利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

370 条记录 (耗时 0.031 秒)

    METHODS AND APPARATUS FOR IDENTIFYING AN IMPACT OF A PORTION OF A FILE ON MACHINE LEARNING CLASSIFICATION OF MALICIOUS CONTENT
    1.
    发明申请
    METHODS AND APPARATUS FOR IDENTIFYING AN IMPACT OF A PORTION OF A FILE ON MACHINE LEARNING CLASSIFICATION OF MALICIOUS CONTENT 审中-公开

    公开(公告)号：WO2019150079A1

    公开(公告)日：2019-08-08

    申请号：PCT/GB2019/050199

    申请日：2019-01-23

    申请人： SOPHOS LIMITED

    发明人： HARANG, Richard ,  SAXE, Joshua Daniel

    IPC分类号： G06F21/56 ,  G06N20/00

    CPC分类号： G06N20/00 ,  G06F16/80 ,  G06F21/56 ,  G06F2221/033 ,  G06F2221/034

    摘要： In other embodiments, a non-transitory processor-readable medium stores code representing instructions to be executed by a processor. The code includes code to cause the processor to receive a structured file for which a machine learning model has made a malicious content classification. The code further includes code to remove a portion of the structured file to define a modified structured file that follows a format associated with a type of the structured file. The code further includes code to extract a set of features from the modified structured file. The code further includes code to provide the set of features as an input to the machine learning model to produce an output. The code further includes code to identify an impact of the portion of the structured file on the malicious content classification of the structured file based on the output.

    验证上层应用身份的方法、自助终端及应用服务器
    2.
    发明申请
    验证上层应用身份的方法、自助终端及应用服务器 审中-公开

    公开(公告)号：WO2018129658A1

    公开(公告)日：2018-07-19

    申请号：PCT/CN2017/070763

    申请日：2017-01-10

    申请人： 深圳怡化电脑股份有限公司

    发明人： 谢卫平 ,  贺光容 ,  沈俊 ,  谢兴锋 ,  郑明都 ,  王庆华 ,  胡小敏

    IPC分类号： G06F21/51

    CPC分类号： G06F21/44 ,  G06F21/51 ,  G06F2221/033 ,  G07F19/206

    摘要： 一种验证上层应用身份的方法、自助终端及应用授权服务器，涉及自助终端技术领域。其中方法包括：若检测到SP驱动库被加载或者出钞指令接口被调用，则获取加载所述SP驱动库或者调用所述出钞指令接口的应用程序的可执行文件信息；根据所述可执行文件信息和预先存储的被授权的可执行文件规则库验证所述应用程序是否为合法应用；若为合法应用，则允许所述应用程序继续执行业务处理流程；或者，若为非法应用，则中止所述应用程序当前执行的业务处理流程，该方法可以提高自助终端的安全性，避免不法分子伪造ATMC软件来实现对SP和机芯硬件设备的控制导致的资金损失问题。

    NEURAL ATTENTION MECHANISMS FOR MALWARE ANALYSIS
    3.
    发明申请
    NEURAL ATTENTION MECHANISMS FOR MALWARE ANALYSIS 审中-公开
    用于恶意软件分析的神经注意机制

    公开(公告)号：WO2018017953A1

    公开(公告)日：2018-01-25

    申请号：PCT/US2017/043285

    申请日：2017-07-21

    申请人： CYLANCE INC.

    发明人： DAVIS, Andrew ,  WOLFF, Matthew ,  WOJNOWICZ, Michael ,  SOEDER, Derek, A. ,  ZHAO, Xuan

    IPC分类号： G06N3/08 ,  G06F21/56 ,  G06N3/04 ,  G06N7/00 ,  H04L29/06

    CPC分类号： G06F21/562 ,  G06F2221/033 ,  G06N3/0445 ,  G06N3/0454 ,  G06N3/08 ,  G06N3/084 ,  G06N7/005 ,  H04L63/1408 ,  H04L63/1416 ,  H04L63/1425

    摘要： As part of an analysis of the likelihood that a given input (e.g. a file, etc.) includes malicious code, a convolutional neural network can be used to review a sequence of chunks into which an input is divided to assess how best to navigate through the input and to classify parts of the input in a most optimal manner. At least some of the sequence of chunks can be further examined using a recurrent neural network in series with the convolutional neural network to determine how to progress through the sequence of chunks. A state of the at least some of the chunks examined using the recurrent neural network summarized to form an output indicative of the likelihood that the input includes malicious code. Methods, systems, and articles of manufacture are also described.

    摘要翻译： 作为对给定输入（例如文件等）包括恶意代码的可能性的分析的一部分，可以使用卷积神经网络来查看输入是其中的块的序列 划分以评估如何最好地浏览输入并以最优方式分类输入的部分。 使用与卷积神经网络串联的递归神经网络可以进一步检查至少一些组块序列，以确定如何在组块序列中前进。 使用回归神经网络检查的至少一些组块的状态被汇总以形成指示输入包括恶意代码的可能性的输出。 还描述了方法，系统和制造物品。

    주 기억 장치 내부의 코드 수정을 통한 애플리케이션 코드 은닉 장치 및 이를 이용한 애플리케이션 코드 은닉 방법
    4.
    发明申请
    주 기억 장치 내부의 코드 수정을 통한 애플리케이션 코드 은닉 장치 및 이를 이용한 애플리케이션 코드 은닉 방법 审中-公开
    应用代码隐藏装置通过主存储装置中的代码修改以及使用它的应用代码隐藏方法

    公开(公告)号：WO2018012693A1

    公开(公告)日：2018-01-18

    申请号：PCT/KR2017/000059

    申请日：2017-01-03

    申请人： (주)케이사인 ,  숭실대학교 산학협력단

    发明人： 이정현 ,  박태용 ,  박용진 ,  박성은

    IPC分类号： G06F21/12 ,  G06F9/45 ,  G06F9/44

    CPC分类号： G06F21/14 ,  G06F8/30 ,  G06F8/441 ,  G06F8/53 ,  G06F8/74 ,  G06F12/1408 ,  G06F21/78 ,  G06F2212/1052 ,  G06F2221/031 ,  G06F2221/033 ,  H04L9/3226 ,  H04L9/3242

    摘要： 애플리케이션 코드 은닉 장치는 애플리케이션 코드를 중요코드 및 중요코드 이외의 일반코드로 분리하는 중요코드 분리부, 중요코드를 호출하기 위한 중요코드 호출기를 생성하는 중요코드 호출기 생성부, 중요코드를 분석하는 코드 분석부, 중요코드에 대응하는 더미코드를 생성하는 더미코드 생성부, 중요코드를 암호화하는 코드 암호화부, 더미코드 및 암호화된 중요코드를 배치시키고, 더미코드 및 암호화된 중요코드의 위치 정보를 생성하는 코드 배치부, 암호화된 중요코드를 복호화하기 위한 코드 복호화기를 생성하는 코드 복호화기 생성부, 더미코드 및 암호화된 중요코드의 위치 정보를 이용하여 더미코드 및 암호화된 중요코드를 전달하는 배치된 코드 임포터를 생성하는 배치된 코드 임포터 생성부, 더미코드를 메모리에 적재하는 코드 적재기를 생성하는 코드 적재기 생성부, 메모리에 적재된 더미코드를 복호화된 중요코드로 대체하는 메모리 내부 코드 수정기를 생성하는 메모리 내부 코드 수정기 생성부 및 메모리에 대체된 복호화된 중요코드를 호출하기 위한 복호화된 코드 호출기를 생성하는 복호화된 코드 호출기 생성부를 포함한다.

    摘要翻译： 应用代码隐藏装置包括用于将应用代码分离为除重要代码和重要代码之外的通用代码的重要代码分离器，重要代码寻呼机生成单元 虚拟代码生成单元，用于生成与重要代码对应的虚拟代码;代码加密单元，用于加密重要代码;虚拟代码和加密的重要代码;虚拟代码和加密的代码 用于产生的关键码的位置信息，产生一组代码，用于通过使用伪代码和加密的关键码哑代码和加密的重要的位置信息解码该加密关键码解码器生成单元，解码代码配置单元 部署代码导入器生成单元，用于生成用于传递代码的部署代码导入器;虚拟代码加载单元，用于将虚拟代码加载到存储器中 存储器内代码修改器生成单元，用于生成存储器代码修改器，该存储器代码修改器用解码的重要代码替换加载在存储器中的虚拟代码和存储器中的解码的重要代码 以及一个解码码寻呼机产生器，用于产生一个解码码寻呼机，用于执行下列步骤：

    SYSTEMS AND METHODS FOR FLAW ATTRIBUTION AND CORRELATION
    5.
    发明申请
    SYSTEMS AND METHODS FOR FLAW ATTRIBUTION AND CORRELATION 审中-公开
    用于缺陷归因和相关性的系统和方法

    公开(公告)号：WO2017214364A1

    公开(公告)日：2017-12-14

    申请号：PCT/US2017/036502

    申请日：2017-06-08

    申请人： VERACODE, INC.

    发明人： SMITH, Bradford, Matthew

    IPC分类号： G06F11/36 ,  G06Q10/06 ,  G06F9/44

    CPC分类号： G06F21/577 ,  G06F8/75 ,  G06F11/3604 ,  G06F21/51 ,  G06F21/52 ,  G06F2221/033 ,  G06Q10/06398

    摘要： In a system for attributing one or more vulnerabilities in a software application to one or more developers, information identifying the source of a vulnerability is obtained from a vulnerability report. From a repository, developer-related information associated with the identified source is obtained. One or more developers are selected from the developer-related information according to one or more specified rules, and the defect is attributed to the selected developer(s). Attribution of the defect may indicate that the developer(s) contributed to introduction of the defect or to remedying the defect.

    摘要翻译： 在用于将软件应用程序中的一个或多个漏洞归因于一个或多个开发者的系统中，从漏洞报告中获得标识漏洞来源的信息。 从存储库中获得与所标识的源相关联的与开发者相关的信息。 根据一个或多个指定规则从开发者相关信息中选择一个或多个开发者，并将缺陷归因于所选择的开发者。 对缺陷的归因可能表明开发者有助于引入缺陷或纠正缺陷。

    AUTOMATED CLASSIFICATION OF EXPLOITS BASED ON RUNTIME ENVIRONMENTAL FEATURES
    6.
    发明申请
    AUTOMATED CLASSIFICATION OF EXPLOITS BASED ON RUNTIME ENVIRONMENTAL FEATURES 审中-公开
    基于运行环境特征的开源自动分类

    公开(公告)号：WO2017137804A1

    公开(公告)日：2017-08-17

    申请号：PCT/IB2016/050712

    申请日：2016-02-11

    申请人： MORPHISEC INFORMATION SECURITY LTD.

    发明人： GURI, Mordechai ,  GORELIK, Michael ,  YEHOSHUA, Ronen

    IPC分类号： G06F21/54 ,  G06F21/55 ,  G06F21/56

    CPC分类号： G06F21/566 ,  G06F21/54 ,  G06F21/554 ,  G06F2221/033

    摘要： Various approaches are described herein for the automated classification of exploit(s) based on snapshots of runtime environmental features of a computing process in which the exploit(s) are attempted. The foregoing is achieved with a server and local station(s). Each local station is configured to neutralize operation of malicious code being executed thereon, obtain snapshot(s) indicating the state thereof at the time of the exploitation attempt, and perform a classification process using the snapshot(s). The snapshot(s) are analyzed with respect to a local classification model maintained by the local station to find a classification of the exploit therein. If a classification is found, an informed decision is made as to how to handle the classified exploit. If a classification is not found, the snapshot(s) are provided to the server for classification thereby. The server provides an updated classification model containing a classification for the exploit to the local station(s).

    摘要翻译： 这里描述了基于其中尝试利用（一个或多个）攻击的计算过程的运行时环境特征的快照的漏洞的自动分类的各种方法。 以上是通过服务器和本地站实现的。 每个本地站被配置为中和正在其上执行的恶意代码的操作，获取指示在利用尝试时的状态的快照，并且使用快照执行分类处理。 根据本地站维护的本地分类模型分析快照以找到其中的漏洞分类。 如果发现分类，就如何处理分类的漏洞利用做出明智的决定。 如果未找到分类，则将快照提供给服务器以进行分类。 服务器向本地站提供包含漏洞分类的更新分类模型。

    SYSTEMS AND METHODS FOR GENERATING POLICIES FOR AN APPLICATION USING A VIRTUALIZED ENVIRONMENT
    8.
    发明申请
    SYSTEMS AND METHODS FOR GENERATING POLICIES FOR AN APPLICATION USING A VIRTUALIZED ENVIRONMENT 审中-公开
    使用虚拟化环境生成应用策略的系统和方法

    公开(公告)号：WO2017062313A1

    公开(公告)日：2017-04-13

    申请号：PCT/US2016/055188

    申请日：2016-10-03

    申请人： DIGITAL GUARDIAN, INC.

    发明人： FOX, John C.

    IPC分类号： G06F21/53

    CPC分类号： G06F21/53 ,  G06F21/566 ,  G06F2221/033 ,  H04L63/1433 ,  H04L63/20

    摘要： Provided herein are systems and methods for generating policies for a new application using a virtualized environment. Prior to allowing a new application to operate on a host system, the new application may be installed in a virtual environment. A first program execution restrictor of the virtualized environment may determine a set of policies for the new application. The set of policies may allow the new application to add specific program elements during installation and execution in the virtualized environment. The first program execution restrictor may verify an absence of malicious behavior from the new application while the new application executes in the virtualized environment. The new application may be executed on the host system responsive to the verification. The host system may have a second program execution restrictor that applies the set of policies when the new application is allowed to execute on the host system.

    摘要翻译： 本文提供的是使用虚拟化环境为新应用程序生成策略的系统和方法。 在允许新应用程序在主机系统上运行之前，新应用程序可能会安装在虚拟环境中。 虚拟化环境的第一程序执行限制器可以确定新应用程序的一组策略。 该策略集可能允许新应用程序在虚拟化环境中的安装和执行期间添加特定的程序元素。 当新应用程序在虚拟化环境中执行时，第一个程序执行限制器可以验证新应用程序中是否存在恶意行为。 响应于验证，可以在主机系统上执行新的应用。 主机系统可以具有第二程序执行限制器，其在允许新应用被允许在主机系统上执行时应用该组策略。

    SYSTEMS AND METHODS FOR MATCHING AND SCORING SAMENESS
    9.
    发明申请
    SYSTEMS AND METHODS FOR MATCHING AND SCORING SAMENESS 审中-公开
    用于匹配和分类SAMENESS的系统和方法

    公开(公告)号：WO2017037544A2

    公开(公告)日：2017-03-09

    申请号：PCT/IB2016/001454

    申请日：2016-09-04

    申请人： NUDATA SECURITY INC. ,  RICHARDSON, Gary, Wayne

    发明人： RICHARDSON, Gary, Wayne ,  BAILEY, Christopher, Everett ,  LUKASHUK, Randy

    IPC分类号： G06F17/00

    CPC分类号： H04L63/1425 ,  G06F7/08 ,  G06F17/3033 ,  G06F17/3053 ,  G06F17/30598 ,  G06F17/30867 ,  G06F21/44 ,  G06F21/552 ,  G06F21/602 ,  G06F2221/033 ,  G06F2221/2101 ,  G06F2221/2137 ,  G06F2221/2145 ,  H04L41/20 ,  H04L43/12 ,  H04L43/16 ,  H04L63/0861 ,  H04L63/1408 ,  H04L63/1416 ,  H04L63/1466 ,  H04L63/20 ,  H04L67/02 ,  H04L67/22 ,  H04L67/30 ,  H04L67/303 ,  H04L2463/144

    摘要： Systems and methods for matching and scoring sameness. In some embodiments, a computer-implemented method is provided, comprising acts of: identifying a plurality of first- degree anchor values from the first digital interaction, wherein the plurality of first-degree anchor values comprise first-degree anchor values X and Y; accessing a profile of the first- degree anchor value X, wherein: the profile of the first-degree anchor value X comprises a plurality of sets of second-degree anchor values; and each set of the plurality of sets of second- degree anchor values corresponds to a respective anchor type and comprises one or more second- degree anchor values of that anchor type; determining how closely the first-degree anchor values X and Y are associated; and generating an association score indicative of how closely the plurality of first-degree anchors are associated, based at least in part on how closely the first- degree anchor values X and Y are associated.

    摘要翻译： 匹配和评分相同的系统和方法。 在一些实施例中，提供了一种计算机实现的方法，包括以下动作：从所述第一数字交互识别多个第一度锚点值，其中所述多个第一度锚点值包括第一度锚点值X和Y; 访问一级锚定值X的轮廓，其中：第一度锚定值X的轮廓包括多组二次锚定值; 并且所述多组第二度锚定值的每组对应于相应的锚定类型，并且包括该锚类型的一个或多个第二度锚点值; 确定第一度锚值X和Y相关联的密切程度; 以及至少部分地基于所述一级锚定值X和Y的关系如何接近来生成指示所述多个第一度锚相关联的关联得分。