公开(公告)号：US12120214B2

公开(公告)日：2024-10-15

申请号：US17977320

申请日：2022-10-31

Applicant: INSTITUTE FOR INFORMATION INDUSTRY

Inventor： Jian-Wei Liao ,  Cheng-En Lee ,  Ting-Yu Lin

IPC: H04L9/00 ,  G06F21/55 ,  G06F21/56 ,  G06F21/57

CPC classification number: H04L9/002 ,  G06F21/556 ,  G06F21/566 ,  G06F21/577

Abstract: The present invention provides an encryption determining method. The method includes the following steps: receiving a side channel signal; generating a filtered side channel signal by filtering noise within the side channel signal; generating a phasor signal by utilizing a filter to covert the filtered side channel signal; locating the encrypted segment by calculating a periodicity of the phasor signal utilizing a standard deviation window; extracting at least one encrypted characteristic from the encrypted segment; and generating an encryption analytic result by recognizing the at least one encrypted characteristic according to a characteristic recognition model; wherein the encryption analytic result includes a position of the encrypted segment within the side channel signal, and an encryption type corresponding to the side channel signal. The present invention is able to automatically and efficiently locate the encryption segment and analyze the encryption type corresponding to the side channel signal.

公开(公告)号：US10318731B2

公开(公告)日：2019-06-11

申请号：US15369769

申请日：2016-12-05

Applicant: INSTITUTE FOR INFORMATION INDUSTRY

Inventor： Jian-Wei Liao ,  Chin-Wei Tien ,  Shun-Chieh Chang

IPC: G06F21/55 ,  H04L12/26 ,  G06F21/56

Abstract: A detection method comprising: (A) transmitting a to-be tested file to a first testing machine by the processing device; wherein the first testing machine uses for executing the to-be tested file; (B) monitoring that whether a component usage of the first testing machine is higher than a default threshold during a period of executing the to-be tested file by the processing device; and (C) when the component usage of the first testing machine is higher than the default threshold, the memory forensics module analyzes the memory space of the first testing machine to determine that whether the to-be tested file comprises a malware program and generate an analyzing result.