公开(公告)号：US20080189530A1

公开(公告)日：2008-08-07

申请号：US11672288

申请日：2007-02-07

申请人： Suzanne McIntosh ,  Daniel Brand ,  Matthew Kaplan ,  Paul A. Karger ,  Michael G. McIntosh ,  Elaine R. Palmer ,  Amitkumar M. Paradkar ,  David Toll ,  Samuel M. Weber

发明人： Suzanne McIntosh ,  Daniel Brand ,  Matthew Kaplan ,  Paul A. Karger ,  Michael G. McIntosh ,  Elaine R. Palmer ,  Amitkumar M. Paradkar ,  David Toll ,  Samuel M. Weber

IPC分类号： G06F9/30

CPC分类号： G06F11/28 ,  G06F21/563

摘要： A method for malware detection, wherein the method includes: utilizing a hardware based program flow monitor (PFM) for embedded software that employs a static analysis of program code; marrying the program code to addresses, while considering which central processing unit (CPU) is executing the program code; capturing an expected control flow of the program code, and storing the control flow as physical address pairs of leaders and followers (LEAD-FOLL pair) in a Metadata Store (MDS) within the PFM; monitoring control flow at runtime by the PFM; and comparing runtime control flow with the expected control flow

摘要翻译： 一种用于恶意软件检测的方法，其中所述方法包括：利用基于硬件的程序流监视器（PFM）用于采用程序代码的静态分析的嵌入式软件; 将程序代码结合到地址，同时考虑哪个中央处理单元（CPU）正在执行程序代码; 捕获所述程序代码的预期控制流程，以及将所述控制流作为所述PFM中的元数据存储（MDS）中的领导者和跟随者的物理地址对（LEAD-FOLL对）存储; 通过PFM监控运行时的控制流程; 并将运行时控制流与预期控制流进行比较

公开(公告)号：US07861305B2

公开(公告)日：2010-12-28

申请号：US11672288

申请日：2007-02-07

申请人： Suzanne McIntosh ,  Daniel Brand ,  Matthew Kaplan ,  Paul A. Karger ,  Michael G. McIntosh ,  Elaine R. Palmer ,  Amitkumar M. Paradkar ,  David Toll ,  Samuel M. Weber

发明人： Suzanne McIntosh ,  Daniel Brand ,  Matthew Kaplan ,  Paul A. Karger ,  Michael G. McIntosh ,  Elaine R. Palmer ,  Amitkumar M. Paradkar ,  David Toll ,  Samuel M. Weber

IPC分类号： G06F12/14

CPC分类号： G06F11/28 ,  G06F21/563

摘要： A method for malware detection, wherein the method includes: utilizing a hardware based program flow monitor (PFM) for embedded software that employs a static analysis of program code; marrying the program code to addresses, while considering which central processing unit (CPU) is executing the program code; capturing an expected control flow of the program code, and storing the control flow as physical address pairs of leaders and followers (LEAD-FOLL pair) in a Metadata Store (MDS) within the PFM; monitoring control flow at runtime by the PFM; and comparing runtime control flow with the expected control flow.

摘要翻译： 一种用于恶意软件检测的方法，其中所述方法包括：利用基于硬件的程序流监视器（PFM）用于采用程序代码的静态分析的嵌入式软件; 将程序代码结合到地址，同时考虑哪个中央处理单元（CPU）正在执行程序代码; 捕获所述程序代码的预期控制流程，以及将所述控制流作为所述PFM中的元数据存储（MDS）中的领导者和跟随者的物理地址对（LEAD-FOLL对）存储; 通过PFM监控运行时的控制流程; 并将运行时控制流与预期控制流进行比较。

公开(公告)号：US4862376A

公开(公告)日：1989-08-29

申请号：US113837

申请日：1987-10-28

申请人： Kate M. Ferriter ,  Elaine R. Palmer

发明人： Kate M. Ferriter ,  Elaine R. Palmer

IPC分类号： G06F17/50 ,  G06T17/00

CPC分类号： G06F17/50 ,  G06Q10/0875 ,  G06T17/00

摘要： A method for interfacing between a product planning conceptual design tool and a CAD/CAM environment allows an indented bill of materials to be imported to the CAD/CAM environment while retaining the characteristics as a primitive text file. The conceptual design tool uses a sketch sheet approach on a computer display to enter the functional design of a new or modified product, thereby encouraging the designer to use a top down approach to the design process. The user keys in item information, and the system automatically draws a hierarchical tree structure on the computer display. The system then automatically generates an indented bill of materials which is stored in a graphics standard file that retains the character of text primitives. From this file an image of the bill of materials can be displayed in the CAD/CAM environment. The designer can use this image as an aid in the design process. Item names and numbers can be copied from the displayed bill of materials to the CAD/CAM image. The bill of materials can also be edited in the CAD/CAM environment and the edited bill of materials can then be reconstructed in the conceptual design tool for use in the continuing design and planning process.