中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

4 records (took 0.014 seconds)

    PREVENTING ACTIVATION OF MALWARE BY EXHIBITING SANDBOX BEHAVIOR IN A NON-SANDBOX ENVIRONMENT
    1.
    发明公开
    PREVENTING ACTIVATION OF MALWARE BY EXHIBITING SANDBOX BEHAVIOR IN A NON-SANDBOX ENVIRONMENT 审中-公开

    公开(公告)号：US20230385413A1

    公开(公告)日：2023-11-30

    申请号：US17825684

    申请日：2022-05-26

    Applicant: VMware, Inc.

    Inventor： Rayanagouda Bheemanagouda PATIL ,  Kedar Bhalchandra CHAUDHARI ,  Clemens KOLBITSCH ,  Laxmikant Vithal GUNDA ,  Vaibhav KULKARNI

    IPC: G06F21/56 ,  G06F21/53

    CPC classification number: G06F21/566 ,  G06F21/53 ,  G06F2221/034

    Abstract: The disclosure herein describes executing unknown processes while preventing sandbox-evading malware therein from performing malicious behavior. A process execution event associated with an executable is detected, wherein the executable is to be executed in a production environment. The executable is determined to be an unknown executable (e.g., an executable that has not been analyzed for malware) using signature data in the process execution event. A function call hook interface of a sandbox simulator is activated, and a process of the executable is executed in the production environment. Any function calls from the executing process are intercepted by the activated function call hook interface, and sandbox-style responses to the intercepted function call are generated using sandbox response data of the sandbox simulator. The generated sandbox responses are provided to the executing process, whereby malware included in the executable behaves as if the executing process is executing in a sandbox environment.

    IN-MEMORY SCANNING FOR FILELESS MALWARE ON A HOST DEVICE
    2.
    发明公开
    IN-MEMORY SCANNING FOR FILELESS MALWARE ON A HOST DEVICE 审中-公开

    公开(公告)号：US20230367877A1

    公开(公告)日：2023-11-16

    申请号：US17743274

    申请日：2022-05-12

    Applicant: VMware, Inc.

    Inventor： Kedar Bhalchandra CHAUDHARI ,  Pranav GOKHALE ,  Mandar BARVE

    IPC: G06F21/56 ,  G06F21/53

    CPC classification number: G06F21/566 ,  G06F21/53

    Abstract: The disclosure herein describes the processing of malware scan requests from VCIs by an anti-malware scanner (AMS) on a host device. A malware scan request is received by the AMS from a VCI, the malware scan request including script data of a script from a memory buffer of the VCI. The AMS scans the script data of the malware scan request, outside of the VCI, and determines that the script includes malware. The AMS notifies the VCI that the script includes malware, whereby the VCI is configured to prevent execution of the script or take other mitigating action. The AMS provides scanning for fileless malware to VCIs on a host device without consuming or otherwise affecting resources of the VCIs.

Patent Agency Ranking