摘要:
A method of securely executing a Just-In-Time (JIT) compiled code in a runtime environment, comprising using one or more processors for receiving from a JIT executing process a request to compile in runtime a code segment, initiating a JIT compiling process to compile the code segment in order to generate an executable code segment, storing the executable code segment in a shared memory and providing to the JIT executing process a pointer to the executable code segment in the shared memory. Wherein the JIT executing process having read-execute access rights to the shared memory and the JIT executing process and the JIT compiling process are different processes.
摘要:
A threat detection method and apparatus, and a network system are disclosed, which relate to the field of computer technologies, and can resolve a missed detection problem of a Web sandbox in a delay loading scenario. The method includes: when loading a URL in a browser of a Web sandbox, obtaining page code of a first display page group identified by the URL and an overall size occupied by the first display page group in a display area of the browser; injecting preset dynamic code into the page code of the first display page group; parsing and executing the page code that is of the first display page group and that includes the preset dynamic code; sending a request message when detecting that a value of a display variable is greater than or equal to a preset value, to request to obtain page code of a second display page group; receiving a response message that carries the page code of the second display page group; and detecting, in the Web sandbox, whether the page code of the second display page group carries attack code.
摘要:
A program that causes an information processing apparatus to execute a process, the process includes executing a first program by using a system including a kernel of an operating system (OS) and shared libraries, acquiring first information on a first file group read out from the shared libraries, executing a second program by using the system, acquiring second information on a second file group read out from the shared libraries, executing similarity determination processing of determining similarity between the first program and the second program by comparing the first information and the second information that have been acquired, and outputting the similarity that has been determined.
摘要:
In some embodiments, an anti-malware system accounts for benign differences between non-malicious data objects, such as differences introduced by compilers and other polymorphisms. A target object is separated into a multitude of code blocks, and a hash is calculated for each code block. The obtained set of target hashes is then compared against a database of hashes corresponding to code blocks extracted from whitelisted objects. A target object may be labeled as whitelisted (trusted, non-malicious) if it has a substantial number of hashes in common with a whitelisted object. Objects which are slightly different from known whitelisted objects may still receive whitelisting status. By allowing a certain degree of mismatch between the sets of hashes of distinct objects, some embodiments of the present invention increase the efficiency of whitelisting without an unacceptable decrease in safety.
摘要:
Visual and non-visual elements associated with the candidate files are analyzed to determine whether the candidate files are malware. A visual element (e.g., icon) is extracted from the candidate file, and the icon's image is compared to a group of reference images associated with trusted entities. If the icon's image matches a reference image, the candidate file may be malware masquerading as trusted software. The non-visual elements associated with the candidate file are used, in combination with the visual elements, to determine whether the candidate file is malware.
摘要:
Particular embodiments described herein provide for an electronic device that can be configured to analyze data related to a digital certificate and assign a reputation to the digital certificate, where the reputation includes an indication if the data is proper. The analysis of the data can include determining if code signing for the digital certificate matches binary code for the digital certificate, if the digital certificate has been grafted to the data by modifying a portable executable file header, or the digital certificate is the same as another trusted digital certificate associated with different data.
摘要:
An embodiment of the present invention discloses a web application security access method, including: periodically detecting, by an application store server, whether locally stored backup source code is consistent with source code that is corresponding to a web application and that is in a web server, and if the locally stored backup source code is inconsistent with the source code that is corresponding to the web application and that is in the web server, adding an exception identifier to a version parameter stored on the application store server; receiving, by the application store server, an access request that is for accessing the web application and that is sent by a user by using a client, where the access request includes a user version parameter of source code corresponding to the web application installed on the client; and if detecting that the exception identifier exists in the version parameter that is stored on the application store server and associated with the user version parameter, returning, by the application store server to the client, prompt information used to indicate to the user that there is a security risk in the access request. Embodiments of the present invention further disclose a server and a client. By using the present invention, security of accessing a web application can be improved.
摘要:
Visual and non-visual elements associated with the candidate files are analyzed to determine whether the candidate files are malware. A visual element (e.g., icon) is extracted from the candidate file, and the icon's image is compared to a group of reference images associated with trusted entities. If the icon's image matches a reference image, the candidate file may be malware masquerading as trusted software. The non-visual elements associated with the candidate file are used, in combination with the visual elements, to determine whether the candidate file is malware.