发明授权
US08694833B2 Methods, media, and systems for detecting an anomalous sequence of function calls
有权
用于检测函数调用异常顺序的方法,介质和系统
- 专利标题: Methods, media, and systems for detecting an anomalous sequence of function calls
- 专利标题(中): 用于检测函数调用异常顺序的方法,介质和系统
-
申请号: US13942632申请日: 2013-07-15
-
公开(公告)号: US08694833B2公开(公告)日: 2014-04-08
- 发明人: Angelos D. Keromytis , Salvatore J. Stolfo
- 申请人: Angelos D. Keromytis , Salvatore J. Stolfo
- 申请人地址: US NY New York
- 专利权人: The Trustees of Columbia University in the City of New York
- 当前专利权人: The Trustees of Columbia University in the City of New York
- 当前专利权人地址: US NY New York
- 代理机构: Byrne Poh LLP
- 主分类号: G06F11/00
- IPC分类号: G06F11/00
摘要:
Methods, media, and systems for detecting an anomalous sequence of function calls are provided. The methods can include compressing a sequence of function calls made by the execution of a program using a compression model; and determining the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed. The methods can further include executing at least one known program; observing at least one sequence of function calls made by the execution of the at least one known program; assigning each type of function call in the at least one sequence of function calls made by the at least one known program a unique identifier; and creating at least part of the compression model by recording at least one sequence of unique identifiers.
公开/授权文献
信息查询