利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

232 条记录 (耗时 0.028 秒)

    DETECTION AND PREVENTION OF INSTALLATION OF MALICIOUS MOBILE APPLICATIONS
    25.
    发明授权
    DETECTION AND PREVENTION OF INSTALLATION OF MALICIOUS MOBILE APPLICATIONS 有权

    公开(公告)号：EP2839406B1

    公开(公告)日：2018-08-08

    申请号：EP13778473.2

    申请日：2013-04-17

    申请人： McAfee, LLC

    发明人： DAS, Sudeep ,  DIVAKARLA, Jayasankar ,  SHARMA, Pramod

    IPC分类号： G06F21/56 ,  G06F21/44 ,  H04L29/06 ,  G06F21/51

    CPC分类号： H04L63/1441 ,  G06F17/30876 ,  G06F21/51 ,  G06F2221/033 ,  H04W12/12

    摘要： A combination of shim and back-end server applications may be used to identify and block the installation of malicious applications on mobile devices. In practice, a shim application registers with a mobile device's operating system to intercept application installation operations. Upon intercepting an attempted installation operation, the shim application identifies the application seeking to be installed, generates a key uniquely identifying the application, and transmits the key over a network connection to a back-end server. The back-end server may be configured to crawl the Internet to identify malicious applications and compile and maintain a database of such applications. Upon receiving a key from the shim application, the back-end server can search its database to locate a matching application and, if found, respond to the mobile device with the application's status (e.g., malicious or not). The shim application can utilize this information to allow or block installation of the application.

    BEHAVIORAL DETECTION OF MALWARE AGENTS
    28.
    发明公开
    BEHAVIORAL DETECTION OF MALWARE AGENTS 无效

    公开(公告)号：EP3198800A4

    公开(公告)日：2018-06-20

    申请号：EP15843535

    申请日：2015-08-25

    申请人： MCAFEE LLC

    发明人： MONDIGUING STEPHEN ,  CRUZ BENJAMIN

    IPC分类号： H04L29/06 ,  H04L29/12

    CPC分类号： H04L63/1416 ,  H04L61/1511 ,  H04L2463/142 ,  H04L2463/144 ,  H05K999/99

    摘要： In an example, a detection engine identifies potential malware objects according to behavior. In order to circumvent blacklists and fingerprint-based detection, a malware server may frequently change domain names, and change the fingerprints of distributed malware agents. A malware agent may perform only an initial DNS lookup, and thereafter communicate with the malware command-and-control server via “naked” HTTP packets using the raw IP address of the server. The detection engine identifies malware agents by this behavior. In one example, if an executable object makes repeated HTTP requests to an address after the DNS lookup “time to live” has expired, the object may be flagged as potential malware.

    MITIGATION OF STACK CORRUPTION EXPLOITS
    29.
    发明公开
    MITIGATION OF STACK CORRUPTION EXPLOITS 无效

    公开(公告)号：EP3198506A4

    公开(公告)日：2018-05-30

    申请号：EP15844964

    申请日：2015-08-26

    申请人： MCAFEE LLC

    发明人： CROWE SIMON

    IPC分类号： G06F21/54 ,  G06F21/52 ,  G06F21/56

    CPC分类号： G06F21/54 ,  G06F2221/033

    摘要： In an example, a stack protection engine is disclosed for preventing or ameliorating stack corruption attacks. The stack protection engine may operate transparently to user-space processes. After a call to a subroutine from a parent routine, the stack protection engine encodes the return address on the stack, such as with an exclusive or cipher and a key selected from a key array. After the subroutine returns control to the main routine, the stack protection engine decodes the address, and returns control. If a stack corruption attack occurs, the malicious return address is not properly encoded, so that when decoding occurs, the program may simply crash rather than returning control to the malicious code.

    SECURITY SERVICE FOR AN UNMANAGED DEVICE
    30.
    发明公开
    SECURITY SERVICE FOR AN UNMANAGED DEVICE 审中-公开
    为未经管理的设备提供安全服务

    公开(公告)号：EP3318042A1

    公开(公告)日：2018-05-09

    申请号：EP16818420.8

    申请日：2016-05-30

    申请人： McAfee, LLC

    发明人： STECHER, Martin ,  SABBAN, Andre

    IPC分类号： H04L29/06 ,  H04L29/08 ,  H04L12/26

    CPC分类号： H04L63/10 ,  G06F8/65 ,  H04L43/50 ,  H04L63/0281 ,  H04L63/102 ,  H04L67/02 ,  H04W12/0027

    摘要： Particular embodiments described herein provide for a network element that can be configured to receive, from an electronic device, a request to access a network service. In response to the request, the network element can send data related to the network service to the electronic device and add a test link to the data related to the network service. The network element can also be configured to determine if the test link was successfully executed and classify the electronic device as untrusted if the test link was not successfully executed.