REPUTATION CHECKING OF EXECUTABLE PROGRAMS
    1.
    发明申请
    REPUTATION CHECKING OF EXECUTABLE PROGRAMS 有权
    声明检查可执行程序

    公开(公告)号:US20120192275A1

    公开(公告)日:2012-07-26

    申请号:US13010189

    申请日:2011-01-20

    IPC分类号: G06F21/22

    CPC分类号: G06F21/51

    摘要: The reputation of an executable computer program is checked when a user input to a computing device initiates a program launch, thus triggering a check of a local cache of reputation information. If the local cache confirms that the program is safe, it is permitted to launch, typically without notifying the user that a reputation check has been made. If the local cache cannot confirm the safety of the program, a reputation check is made by accessing a reputation service in the cloud. If the reputation service identifies the program as safe, it returns an indication to the computing device and the program is permitted to be launched, again without notifying the user that a reputation check has been made. If the reputation service identifies the program as unsafe or potentially unsafe, or does not recognize it at all, a warning is displayed to the user.

    摘要翻译: 当输入到计算设备的用户启动程序启动时,检查可执行计算机程序的声誉,从而触发对本地缓存信誉信息的检查。 如果本地缓存确认程序是安全的,则允许启动,通常不通知用户进行了声誉检查。 如果本地缓存无法确认程序的安全性,则通过访问云中的声誉服务进行声誉检查。 如果信誉服务将该程序识别为安全的,则将该指示返回给计算设备,并且允许程序被启动,而不通知用户进行了信誉检查。 如果声誉服务将程序识别为不安全或可能不安全,或者根本不识别该程序,则向用户显示警告。

    Identifying application reputation based on resource accesses
    3.
    发明授权
    Identifying application reputation based on resource accesses 有权
    基于资源访问识别应用程序信誉

    公开(公告)号:US09065826B2

    公开(公告)日:2015-06-23

    申请号:US13205136

    申请日:2011-08-08

    摘要: Malware detection is often based on monitoring a local application binary and/or process, such as detecting patterns of malicious code, unusual local resource utilization, or suspicious application behavior. However, the volume of available software, variety of malware, and sophistication of evasion techniques may reduce the effectiveness of detection based on monitoring local resources. Presented herein are techniques for identifying malware based on the reputations of remote resources (e.g., web content, files, databases, IP addresses, services, and users) accessed by an application. Remote resource accesses may be reported to a reputation service, which may identify reputations of remote resources, and application reputations of applications that utilize such remote resources. These application reputations may be used to adjust the application policies of the applications executed by devices and servers. These techniques thereby achieve rapid detection and mitigation of newly identified malware through application telemetry in a predominantly automated manner.

    摘要翻译: 恶意软件检测通常基于监视本地应用程序二进制和/或进程,例如检测恶意代码的模式,异常的本地资源利用率或可疑应用程序行为。 然而,可用软件的数量,各种恶意软件和复杂的逃避技术可能会降低基于监视本地资源的检测的有效性。 这里提出的是基于由应用访问的远程资源(例如,web内容,文件,数据库,IP地址,服务和用户)的声誉来识别恶意软件的技术。 远程资源访问可以被报告给信誉服务,信誉服务可以识别远程资源的信誉,以及利用这种远程资源的应用程序的应用程序信誉。 这些应用程序信誉可以用于调整由设备和服务器执行的应用程序的应用程序策略。 这些技术从而通过主要以自动化的方式通过应用遥测来实现对新识别的恶意软件的快速检测和缓解。

    INTERNET INFRASTRUCTURE REPUTATION
    4.
    发明申请
    INTERNET INFRASTRUCTURE REPUTATION 审中-公开
    互联网基础设施信誉

    公开(公告)号:US20130036466A1

    公开(公告)日:2013-02-07

    申请号:US13195245

    申请日:2011-08-01

    IPC分类号: G06F21/00 G06F15/173

    摘要: One or more techniques and/or systems are provided for internet connectivity protection. In particular, reputational information assigned to infrastructure components (e.g., IP addresses, name servers, domains, etc.) may be leveraged to determine whether an infrastructure component associated with a user navigating to content of a URL is malicious or safe. For example, infrastructure component data associated with a web browser navigating to a website of a URL may be collected and sent to a reputation server. The reputation server may return reputation information associated with the infrastructure component data (e.g., an IP address may be known as malicious even though the URL may not yet have a reputation). In this way, the user may be provided with notifications, such as warnings, when various unsafe conditions arise, such as interacting with an infrastructure component with a bad reputation, a resolved IP address not matching the URL, etc.

    摘要翻译: 提供一种或多种技术和/或系统用于互联网连接保护。 特别地,可以利用分配给基础设施组件(例如,IP地址,名称服务器,域等)的声誉信息来确定与导航到URL的内容的用户相关联的基础设施组件是否是恶意或安全的。 例如,可以收集与浏览到URL的网站的web浏览器相关联的基础设施组件数据并将其发送到信誉服务器。 信誉服务器可以返回与基础结构组件数据相关联的信誉信息(例如,即使URL可能还没有信誉,IP地址也可能被称为恶意的)。 以这种方式,当出现各种不安全的情况时,例如与不良信誉的基础设施组件交互,不符合URL的已解决的IP地址等,可以向用户提供诸如警告之类的通知。

    IDENTIFYING APPLICATION REPUTATION BASED ON RESOURCE ACCESSES
    5.
    发明申请
    IDENTIFYING APPLICATION REPUTATION BASED ON RESOURCE ACCESSES 有权
    基于资源访问识别应用程序信誉

    公开(公告)号:US20130042294A1

    公开(公告)日:2013-02-14

    申请号:US13205136

    申请日:2011-08-08

    IPC分类号: G06F21/00 G06F17/00 G06F11/00

    摘要: Malware detection is often based on monitoring a local application binary and/or process, such as detecting patterns of malicious code, unusual local resource utilization, or suspicious application behavior. However, the volume of available software, variety of malware, and sophistication of evasion techniques may reduce the effectiveness of detection based on monitoring local resources. Presented herein are techniques for identifying malware based on the reputations of remote resources (e.g., web content, files, databases, IP addresses, services, and users) accessed by an application. Remote resource accesses may be reported to a reputation service, which may identify reputations of remote resources, and application reputations of applications that utilize such remote resources. These application reputations may be used to adjust the application policies of the applications executed by devices and servers. These techniques thereby achieve rapid detection and mitigation of newly identified malware through application telemetry in a predominantly automated manner.

    摘要翻译: 恶意软件检测通常基于监视本地应用程序二进制和/或进程,例如检测恶意代码的模式,异常的本地资源利用率或可疑应用程序行为。 然而,可用软件的数量,各种恶意软件和复杂的逃避技术可能会降低基于监视本地资源的检测的有效性。 这里提出的是基于由应用访问的远程资源(例如,web内容,文件,数据库,IP地址,服务和用户)的声誉来识别恶意软件的技术。 远程资源访问可以被报告给信誉服务,信誉服务可以识别远程资源的信誉,以及利用这种远程资源的应用程序的应用程序信誉。 这些应用程序信誉可以用于调整由设备和服务器执行的应用程序的应用程序策略。 这些技术从而通过主要以自动化的方式通过应用遥测来实现对新识别的恶意软件的快速检测和缓解。

    Methods and systems for providing proprietary access to a server
    6.
    发明申请
    Methods and systems for providing proprietary access to a server 有权
    用于提供对服务器的专有访问的方法和系统

    公开(公告)号:US20070101003A1

    公开(公告)日:2007-05-03

    申请号:US11260613

    申请日:2005-10-27

    IPC分类号: G06F15/16

    摘要: Systems and methods are disclosed for providing proprietary access to a server. The disclosed systems and methods may include receiving a first service request from a client. The first service request may include a client identifier. Furthermore, the disclosed systems and methods may include creating a session identifier when it is determined that the client identifier is valid and transmitting the session identifier to the client. Moreover, the disclosed systems and methods may include receiving a second service request from the client. The second service request may include the session identifier and client data that may have at least one of a proprietary format and a proprietary scheme. In addition, the disclosed systems and methods may include servicing the second service request when it is determined that the session identifier received in the second service request is valid.

    摘要翻译: 公开了用于提供对服务器的专有访问的系统和方法。 所公开的系统和方法可以包括从客户端接收第一服务请求。 第一服务请求可以包括客户端标识符。 此外,所公开的系统和方法可以包括当确定客户端标识符有效并且将会话标识符发送给客户端时创建会话标识符。 此外,所公开的系统和方法可以包括从客户端接收第二服务请求。 第二服务请求可以包括可以具有专有格式和专有方案中的至少一个的会话标识符和客户端数据。 此外,所公开的系统和方法可以包括当确定在第二服务请求中接收到的会话标识是有效的时对第二服务请求进行服务。

    Server-side eventing for managed server applications
    7.
    发明申请
    Server-side eventing for managed server applications 审中-公开
    受管服务器应用程序的服务器端事件

    公开(公告)号:US20060136933A1

    公开(公告)日:2006-06-22

    申请号:US11015062

    申请日:2004-12-17

    IPC分类号: G06F9/46

    CPC分类号: G06F9/542

    摘要: The present invention relates to a system for generating events for a server application executing in a first process on a server computer. The system includes a server event service on the server computer executing in a second process independent of the first process. The server event service has a plurality of event handlers each event handler associated with a specified server event. The server event service is capable of receiving a server event from the server application and identifying one or more event handlers associated with the server event. The server event service then passes information related to the server event to the identified event handlers. The event handlers, in response to receiving the information related to an associated server event, generates one or more output events for the server application. In the system, the server event is generated by the server application in response to a request received from a client application on a remote client computer.

    摘要翻译: 本发明涉及一种用于为在服务器计算机上的第一进程中执行的服务器应用程序生成事件的系统。 该系统包括在独立于第一进程的第二进程中执行的服务器计算机上的服务器事件服务。 服务器事件服务具有多个事件处理程序,每个事件处理程序与指定的服务器事件相关联。 服务器事件服务能够从服务器应用程序接收服务器事件,并识别与服务器事件相关联的一个或多个事件处理程序。 然后,服务器事件服务将与服务器事件相关的信息传递给标识的事件处理程序。 事件处理程序响应于接收到与关联的服务器事件相关的信息,为服务器应用程序生成一个或多个输出事件。 在系统中,响应于从远程客户端计算机上的客户端应用程序接收的请求,服务器应用程序生成服务器事件。

    System and method for integrating workflow processes with a project management system
    8.
    发明申请
    System and method for integrating workflow processes with a project management system 审中-公开
    将工作流程与项目管理系统集成的系统和方法

    公开(公告)号:US20060241997A1

    公开(公告)日:2006-10-26

    申请号:US11111590

    申请日:2005-04-20

    IPC分类号: G06F9/46

    摘要: A project management system is integrated with a workflow engine to provide automatic coordination of project tasks and workflow processes. The workflow engine provides support for defining logical expressions that determine a path of execution for the defined workflow tasks. In addition to composition capabilities, the workflow engine may execute and track the defined processes. The project management system provides a platform for defining the project plan that includes tasks and resources. Tasks are annotated defining their behavior and implementation and exported to the workflow system. The workflow system substitutes project tasks with the appropriate workflow activities and provides feedback upon execution of the activities.

    摘要翻译: 项目管理系统与工作流引擎集成,可以自动协调项目任务和工作流程。 工作流引擎支持定义确定定义的工作流任务的执行路径的逻辑表达式。 除了组合能力之外,工作流引擎可以执行和跟踪定义的进程。 项目管理系统为定义包含任务和资源的项目计划提供了一个平台。 任务注释定义其行为和实现,并导出到工作流系统。 工作流程系统将项目任务与适当的工作流活动代替,并在执行活动时提供反馈意见。

    Translating a relational query to a multidimensional query
    9.
    发明授权
    Translating a relational query to a multidimensional query 有权
    将关系查询转换为多维查询

    公开(公告)号:US08606803B2

    公开(公告)日:2013-12-10

    申请号:US12060279

    申请日:2008-04-01

    IPC分类号: G06F17/30 H04L12/58

    摘要: Data stored in relational databases can be retrieved using a relational database query language, while data stored in a multidimensional database is typically retrieved using a multidimensional database query language. However, most users do not have a functional working knowledge of multidimensional database query languages, which leaves large amounts of data inaccessible. Further, while some relational database query languages may be translated into a multidimensional database language, the information generated by such translations is often unusable, or returns large numbers of errors. In order to obtain effective translation of a relational database query language to a multidimensional database query language effective translation and filtering needs to occur. Using effective mapping and retrieval of database metadata along with effective, customizable business logic filtering of query components, more effective and reliable results may be achieved.

    摘要翻译: 可以使用关系数据库查询语言来检索存储在关系数据库中的数据,而通常使用多维数据库查询语言检索存储在多维数据库中的数据。 然而,大多数用户没有多维数据库查询语言的功能工作知识,这使得大量数据无法访问。 此外,虽然一些关系数据库查询语言可以被翻译成多维数据库语言,但是由这种翻译生成的信息通常是不可用的或者返回大量的错误。 为了获得关系数据库查询语言到多维数据库查询语言的有效翻译,需要有效的翻译和过滤。 利用数据库元数据的有效映射和检索以及有效的可定制的查询组件的业务逻辑过滤,可以实现更有效和可靠的结果。

    DATABASE QUERYING
    10.
    发明申请
    DATABASE QUERYING 有权
    数据库查询

    公开(公告)号:US20090249125A1

    公开(公告)日:2009-10-01

    申请号:US12060279

    申请日:2008-04-01

    IPC分类号: G06F7/06 G06F17/30 G06F11/07

    摘要: Data stored in relational databases can be retrieved using a relational database query language, while data stored in a multidimensional database is typically retrieved using a multidimensional database query language. However, most users do not have a functional working knowledge of multidimensional database query languages, which leaves large amounts of data inaccessible. Further, while some relational database query languages may be translated into a multidimensional database language, the information generated by such translations is often unusable, or returns large numbers of errors. In order to obtain effective translation of a relational database query language to a multidimensional database query language effective translation and filtering needs to occur. Using effective mapping and retrieval of database metadata along with effective, customizable business logic filtering of query components, more effective and reliable results may be achieved.

    摘要翻译: 可以使用关系数据库查询语言来检索存储在关系数据库中的数据,而通常使用多维数据库查询语言检索存储在多维数据库中的数据。 然而,大多数用户没有多维数据库查询语言的功能工作知识,这使得大量的数据无法访问。 此外,虽然一些关系数据库查询语言可以被翻译成多维数据库语言,但是由这种翻译生成的信息通常是不可用的或者返回大量的错误。 为了获得关系数据库查询语言到多维数据库查询语言的有效翻译,需要有效的翻译和过滤。 利用数据库元数据的有效映射和检索以及有效的可定制的查询组件的业务逻辑过滤,可以实现更有效和可靠的结果。