HK1246905A1 - 使用解釋器虛擬機的行為惡意軟件檢測 - Google Patents

使用解釋器虛擬機的行為惡意軟件檢測

Info

Publication number
HK1246905A1
HK1246905A1 HK18106493.9A HK18106493A HK1246905A1 HK 1246905 A1 HK1246905 A1 HK 1246905A1 HK 18106493 A HK18106493 A HK 18106493A HK 1246905 A1 HK1246905 A1 HK 1246905A1
Authority
HK
Hong Kong
Prior art keywords
virtual machine
malware detection
interpreter
behavioral malware
behavioral
Prior art date
Application number
HK18106493.9A
Other languages
English (en)
Inventor
格奧爾基-弗洛林‧哈伊瑪山
山多爾‧盧卡奇
博通德‧富洛普
Original Assignee
比特梵德知識產權管理有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 比特梵德知識產權管理有限公司 filed Critical 比特梵德知識產權管理有限公司
Publication of HK1246905A1 publication Critical patent/HK1246905A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45591—Monitoring or debugging support
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Debugging And Monitoring (AREA)
  • Devices For Executing Special Programs (AREA)
  • Storage Device Security (AREA)
HK18106493.9A 2015-06-12 2018-05-18 使用解釋器虛擬機的行為惡意軟件檢測 HK1246905A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US14/738,548 US9460284B1 (en) 2015-06-12 2015-06-12 Behavioral malware detection using an interpreter virtual machine
PCT/EP2016/062882 WO2016198392A1 (en) 2015-06-12 2016-06-07 Behavioral malware detection using an interpreter virtual machine

Publications (1)

Publication Number Publication Date
HK1246905A1 true HK1246905A1 (zh) 2018-09-14

Family

ID=56137286

Family Applications (1)

Application Number Title Priority Date Filing Date
HK18106493.9A HK1246905A1 (zh) 2015-06-12 2018-05-18 使用解釋器虛擬機的行為惡意軟件檢測

Country Status (12)

Country Link
US (1) US9460284B1 (zh)
EP (1) EP3308315B1 (zh)
JP (1) JP6706273B2 (zh)
KR (1) KR102206115B1 (zh)
CN (1) CN107690645B (zh)
AU (1) AU2016274532B2 (zh)
CA (1) CA2986321C (zh)
ES (1) ES2857102T3 (zh)
HK (1) HK1246905A1 (zh)
IL (1) IL255802B (zh)
RU (1) RU2679175C1 (zh)
WO (1) WO2016198392A1 (zh)

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015200510A1 (en) * 2014-06-24 2015-12-30 Virsec Systems, Inc. Automated code lockdown to reduce attach surface for software
US10614210B2 (en) * 2015-07-31 2020-04-07 Digital Guardian, Inc. Systems and methods of protecting data from injected malware
US10929537B2 (en) * 2015-07-31 2021-02-23 Digital Guardian, Inc. Systems and methods of protecting data from malware processes
US11170104B1 (en) * 2015-08-21 2021-11-09 Amazon Technologies, Inc. Identifying attacks on file systems
US10033747B1 (en) * 2015-09-29 2018-07-24 Fireeye, Inc. System and method for detecting interpreter-based exploit attacks
US20210026950A1 (en) * 2016-03-07 2021-01-28 Crowdstrike, Inc. Hypervisor-based redirection of system calls and interrupt-based task offloading
US9734337B1 (en) * 2017-01-24 2017-08-15 Malwarebytes Inc. Behavior-based ransomware detection
US11223649B2 (en) 2018-05-06 2022-01-11 Nec Corporation User-added-value-based ransomware detection and prevention
EP3818680A1 (en) * 2018-07-18 2021-05-12 Bitdefender IPR Management Ltd. Systems and methods for reporting computer security incidents
US10846088B2 (en) * 2018-08-21 2020-11-24 Arm Limited Control of instruction execution in a data processor
US10452868B1 (en) 2019-02-04 2019-10-22 S2 Systems Corporation Web browser remoting using network vector rendering
US11880422B2 (en) 2019-02-04 2024-01-23 Cloudflare, Inc. Theft prevention for sensitive information
US11080394B2 (en) * 2019-03-27 2021-08-03 Webroot Inc. Behavioral threat detection virtual machine
US11314863B2 (en) 2019-03-27 2022-04-26 Webroot, Inc. Behavioral threat detection definition and compilation
US11080391B2 (en) 2019-03-27 2021-08-03 Webroot Inc. Behavioral threat detection definition and compilation
US11481486B2 (en) * 2019-03-27 2022-10-25 Webroot Inc. Behavioral threat detection engine
RU2711041C1 (ru) * 2019-05-14 2020-01-14 федеральное государственное казенное военное образовательное учреждение высшего образования "Краснодарское высшее военное училище имени генерала армии С.М. Штеменко" Министерства обороны Российской Федерации Способ анализа программного обеспечения на отсутствие недекларированных функциональных возможностей
CN111061538A (zh) * 2019-11-14 2020-04-24 珠海金山网络游戏科技有限公司 一种多Lua虚拟机内存优化方法及其系统
WO2024034841A1 (ko) * 2022-08-12 2024-02-15 삼성전자주식회사 지정된 이벤트에 기반하여 파일을 컴파일하기 위한 전자 장치 및 그 방법

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1997027536A1 (en) * 1996-01-24 1997-07-31 Sun Microsystems, Inc. Instruction folding for a stack-based machine
US6295643B1 (en) * 1998-12-10 2001-09-25 International Business Machines Corporation Method and apparatus for improving java virtual machine performance using persistent execution information
WO2004075060A1 (ja) * 2003-02-21 2004-09-02 Tabei, Hikaru コンピュータウィルス検出装置
KR100483700B1 (ko) * 2003-12-03 2005-04-19 주식회사 잉카인터넷 온라인 게임 클라이언트 보안을 위한 실시간 프로세스 불법 접근 및 조작 차단 방법
GB0525902D0 (en) * 2005-12-20 2006-02-01 Nokia Corp Signal message decompressor
US7949848B2 (en) * 2007-03-08 2011-05-24 Arm Limited Data processing apparatus, method and computer program product for reducing memory usage of an object oriented program
CN101373502B (zh) * 2008-05-12 2012-06-20 公安部第三研究所 基于Win32平台下病毒行为的自动化分析系统
US8572740B2 (en) * 2009-10-01 2013-10-29 Kaspersky Lab, Zao Method and system for detection of previously unknown malware
US8566943B2 (en) * 2009-10-01 2013-10-22 Kaspersky Lab, Zao Asynchronous processing of events for malware detection
KR20130018642A (ko) * 2009-11-13 2013-02-25 어데토 캐나다 코포레이션 적대적 실행 환경 내에서 정적 및 동적 공격들에 대하여 자바 바이트코드 코드를 보호하는 시스템 및 방법
RU2430411C1 (ru) * 2010-03-02 2011-09-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ обнаружения вредоносного программного обеспечения
US9032526B2 (en) * 2011-05-12 2015-05-12 Microsoft Technology Licensing, Llc Emulating mixed-code programs using a virtual machine instance
US9298910B2 (en) * 2011-06-08 2016-03-29 Mcafee, Inc. System and method for virtual partition monitoring
US20130152200A1 (en) * 2011-12-09 2013-06-13 Christoph Alme Predictive Heap Overflow Protection
US8918881B2 (en) * 2012-02-24 2014-12-23 Appthority, Inc. Off-device anti-malware protection for mobile devices
US8881291B2 (en) * 2012-09-25 2014-11-04 Oracle International Corporation System and method for inhibiting the processing of new code modules by an outdated runtime environment
RU2536664C2 (ru) * 2012-12-25 2014-12-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ автоматической модификации антивирусной базы данных
US10114948B2 (en) 2013-03-15 2018-10-30 Mcafee, Llc Hypervisor-based buffer overflow detection and prevention
RU2531861C1 (ru) * 2013-04-26 2014-10-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ оценки вредоносности кода, исполняемого в адресном пространстве доверенного процесса
RU2653985C2 (ru) 2013-06-28 2018-05-15 Закрытое акционерное общество "Лаборатория Касперского" Способ и система обнаружения вредоносного программного обеспечения путем контроля исполнения программного обеспечения запущенного по сценарию

Also Published As

Publication number Publication date
AU2016274532B2 (en) 2020-08-20
RU2679175C1 (ru) 2019-02-06
EP3308315A1 (en) 2018-04-18
JP2018517985A (ja) 2018-07-05
KR20180018531A (ko) 2018-02-21
CA2986321C (en) 2021-09-28
IL255802B (en) 2021-01-31
WO2016198392A1 (en) 2016-12-15
AU2016274532A1 (en) 2017-12-07
KR102206115B1 (ko) 2021-01-22
JP6706273B2 (ja) 2020-06-03
CA2986321A1 (en) 2016-12-15
EP3308315B1 (en) 2020-12-09
US9460284B1 (en) 2016-10-04
IL255802A (en) 2018-01-31
ES2857102T3 (es) 2021-09-28
CN107690645A (zh) 2018-02-13
CN107690645B (zh) 2021-07-16

Similar Documents

Publication Publication Date Title
HK1246905A1 (zh) 使用解釋器虛擬機的行為惡意軟件檢測
GB201602099D0 (en) Securityevent detection through virtual machine introspection
GB2557253B (en) Machine learning based malware detection system
GB2545838B (en) Hypervisor and virtual machine protection
GB2517069B (en) Autostereoscopic virtual reality platform
GB2524269B (en) Virtual reality
GB201405706D0 (en) Software protection
HK1251315B (zh) 虛擬機系統
EP3314424A4 (en) MIGRATION TECHNIQUES OF VIRTUAL MACHINES
EP3198800A4 (en) Behavioral detection of malware agents
GB2556774B (en) Virtual reductant level sensor
EP3188008A4 (en) Virtual machine migration method and device
EP3333301A4 (en) DEVICE FOR TREATING CLOTHES
GB201418499D0 (en) Malware detection method
AU2016336575B2 (en) Laundry processing device
GB201506807D0 (en) An emulsion
EP3380142C0 (en) AN AUTOINJECTOR DEVICE
GB2543813B (en) Improved malware detection
GB201503144D0 (en) Virtual barrier
GB201503831D0 (en) Virtual trying on experience
SG10201406350UA (en) An event detection method
GB2546366B (en) Software protection
GB201508023D0 (en) Virtual imagery
GB201712461D0 (en) Malicious host detection
GB201522887D0 (en) Detecting malicious software