0083408(A1)	2004-04-01	Spiegel et al.	Applicant
US2004/0088581(A1)	2004-05-01	Brawn et al.	Applicant
US2004/0093513(A1)	2004-05-01	Cantrell et al.	Applicant
US2004/0111531(A1)	2004-06-01	Staniford et al.	Applicant
US2004/0117478(A1)	2004-06-01	Triulzi et al.	Applicant
US2004/0117624(A1)	2004-06-01	Brandt et al.	Applicant
US2004/0128355(A1)	2004-07-01	Chao et al.	Applicant
US2004/0165588(A1)	2004-08-01	Pandya	Applicant
US2004/0236963(A1)	2004-11-01	Danford et al.	Applicant
US2004/0243349(A1)	2004-12-01	Greifeneder et al.	Applicant
US2004/0249911(A1)	2004-12-01	Alkhatib et al.	Applicant
US2004/0255161(A1)	2004-12-01	Cavanaugh	Applicant
US2004/0268147(A1)	2004-12-01	Wiederin et al.	Applicant
US2005/0005159(A1)	2005-01-01	Oliphant	Applicant
US2005/0021740(A1)	2005-01-01	Bar et al.	Applicant
US2005/0033960(A1)	2005-02-01	Vialen et al.	Applicant
US2005/0033989(A1)	2005-02-01	Poletto et al.	Applicant
US2005/0050148(A1)	2005-03-01	Mohammadioun et al.	Applicant
US2005/0086523(A1)	2005-04-01	Zimmer et al.	Applicant
US2005/0091513(A1)	2005-04-01	Mitomo et al.	Applicant
US2005/0091533(A1)	2005-04-01	Omote et al.	Applicant
US2005/0091652(A1)	2005-04-01	Ross et al.	Applicant
US2005/0108562(A1)	2005-05-01	Khazan et al.	Applicant
US2005/0114663(A1)	2005-05-01	Cornell et al.	Applicant
US2005/0125195(A1)	2005-06-01	Brendel	Applicant
US2005/0149726(A1)	2005-07-01	Joshi et al.	Applicant
US2005/0157662(A1)	2005-07-01	Bingham et al.	Applicant
US2005/0183143(A1)	2005-08-01	Anderholm et al.	Applicant
US2005/0201297(A1)	2005-09-01	Peikari	Applicant
US2005/0210533(A1)	2005-09-01	Copeland et al.	Applicant
US2005/0238005(A1)	2005-10-01	Chen et al.	Applicant
US2005/0240781(A1)	2005-10-01	Gassoway	Applicant
US2005/0262562(A1)	2005-11-01	Gassoway	Applicant
US2005/0265331(A1)	2005-12-01	Stolfo	Applicant
US2005/0283839(A1)	2005-12-01	Cowbum	Applicant
US2006/0010495(A1)	2006-01-01	Cohen et al.	Applicant
US2006/0015416(A1)	2006-01-01	Hoffman et al.	Applicant
US2006/0015715(A1)	2006-01-01	Anderson	Applicant
US2006/0015747(A1)	2006-01-01	Van de Ven	Applicant
US2006/0021029(A1)	2006-01-01	Brickell et al.	Applicant
US2006/0021054(A1)	2006-01-01	Costa et al.	Applicant
US2006/0031476(A1)	2006-02-01	Mathes et al.	Applicant
US2006/0047665(A1)	2006-03-01	Neil	Applicant
US2006/0070130(A1)	2006-03-01	Costea et al.	Applicant
US2006/0075496(A1)	2006-04-01	Carpenter et al.	Applicant
US2006/0095968(A1)	2006-05-01	Portolani et al.	Applicant
US2006/0101516(A1)	2006-05-01	Sudaharan et al.	Applicant
US2006/0101517(A1)	2006-05-01	Banzhof et al.	Applicant
US2006/0117385(A1)	2006-06-01	Mester et al.	Applicant
US2006/0123477(A1)	2006-06-01	Raghavan et al.	Applicant
US2006/0143709(A1)	2006-06-01	Brooks et al.	Applicant
US2006/0150249(A1)	2006-07-01	Gassen et al.	Applicant
US2006/0161983(A1)	2006-07-01	Cothrell et al.	Applicant
US2006/0161987(A1)	2006-07-01	Levy-Yurista	Applicant
US2006/0161989(A1)	2006-07-01	Reshef et al.	Applicant
US2006/0164199(A1)	2006-07-01	Gilde et al.	Applicant
US2006/0173992(A1)	2006-08-01	Weber et al.	Applicant
US2006/0179147(A1)	2006-08-01	Tran et al.	Applicant
US2006/0184632(A1)	2006-08-01	Marino et al.	Applicant
US2006/0191010(A1)	2006-08-01	Benjamin	Applicant
US2006/0221956(A1)	2006-10-01	Narayan et al.	Applicant
US2006/0236393(A1)	2006-10-01	Kramer et al.	Applicant
US2006/0242709(A1)	2006-10-01	Seinfeld et al.	Applicant
US2006/0248519(A1)	2006-11-01	Jaeger et al.	Applicant
US2006/0248582(A1)	2006-11-01	Panjwani et al.	Applicant
US2006/0251104(A1)	2006-11-01	Koga	Applicant
US2006/0288417(A1)	2006-12-01	Bookbinder et al.	Applicant
US2007/0006288(A1)	2007-01-01	Mayfield et al.	Applicant
US2007/0006313(A1)	2007-01-01	Porras et al.	Applicant
US2007/0011174(A1)	2007-01-01	Takaragi et al.	Applicant
US2007/0016951(A1)	2007-01-01	Piccard et al.	Applicant
US2007/0033645(A1)	2007-02-01	Jones	Applicant
US2007/0038943(A1)	2007-02-01	FitzGerald et al.	Applicant
US2007/0064689(A1)	2007-03-01	Shin et al.	Applicant
US2007/0074169(A1)	2007-03-01	Chess et al.	Applicant
US2007/0094730(A1)	2007-04-01	Bhikkaji et al.	Applicant
US2007/0101435(A1)	2007-05-01	Konanka et al.	Applicant
US2007/0128855(A1)	2007-06-01	Cho et al.	Applicant
US2007/0142030(A1)	2007-06-01	Sinha et al.	Applicant
US2007/0143827(A1)	2007-06-01	Nicodemus et al.	Applicant
US2007/0156895(A1)	2007-07-01	Vuong	Applicant
US2007/0157180(A1)	2007-07-01	Tillmann et al.	Applicant
US2007/0157306(A1)	2007-07-01	Elrod et al.	Applicant
US2007/0168988(A1)	2007-07-01	Eisner et al.	Applicant
US2007/0171824(A1)	2007-07-01	Ruello et al.	Applicant
US2007/0174915(A1)	2007-07-01	Gribble et al.	Applicant
US2007/0192500(A1)	2007-08-01	Lum	Applicant
US2007/0192858(A1)	2007-08-01	Lum	Applicant
US2007/0198275(A1)	2007-08-01	Malden et al.	Applicant
US2007/0208822(A1)	2007-09-01	Wang et al.	Applicant
US2007/0220607(A1)	2007-09-01	Sprosts et al.	Applicant
US2007/0240218(A1)	2007-10-01	Tuvell et al.	Applicant
US2007/0240219(A1)	2007-10-01	Tuvell et al.	Applicant
US2007/0240220(A1)	2007-10-01	Tuvell et al.	Applicant
US2007/0240222(A1)	2007-10-01	Tuvell et al.	Applicant
US2007/0250930(A1)	2007-10-01	Aziz	Examiner
US2007/0256132(A2)	2007-11-01	Oliphant	Applicant
US2007/0271446(A1)	2007-11-01	Nakamura	Applicant
US2008/0005782(A1)	2008-01-01	Aziz	Applicant
US2008/0018122(A1)	2008-01-01	Zierler et al.	Applicant
US2008/0028463(A1)	2008-01-01	Dagon et al.	Applicant
US2008/0032556(A1)	2008-02-01	Schreier	Applicant
US2008/0040710(A1)	2008-02-01	Chiriac	Applicant
US2008/0046781(A1)	2008-02-01	Childs et al.	Applicant
US2008/0066179(A1)	2008-03-01	Liu	Applicant
US2008/0072326(A1)	2008-03-01	Danford et al.	Applicant
US2008/0077793(A1)	2008-03-01	Tan et al.	Applicant
US2008/0080518(A1)	2008-04-01	Hoeflin et al.	Applicant
US2008/0086720(A1)	2008-04-01	Lekel	Applicant
US2008/0098476(A1)	2008-04-01	Syversen	Applicant
US2008/0120722(A1)	2008-05-01	Sima et al.	Applicant
US2008/0134178(A1)	2008-06-01	Fitzgerald et al.	Applicant
US2008/0134334(A1)	2008-06-01	Kim et al.	Applicant
US2008/0141376(A1)	2008-06-01	Clausen	Examiner
US2008/0184373(A1)	2008-07-01	Traut et al.	Applicant
US2008/0189787(A1)	2008-08-01	Arnold et al.	Applicant
US2008/0201778(A1)	2008-08-01	Guo et al.	Applicant
US2008/0209557(A1)	2008-08-01	Herley et al.	Applicant
US2008/0215742(A1)	2008-09-01	Goldszmidt et al.	Applicant
US2008/0222728(A1)	2008-09-01	Chavez et al.	Applicant
US2008/0222729(A1)	2008-09-01	Chen et al.	Applicant
US2008/0263665(A1)	2008-10-01	Ma et al.	Applicant
US2008/0295172(A1)	2008-11-01	Bohacek	Applicant
US2008/0301810(A1)	2008-12-01	Lehane et al.	Applicant
US2008/0307524(A1)	2008-12-01	Singh et al.	Applicant
US2008/0313738(A1)	2008-12-01	Enderby	Applicant
US2008/0320594(A1)	2008-12-01	Jiang	Applicant
US2009/0003317(A1)	2009-01-01	Kasralikar et al.	Applicant
US2009/0004427(A1)	2009-01-01	Sarrafi-Nour et al.	Applicant
US2009/0007100(A1)	2009-01-01	Field et al.	Applicant
US2009/0013408(A1)	2009-01-01	Schipka	Applicant
US2009/0031423(A1)	2009-01-01	Liu et al.	Applicant
US2009/0036111(A1)	2009-02-01	Danford et al.	Applicant
US2009/0037835(A1)	2009-02-01	Goldman	Applicant
US2009/0044024(A1)	2009-02-01	Oberheide et al.	Applicant
US2009/0044274(A1)	2009-02-01	Budko et al.	Applicant
US2009/0064332(A1)	2009-03-01	Porras et al.	Applicant
US2009/0077666(A1)	2009-03-01	Chen et al.	Applicant
US2009/0083369(A1)	2009-03-01	Marmor	Applicant
US2009/0083855(A1)	2009-03-01	Apap et al.	Applicant
US2009/0089879(A1)	2009-04-01	Wang et al.	Applicant
US2009/0094697(A1)	2009-04-01	Provos et al.	Applicant
US2009/0113425(A1)	2009-04-01	Ports et al.	Applicant
US2009/0125976(A1)	2009-05-01	Wassermann et al.	Applicant
US2009/0126015(A1)	2009-05-01	Monastyrsky et al.	Applicant
US2009/0126016(A1)	2009-05-01	Sobko et al.	Applicant
US2009/0133125(A1)	2009-05-01	Choi et al.	Applicant
US2009/0144823(A1)	2009-06-01	Lamastra et al.	Applicant
US2009/0158430(A1)	2009-06-01	Borders	Applicant
US2009/0172815(A1)	2009-07-01	Gu et al.	Applicant
US2009/0187992(A1)	2009-07-01	Poston	Applicant
US2009/0193293(A1)	2009-07-01	Stolfo et al.	Applicant
US2009/0199296(A1)	2009-08-01	Xie et al.	Applicant
US2009/0228233(A1)	2009-09-01	Anderson et al.	Applicant
US2009/0241187(A1)	2009-09-01	Troyansky	Applicant
US2009/0241190(A1)	2009-09-01	Todd et al.	Applicant
US2009/0265692(A1)	2009-10-01	Godefroid et al.	Applicant
US2009/0271867(A1)	2009-10-01	Zhang	Applicant
US2009/0300415(A1)	2009-12-01	Zhang et al.	Applicant
US2009/0300761(A1)	2009-12-01	Park et al.	Applicant
US2009/0328185(A1)	2009-12-01	Berg et al.	Applicant
US2009/0328221(A1)	2009-12-01	Blumfield et al.	Applicant
US2010/0005146(A1)	2010-01-01	Drako et al.	Applicant
US2010/0011205(A1)	2010-01-01	McKenna	Applicant
US2010/0017546(A1)	2010-01-01	Poo et al.	Applicant
US2010/0031353(A1)	2010-02-01	Thomas et al.	Applicant
US2010/0037314(A1)	2010-02-01	Perdisci et al.	Applicant
US2010/0043073(A1)	2010-02-01	Kuwamura	Applicant
US2010/0054278(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0058474(A1)	2010-03-01	Hicks	Applicant
US2010/0064044(A1)	2010-03-01	Nonoyama	Applicant
US2010/0077481(A1)	2010-03-01	Polyakov et al.	Applicant
US2010/0083376(A1)	2010-04-01	Pereira et al.	Applicant
US2010/0100718(A1)	2010-04-01	Srinivasan	Applicant
US2010/0115621(A1)	2010-05-01	Staniford et al.	Applicant
US2010/0132038(A1)	2010-05-01	Zaitsev	Applicant
US2010/0154056(A1)	2010-06-01	Smith et al.	Applicant
US2010/0180344(A1)	2010-07-01	Malyshev et al.	Applicant
US2010/0192223(A1)	2010-07-01	Ismael et al.	Applicant
US2010/0220863(A1)	2010-09-01	Dupaquis et al.	Applicant
US2010/0235831(A1)	2010-09-01	Dittmer	Applicant
US2010/0251104(A1)	2010-09-01	Massand	Applicant
US2010/0281102(A1)	2010-11-01	Chinta et al.	Applicant
US2010/0281541(A1)	2010-11-01	Stolfo et al.	Applicant
US2010/0281542(A1)	2010-11-01	Stolfo et al.	Applicant
US2010/0287260(A1)	2010-11-01	Peterson et al.	Applicant
US2010/0299754(A1)	2010-11-01	Amit et al.	Applicant
US2010/0306173(A1)	2010-12-01	Frank	Applicant
US2011/0004737(A1)	2011-01-01	Greenebaum	Applicant
US2011/0025504(A1)	2011-02-01	Lyon et al.	Applicant
US2011/0041179(A1)	2011-02-01	St Hlberg	Applicant
US2011/0047594(A1)	2011-02-01	Mahaffey et al.	Applicant
US2011/0047620(A1)	2011-02-01	Mahaffey et al.	Applicant
US2011/0055907(A1)	2011-03-01	Narasimhan et al.	Applicant
US2011/0078794(A1)	2011-03-01	Manni et al.	Applicant
US2011/0093951(A1)	2011-04-01	Aziz	Applicant
US2011/0099620(A1)	2011-04-01	Stavrou et al.	Applicant
US2011/0099633(A1)	2011-04-01	Aziz	Applicant
US2011/0113231(A1)	2011-05-01	Kaminsky	Applicant
US2011/0145918(A1)	2011-06-01	Jung et al.	Applicant
US2011/0145920(A1)	2011-06-01	Mahaffey et al.	Applicant
US2011/0145934(A1)	2011-06-01	Abramovici et al.	Applicant
US2011/0167493(A1)	2011-07-01	Song et al.	Applicant
US2011/0167494(A1)	2011-07-01	Bowen et al.	Applicant
US2011/0173460(A1)	2011-07-01	Ito et al.	Applicant
US2011/0219449(A1)	2011-09-01	St. Neitzel et al.	Applicant
US2011/0219450(A1)	2011-09-01	McDougal et al.	Applicant
US2011/0225624(A1)	2011-09-01	Sawhney et al.	Applicant
US2011/0225655(A1)	2011-09-01	Niemela et al.	Applicant
US2011/0247072(A1)	2011-10-01	Staniford et al.	Applicant
US2011/0265182(A1)	2011-10-01	Peinado et al.	Applicant
US2011/0289582(A1)	2011-11-01	Kejriwal et al.	Applicant
US2011/0302587(A1)	2011-12-01	Nishikawa et al.	Applicant
US2011/0307954(A1)	2011-12-01	Melnik et al.	Applicant
US2011/0307955(A1)	2011-12-01	Kaplan et al.	Applicant
US2011/0307956(A1)	2011-12-01	Yermakov et al.	Applicant
US2011/0314546(A1)	2011-12-01	Aziz et al.	Applicant
US2012/0023593(A1)	2012-01-01	Puder	Applicant
US2012/0054869(A1)	2012-03-01	Yen et al.	Applicant
US2012/0066698(A1)	2012-03-01	Yanoo	Applicant
US2012/0079596(A1)	2012-03-01	Thomas	Examiner
US2012/0084859(A1)	2012-04-01	Radinsky et al.	Applicant
US2012/0110667(A1)	2012-05-01	Zubrilin et al.	Applicant
US2012/0117652(A1)	2012-05-01	Manni et al.	Applicant
US2012/0121154(A1)	2012-05-01	Xue et al.	Applicant
US2012/0124426(A1)	2012-05-01	Maybee et al.	Applicant
US2012/0174186(A1)	2012-07-01	Aziz et al.	Applicant
US2012/0174196(A1)	2012-07-01	Bhogavilli et al.	Applicant
US2012/0174218(A1)	2012-07-01	McCoy et al.	Applicant
US2012/0198279(A1)	2012-08-01	Schroeder	Applicant
US2012/0210423(A1)	2012-08-01	Friedrichs et al.	Applicant
US2012/0222121(A1)	2012-08-01	Staniford et al.	Applicant
US2012/0255015(A1)	2012-10-01	Sahita et al.	Applicant
US2012/0255017(A1)	2012-10-01	Sallam	Applicant
US2012/0260342(A1)	2012-10-01	Dube et al.	Applicant
US2012/0266244(A1)	2012-10-01	Green et al.	Applicant
US2012/0278886(A1)	2012-11-01	Luna	Applicant
US2012/0297489(A1)	2012-11-01	Dequevy	Applicant
US2012/0330801(A1)	2012-12-01	McDougal et al.	Applicant
US2013/0014259(A1)	2013-01-01	Gribble et al.	Applicant
US2013/0036472(A1)	2013-02-01	Aziz	Applicant
US2013/0047257(A1)	2013-02-01	Aziz	Applicant
US2013/0074185(A1)	2013-03-01	McDougal et al.	Applicant
US2013/0086684(A1)	2013-04-01	Mohler	Applicant
US2013/0097699(A1)	2013-04-01	Balupari et al.	Applicant
US2013/0097706(A1)	2013-04-01	Titonis et al.	Applicant
US2013/0111587(A1)	2013-05-01	Goel et al.	Applicant
US2013/0117852(A1)	2013-05-01	Stute	Applicant
US2013/0117855(A1)	2013-05-01	Kim et al.	Applicant
US2013/0139264(A1)	2013-05-01	Brinkley et al.	Applicant
US2013/0160125(A1)	2013-06-01	Likhachev et al.	Applicant
US2013/0160127(A1)	2013-06-01	Jeong et al.	Applicant
US2013/0160130(A1)	2013-06-01	Mendelev et al.	Applicant
US2013/0160131(A1)	2013-06-01	Madou et al.	Applicant
US2013/0167236(A1)	2013-06-01	Sick	Applicant
US2013/0174214(A1)	2013-07-01	Duncan	Applicant
US2013/0185789(A1)	2013-07-01	Hagiwara et al.	Applicant
US2013/0185795(A1)	2013-07-01	Winn et al.	Applicant
US2013/0185798(A1)	2013-07-01	Saunders et al.	Applicant
US2013/0191915(A1)	2013-07-01	Antonakakis et al.	Applicant
US2013/0196649(A1)	2013-08-01	Paddon et al.	Applicant
US2013/0227691(A1)	2013-08-01	Aziz et al.	Applicant
US2013/0246370(A1)	2013-09-01	Bartram et al.	Applicant
US2013/0263260(A1)	2013-10-01	Mahaffey et al.	Applicant
US2013/0291109(A1)	2013-10-01	Staniford et al.	Applicant
US2013/0298243(A1)	2013-11-01	Kumar et al.	Applicant
US2014/0053260(A1)	2014-02-01	Gupta et al.	Applicant
US2014/0053261(A1)	2014-02-01	Gupta et al.	Applicant
US2014/0130158(A1)	2014-05-01	Wang et al.	Applicant
US2014/0137180(A1)	2014-05-01	Lukacs et al.	Applicant
US2014/0169762(A1)	2014-06-01	Ryu	Applicant
US2014/0179360(A1)	2014-06-01	Jackson et al.	Applicant
US2014/0328204(A1)	2014-11-01	Klotsche et al.	Applicant
US2014/0337836(A1)	2014-11-01	Ismael	Applicant
US2014/0351935(A1)	2014-11-01	Shao et al.	Applicant
US2015/0096025(A1)	2015-04-01	Ismael	Applicant
GB2439806(A)	2008-01-01		Applicant
GB2490431(A)	2012-10-01		Applicant
WO2/006928(A2)	2002-01-01		Applicant
WO2/23805(A2)	2002-03-01		Applicant
WO2007/022454(A2)	2007-02-01		Applicant
WO2007117636(A2)	2007-10-01		Applicant
WO2008041950(A2)	2008-04-01		Applicant
WO2008/084259(A1)	2008-07-01		Applicant
WO2011084431(A2)	2011-07-01		Applicant
WO2011/112348(A1)	2011-09-01		Applicant
WO2012/075336(A1)	2012-06-01		Applicant
WO2012145066(A1)	2012-10-01		Applicant
WO2013/067505(A1)	2013-05-01		Applicant
WO2014057542(A1)	2014-04-01		Applicant

Non-Patent Literature (96)

Liljenstam, Michael , et al., “Simulating Realistic Network Traffic for Worm Warning System Design and Testing”, Institute for Security Technology studies, Dartmouth College (“Liljenstam”), (Oct. 27, 2003).Applicant
Lindorfer, Martina, Clemens Kolbitsch, and Paolo Milani Comparetti. “Detecting environment-sensitive malware.” Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2011.Applicant
Lok Kwong et al: “DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis”, Aug. 10, 2012, XP055158513, Retrieved from the Internet: URL:https://www.usenix.org/system/files/conference/usenixsecurity12/sec12--final107.pdf [retrieved on Dec. 15, 2014].Applicant
Marchette, David J., “Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint”, (“Marchette”), (2001).Applicant
Margolis, P.E. , “Random House Webster's ‘Computer & Internet Dictionary 3rd Edition’”, ISBN 0375703519, (Dec. 1998).Applicant
Moore, D. , et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, INFOCOM, vol. 3, (Mar. 30-Apr. 3, 2003), pp. 1901-1910.Applicant
Morales, Jose A., et al., ““Analyzing and exploiting network behaviors of malware.””, Security and Privacy in communication Networks. Springer Berlin Heidelberg, 2010. 20-34.Applicant
Mori, Detecting Unknown Computer Viruses, 2004, Springer-Verlag Berlin Heidelberg.Applicant
Natvig, Kurt , “SANDBOXII: Internet”, Virus Bulletin Conference, (“Natvig”), (Sep. 2002).Applicant
NetBIOS Working Group. Protocol Standard for a NetBIOS Service on a TCP/UDP transport: Concepts and Methods. STD 19, RFC 1001, Mar. 1987.Applicant
Newsome, J. , et al., “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”, In Proceedings of the 12th Annual Network and Distributed System Security, Symposium (NDSS '05), (Feb. 2005).Applicant
Newsome, J. , et al., “Polygraph: Automatically Generating Signatures for Polymorphic Worms”, In Proceedings of the IEEE Symposium on Security and Privacy, (May 2005).Applicant
Nojiri, D. , et al., “Cooperation Response Strategies for Large Scale Attack Mitigation”, DARPA Information Survivability Conference and Exposition, vol. 1, (Apr. 22-24, 2003), pp. 293-302.Applicant
Oberheide et al., CloudAV.sub.--N-Version Antivirus in the Network Cloud, 17th USENIX Security Symposium USENIX Security '08 Jul. 28-Aug. 1, 2008 San Jose, CA.Applicant
PCT/US2012/021916 filed Jan. 19, 2012, International Search Report and Written Opinion dated May 10, 2012.Applicant
Rautiainen et al. “A Look at Portable Document Format Vulnerabilities”, Information Security Technical Report, Elsevier Advanced Technology, Amsterdam, NL, vol. 14, No. L, Feb. 1, 2009 (Feb. 1, 2009).Applicant
Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Roonald Perez, Leendert van Doom, John Linwood Griffin, Stefan Berger., sHype: Secure Hypervisor Appraoch to Trusted Virtualized Systems (Feb. 2, 2005) (“Sailer”).Applicant
Silicon Defense, “Worm Containment in the Internal Network”, (Mar. 2003), pp. 1-25.Applicant
Singh, S. , et al., “Automated Worm Fingerprinting”, Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, California, (Dec. 2004).Applicant
Spitzner, Lance , “Honeypots: Tracking Hackers”, (“Spizner”), (Sep. 17, 2002).Applicant
The Sniffers's Guide to Raw Traffic available at: yuba.stanford.edu/.about.casado/pcap/section1.html, (Jan. 6, 2014).Applicant
Thomas H. Ptacek, and Timothy N. Newsham , “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, Secure Networks, (“Ptacek”), (Jan. 1998).Applicant
U.S. Appl. No. 12/263,971, filed Nov. 3, 2008 Final Office Action dated Aug. 26, 2011.Applicant
U.S. Appl. No. 12/263,971, filed Nov. 3, 2008 Final Office Action dated Sep. 10, 2013.Applicant
U.S. Appl. No. 12/263,971, filed Nov. 3, 2008 Final Office Action dated Sep. 11, 2012.Applicant
U.S. Appl. No. 12/263,971, filed Nov. 3, 2008 Non-Final Office Action dated Apr. 11, 2012.Applicant
U.S. Appl. No. 12/263,971, filed Nov. 3, 2008 Non-Final Office Action dated Apr. 18, 2011.Applicant
U.S. Appl. No. 12/263,971, filed Nov. 3, 2008 Non-Final Office Action dated Dec. 23, 2013.Applicant
U.S. Appl. No. 12/263,971, filed Nov. 3, 2008 Non-Final Office Action dated Mar. 14, 2013.Applicant
U.S. Appl. No. 12/263,971, filed Nov. 3, 2008 Notice of Allowance dated Jun. 20, 2014.Applicant
U.S. Appl. No. 13/011,344, filed Jan. 21, 2011 Advisory Action dated Jun. 19, 2013.Applicant
U.S. Appl. No. 13/011,344, filed Jan. 21, 2011 Final Office Action dated Apr. 2, 2014.Applicant
U.S. Appl. No. 13/011,344, filed Jan. 21, 2011 Final Office Action dated Jan. 2, 2013.Applicant
U.S. Appl. No. 13/011,344, filed Jan. 21, 2011 Non-Final Office Action dated Aug. 10, 2012.Applicant
U.S. Appl. No. 13/011,344, filed Jan. 21, 2011 Non-Final Office Action dated Oct. 22, 2013.Applicant
U.S. Appl. No. 13/011,344, filed Jan. 21, 2011 Non-Final Office Action dated Sep. 30, 2014.Applicant
U.S. Appl. No. 13/011,344, filed Jan. 21, 2011 Notice of Allowance dated Jan. 21, 2015.Applicant
U.S. Appl. No. 14/673,292, filed Mar. 30, 2015 Notice of Allowance dated Apr. 29, 2016.Applicant
U.S. Pat. No. 8,171,553 filed Apr. 20, 2006, Inter Parties Review Decision dated Jul. 10, 2015.Applicant
U.S. Pat. No. 8,291,499 filed Mar. 16, 2012, Inter Parties Review Decision dated Jul. 10, 2015.Applicant
Venezia, Paul , “NetDetector Captures Intrusions”, InfoWorld Issue 27, (“Venezia”), (Jul. 14, 2003).Applicant
Wahid et al., Characterising the Evolution in Scanning Activity of Suspicious Hosts, Oct. 2009, Third International Conference on Network and System Security, pp. 344-350.Applicant
Whyte, et al., “DNS-Based Detection of Scanning Works in an Enterprise Network”, Proceedings of the 12th Annual Network and Distributed System Security Symposium, (Feb. 2005), 15 pages.Applicant
Williamson, Matthew M., “Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code”, ACSAC conference, Las Vegas, NV, USA, (Dec. 2002), pp. 1-9.Applicant
Yuhei Kawakoya et al: “Memory behavior-based automatic malware unpacking in stealth debugging environment”, Malicious and Unwanted Software (Malware), 2010 5th International Conference on, IEEE, Piscataway, NJ, USA, Oct. 19, 2010, pp. 39-46, XP031833827, ISBN:978-1-4244-8-9353-1.Applicant
Zhang et al., The Effects of Threading, Infection Time, and Multiple-Attacker Collaboration on Malware Propagation, Sep. 2009, IEEE 28th International Symposium on Reliable Distributed Systems, pp. 73-82.Applicant
“Network Security: NetDetector—Network Intrusion Forensic System (NIFS) Whitepaper”, (“NetDetector Whitepaper”), (2003).Applicant
“Packet”, Microsoft Computer Dictionary, Microsoft Press, (Mar. 2002), 1 page.Applicant
“When Virtual is Better Than Real”, IEEEXplore Digital Library, available at, http://ieeexplore.ieee.org/xpl/articleDetails.isp?reload=true&arnumbe- r=990073, (Dec. 7, 2013).Applicant
Abdullah, et al., Visualizing Network Data for Intrusion Detection, 2005 IEEE Workshop on Information Assurance and Security, pp. 100-108.Applicant
Adetoye, Adedayo , et al., “Network Intrusion Detection & Response System”, (“Adetoye”), (Sep. 2003).Applicant
Adobe Systems Incorporated, “PDF 32000-1:2008, Document management—Portable document format—Part1:PDF1.7”, First Edition, Jul. 1, 2008, 756 pages.Applicant
AltaVista Advanced Search Results. “attack vector identifier”. Http://www.altavista.com/web/results?Itag=ody&pg=aq&aqmode=aqa=Event+Orch- estrator . . . , (Accessed on Sep. 15, 2009).Applicant
AltaVista Advanced Search Results. “Event Orchestrator”. Http://www.altavista.com/web/results?Itag=ody&pg=aq&aqmode=aqa=Event+Orch- esrator . . . , (Accessed on Sep. 3, 2009).Applicant
Anonymous, “Inside Adobe Reader Protected 1 Mode—Part 1”—Design, Oct. 5, 2010 (Oct. 5, 2010), Retrieved from be Internet: URL:http://blogs.adobe.com/security/2010/1O/inside-adobe-reader-protected-mode-part-1-design.html [retrieved on May 6, 2014].Applicant
Apostolopoulos, George; hassapis, Constantinos; “V-eM: A cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation”, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126.Applicant
Aura, Tuomas, “Scanning electronic documents for personally identifiable information”, Proceedings of the 5th ACM workshop on Privacy in electronic society. ACM, 2006.Applicant
Baecher, “The Nepenthes Platform: An Efficient Approach to collect Malware”, Springer-verlag Berlin Heidelberg, (2006), pp. 165-184.Applicant
Baldi, Mario; Risso, Fulvio; “A Framework for Rapid Development and Portable Execution of Packet-Handling Applications”, 5th IEEE International Symposium Processing and Information Technology, Dec. 21, 2005, pp. 233-238.Applicant
Bayer, et al., “Dynamic Analysis of Malicious Code”, J Comput Virol, Springer-Verlag, France., (2006), pp. 67-77.Applicant
Boubalos, Chris , “extracting syslog data out of raw pcap dumps, seclists.org, Honeypots mailing list archives”, available at http://seclists.org/honeypots/2003/q2/319 (“Boubalos”), (Jun. 5, 2003).Applicant
Chaudet, C. , et al., “Optimal Positioning of Active and Passive Monitoring Devices”, International Conference on Emerging Networking Experiments and Technologies, Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology, CoNEXT '05, Toulousse, France, (Oct. 2005), pp. 71-82.Applicant
Chen, P. M. and Noble, B. D., “When Virtual is Better Than Real, Department of Electrical Engineering and Computer Science”, University of Michigan (“Chen”), 2001.Applicant
Cisco “Intrusion Prevention for the Cisco ASA 5500-x Series” Data Sheet (2012).Applicant
Cisco, Configuring the Catalyst Switched Port Analyzer (SPAN) (“Cisco”), (1992).Applicant
Clark, John, Sylvian Leblanc,and Scott Knight. “Risks associated with usb hardware trojan devices used by insiders.” Systems Conference (SysCon), 2011 IEEE International. IEEE, 2011.Applicant
Cohen, M.I. , “PyFlag—An advanced network forensic framework”, Digital investigation 5, Elsevier, (2008), pp. S112-S120.Applicant
Costa, M. , et al., “Vigilante: End-to-End Containment of Internet Worms”, SOSP '05, Association for Computing Machinery, Inc., Brighton U.K., (Oct. 23-26, 2005).Applicant
Crandall, J.R. , et al., “Minos:Control Data Attack Prevention Orthogonal to Memory Model”, 37th International Symposium on Microarchitecture, Portland, Oregon, (Dec. 2004).Applicant
Deutsch, P. , “Zlib compressed data format specification version 3.3” RFC 1950, (1996).Applicant
Didier Stevens: “Malicious PDF Documents Explained”, Security & Privacy, IEEE, IEEE Service Center, Los Alamitos, CA, US, vol. 9, No. L, Jan. 1, 2011 (Jan. 1, 2011).Applicant
Distler, “Malware Analysis: An Introduction”, SANS Institute InfoSec Reading Room, SANS Institute, (2007).Applicant
Dunlap, George W. , et al., “ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay”, Proceeding of the 5th Symposium on Operating Systems Design and Implementation, USENIX Association, (“Dunlap”), (Dec. 9, 2002).Applicant
EP 12736373.7 filed Jan. 19, 2012 Extended European Search Report dated May 21, 2014.Applicant
Excerpt regarding First Printing Date for Merike Kaeo, Designing Network Security (“Kaeo”), (2005).Applicant
Filiol, Eric , et al., “Combinatorial Optimisation of Worm Propagation on an Unknown Network”, International Journal of Computer Science 2.2 (2007).Applicant
FireEye Malware Analysis & Exchange Network, Malware Protection System, FireEye Inc., 2010.Applicant
FireEye Malware Analysis, Modern Malware Forensics, FireEye Inc., 2010.Applicant
FireEye v.6.0 Security Target, pp. 1-35, Version 1.1, FireEye Inc., May 2011.Applicant
Gibler, Clint, et al. AndroidLeaks: automatically detecting potential privacy leaks in android applications on a large scale. Springer Berlin Heidelberg, 2012.Applicant
Goel, et al., Reconstructing System State for Intrusion Analysis, Apr. 2008 SIGOPS Operating Systems Review, vol. 12 Issue 3, pp. 21-28.Applicant
Gregg Keizer: “Microsoft's HoneyMonkeys Show Patching Windows Works”, Aug. 8, 2005, XP055143386, Retrieved from the Internet: URL:http://www.informationweek.com/microsofts-honeymonkeys-show-patching-windows-works/d/d-id/1035069? [retrieved on Jun. 1, 2016].Applicant
Heng Yin et al, Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis, Research Showcase © CMU, Carnegie Mellon University, 2007.Applicant
Hjelmvik, Erik , “Passive Network Security Analysis with NetworkMiner”, (IN)Secure, Issue 18, (Oct. 2008), pp. 1-100.Applicant
Idika et al., A-Survey-of-Malware-Detection-Techniques, Feb. 2, 2007, Department of Computer Science, Purdue University.Applicant
IEEE Xplore Digital Library Sear Results for “detection of unknown computer worms”. Http://ieeexplore.ieee.org/searchresult.jsp?SortField=Score&SortOrder=desc- &ResultC . . . , (Accessed on Aug. 28, 2009).Applicant
Isohara, Takamasa, Keisuke Takemori, and Ayumu Kubota. “Kernel-based behavior analysis for android malware detection.” Computational intelligence and Security (CIS), 2011 Seventh International Conference on. IEEE, 2011.Applicant
Kaeo, Merike , “Designing Network Security”, (“Kaeo”), (Nov. 2003).Applicant
Kevin A Roundy et al: “Hybrid Analysis and Control of Malware”, Sep. 15, 2010, Recent Advances in Intrusion Detection, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 317-338, XP019150454 ISBN:978-3-642-15511-6.Applicant
Kim, H. , et al., “Autograph: Toward Automated, Distributed Worm Signature Detection”, Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, (Aug. 2004), pp. 271-286.Applicant
King, Samuel T., et al., “Operating System Support for Virtual Machines”, (“King”) (2003).Applicant
Krasnyansky, Max , et al., Universal TUN/TAP driver, available at https://www.kerne.org/doc/Documentation/networking/tuntap.txt (2002) (“Krasnyansky”).Applicant
Kreibich, C. , et al., “Honeycomb-Creating Intrusion Detection Signatures Using Honeypots”, 2nd Workshop on Hot Topics in Networks (HotNets-11), Boston, USA, (2003).Applicant
Kristoff, J. , “Botnets, Detection and Mitigation: DNS-Based Techniques”, NU Security Day, (2005), 23 pages.Applicant
Leading Colleges Select FireEye to Stop Malware-Related Data Breaches, FireEye Inc., 2009.Applicant
Li et al., A VMM-Based System Call Interposition Framework for Program Monitoring, Dec. 2010, IEEE 16th International Conference on Parallel and Distributed Systems, pp. 706-711.Applicant

Abstract