JP5736305B2 - ソフトウェア評価を確立し監視するシステムおよびプログラム - Google Patents
ソフトウェア評価を確立し監視するシステムおよびプログラム Download PDFInfo
- Publication number
- JP5736305B2 JP5736305B2 JP2011514694A JP2011514694A JP5736305B2 JP 5736305 B2 JP5736305 B2 JP 5736305B2 JP 2011514694 A JP2011514694 A JP 2011514694A JP 2011514694 A JP2011514694 A JP 2011514694A JP 5736305 B2 JP5736305 B2 JP 5736305B2
- Authority
- JP
- Japan
- Prior art keywords
- module
- behavior
- evaluation
- expected
- computer system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3409—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3452—Performance evaluation by statistical analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/3604—Software analysis for verifying properties of programs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/865—Monitoring of software
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
- Storage Device Security (AREA)
Description
Claims (16)
- ソフトウェア評価確立・監視アプリケーションを内部に記憶した1又は複数のメモリと、
1又は複数の前記メモリに結合される1又は複数のプロセッサと
を備え、前記プロセッサにおいて、前記ソフトウェア評価確立・監視アプリケーションを実行することにより、
第1のコンピュータシステムにおいて実行されるモジュールの挙動を記録するステップであって、前記記録される挙動は前記第1のコンピュータシステムにおける前記モジュールの期待挙動である、記録するステップと、
前記記録された挙動を第2のコンピュータシステムに供給するステップと、
前記第2のコンピュータシステム及び前記記録された挙動を用いて、前記期待挙動に従って挙動する前記モジュールを条件として、前記モジュールの評価を決定するステップと、
前記モジュールの新たな挙動が前記期待挙動から特定量以上に逸脱していれば、前記モジュールの前記新たな挙動が前記期待挙動から逸脱しているものと決定するステップと、
前記新たな挙動が前記期待挙動から前記特定量以上に逸脱していることの決定に応答して保護動作をとるステップと
を含む方法が実行される、システム。 - 前記期待挙動に前記モジュールの前記評価を関連付けるステップをさらに含む、請求項1に記載のシステム。
- 前記期待挙動に前記モジュールの前記評価を関連付けるステップは、
前記期待挙動の評価マニフェストを作成するステップと、
前記評価マニフェストに前記評価を関連付けるステップと
を含み、
前記評価マニフェストは、
前記モジュールによって通常アクセスされるファイルの種類と、
前記モジュールがスタートアッププログラムであるか否か
を含む、
請求項2に記載のシステム。 - 前記評価マニフェストは、前記期待挙動の集まりである、請求項3に記載のシステム。
- 前記モジュールを実行するステップをさらに含み、前記実行が行われた場合、前記モジュールは前記挙動を実行する、請求項1に記載のシステム。
- 前記モジュールの前記挙動は、いくつかの異なる設置場所での前記モジュールの集合的かつ包括的な挙動を含み、前記異なる設置場所は、異なるオペレーティングシステムを備える少なくとも2つの異なるコンピュータシステムを含む、請求項1に記載のシステム。
- 前記評価は、前記モジュールの全体的な信用度である、請求項1に記載のシステム。
- 前記モジュールの前記新しい挙動が前記期待挙動から逸脱しないと判断される場合、前記コンピュータにより実施される方法は、それ以上の動作を行わないステップをさらに含む、請求項1に記載のシステム。
- 前記保護動作をとるステップは、前記評価を無効化するステップを含む、請求項1に記載のシステム。
- 前記評価を無効化するステップは、前記モジュールにより低い評価を割り当てるステップを含む、請求項9に記載のシステム。
- 前記保護動作をとるステップは、前記モジュールの前記新しい挙動が前記期待挙動から逸脱した旨の警報を生成するステップを含む、請求項1に記載のシステム。
- 前記警報に基づいて、前記モジュールのインストールを考えている新しいユーザに警告が発せられる、請求項11に記載のシステム。
- 前記警告は、前記モジュールが未知の評価を有することを前記新しいユーザに通知するステップを含む、請求項12に記載のシステム。
- 前記保護動作をとるステップは、前記新しい挙動をブロックするステップを含む、請求項1に記載のシステム。
- 挙動が前記モジュールによってとられる動作とその特性を含み、記録されるべき行動と特性がユーザにより構成可能である請求項1に記載のシステム。
- ソフトウェア評価確立・監視アプリケーションからなるコンピュータプログラムであって、
前記ソフトウェア評価確立・監視アプリケーションは、第1のコンピュータシステムにおいて実行される未知のモジュールの挙動を記録するステップであって、前記記録される挙動は前記第1のコンピュータシステムにおいて実行される前記モジュールの期待挙動である、記録するステップと、
さらに前記記録された挙動を第2のコンピュータシステムに供給するステップと、
さらに前記第2のコンピュータシステム及び前記記録された挙動を用いて、前記期待挙動に従って挙動している前記モジュールを条件として、前記モジュールの評価を決定するステップと、
さらに前記モジュールの新たな挙動が前記期待挙動から特定量以上に逸脱していれば、前記モジュールの前記新たな挙動が前記期待挙動から逸脱しているものと決定するステップと、
さらに前記新たな挙動が前記期待挙動から前記特定量以上に逸脱していることの決定に応答して保護動作をとるステップと
をプロセッサに実行させる
コンピュータプログラム。
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US12/141,440 US9779234B2 (en) | 2008-06-18 | 2008-06-18 | Software reputation establishment and monitoring system and method |
US12/141,440 | 2008-06-18 | ||
PCT/US2009/046700 WO2009155165A1 (en) | 2008-06-18 | 2009-06-09 | Software reputation establishment and monitoring system and method |
Publications (2)
Publication Number | Publication Date |
---|---|
JP2011525662A JP2011525662A (ja) | 2011-09-22 |
JP5736305B2 true JP5736305B2 (ja) | 2015-06-17 |
Family
ID=41134664
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
JP2011514694A Active JP5736305B2 (ja) | 2008-06-18 | 2009-06-09 | ソフトウェア評価を確立し監視するシステムおよびプログラム |
Country Status (5)
Country | Link |
---|---|
US (1) | US9779234B2 (ja) |
EP (1) | EP2316089B1 (ja) |
JP (1) | JP5736305B2 (ja) |
CN (1) | CN102037472B (ja) |
WO (1) | WO2009155165A1 (ja) |
Families Citing this family (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8312536B2 (en) | 2006-12-29 | 2012-11-13 | Symantec Corporation | Hygiene-based computer security |
US8079085B1 (en) * | 2008-10-20 | 2011-12-13 | Trend Micro Incorporated | Reducing false positives during behavior monitoring |
US8904520B1 (en) * | 2009-03-19 | 2014-12-02 | Symantec Corporation | Communication-based reputation system |
DE102011117855A1 (de) * | 2011-11-08 | 2013-05-08 | Joachim Linz | Verfahren zum Bewerten und Eindämmen von Risiken durch Smart-Phone-Applikationen. |
US9589129B2 (en) | 2012-06-05 | 2017-03-07 | Lookout, Inc. | Determining source of side-loaded software |
US9407443B2 (en) | 2012-06-05 | 2016-08-02 | Lookout, Inc. | Component analysis of software applications on computing devices |
US9208215B2 (en) | 2012-12-27 | 2015-12-08 | Lookout, Inc. | User classification based on data gathered from a computing device |
US10834109B2 (en) * | 2014-12-23 | 2020-11-10 | Mcafee, Llc | Determining a reputation for a process |
EP3289510B1 (en) | 2015-05-01 | 2020-06-17 | Lookout Inc. | Determining source of side-loaded software |
US10218697B2 (en) | 2017-06-09 | 2019-02-26 | Lookout, Inc. | Use of device risk evaluation to manage access to services |
JP7156098B2 (ja) * | 2019-03-06 | 2022-10-19 | コニカミノルタ株式会社 | 情報処理装置、機能実行可否判断方法および機能実行可否判断プログラム |
Family Cites Families (53)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6092147A (en) * | 1997-04-15 | 2000-07-18 | Sun Microsystems, Inc. | Virtual machine with securely distributed bytecode verification |
US6167521A (en) * | 1997-08-29 | 2000-12-26 | International Business Machines Corporation | Securely downloading and executing code from mutually suspicious authorities |
US6560611B1 (en) * | 1998-10-13 | 2003-05-06 | Netarx, Inc. | Method, apparatus, and article of manufacture for a network monitoring system |
US6725377B1 (en) * | 1999-03-12 | 2004-04-20 | Networks Associates Technology, Inc. | Method and system for updating anti-intrusion software |
US6775779B1 (en) * | 1999-04-06 | 2004-08-10 | Microsoft Corporation | Hierarchical trusted code for content protection in computers |
US7185367B2 (en) * | 1999-05-11 | 2007-02-27 | Cylant, Inc. | Method and system for establishing normal software system behavior and departures from normal behavior |
US7181768B1 (en) * | 1999-10-28 | 2007-02-20 | Cigital | Computer intrusion detection system and method based on application monitoring |
US6862696B1 (en) * | 2000-05-03 | 2005-03-01 | Cigital | System and method for software certification |
US6892178B1 (en) * | 2000-06-02 | 2005-05-10 | Open Ratings Inc. | Method and system for ascribing a reputation to an entity from the perspective of another entity |
US7093239B1 (en) * | 2000-07-14 | 2006-08-15 | Internet Security Systems, Inc. | Computer immune system and method for detecting unwanted code in a computer system |
US6931545B1 (en) * | 2000-08-28 | 2005-08-16 | Contentguard Holdings, Inc. | Systems and methods for integrity certification and verification of content consumption environments |
US20020174422A1 (en) * | 2000-09-28 | 2002-11-21 | The Regents Of The University Of California | Software distribution system |
US6983380B2 (en) * | 2001-02-06 | 2006-01-03 | Networks Associates Technology, Inc. | Automatically generating valid behavior specifications for intrusion detection |
US7191438B2 (en) * | 2001-02-23 | 2007-03-13 | Lenovo (Singapore) Pte, Ltd. | Computer functional architecture and a locked down environment in a client-server architecture |
US20020194490A1 (en) * | 2001-06-18 | 2002-12-19 | Avner Halperin | System and method of virus containment in computer networks |
US6990534B2 (en) * | 2001-07-20 | 2006-01-24 | Flowfinity Wireless, Inc. | Method for a proactive browser system for implementing background frame maintenance and asynchronous frame submissions |
JP2003067210A (ja) * | 2001-08-22 | 2003-03-07 | Just Syst Corp | プログラム実行防止装置、プログラム実行防止方法、その方法をコンピュータに実行させるプログラムおよびそのプログラムを記録したコンピュータ読み取り可能な記録媒体 |
US7174566B2 (en) * | 2002-02-01 | 2007-02-06 | Intel Corporation | Integrated network intrusion detection |
US6880149B2 (en) * | 2002-04-01 | 2005-04-12 | Pace Anti-Piracy | Method for runtime code integrity validation using code block checksums |
US7487543B2 (en) * | 2002-07-23 | 2009-02-03 | International Business Machines Corporation | Method and apparatus for the automatic determination of potentially worm-like behavior of a program |
US7020802B2 (en) * | 2002-10-17 | 2006-03-28 | Sun Microsystems, Inc. | Method and apparatus for monitoring and recording computer system performance parameters |
US7051322B2 (en) * | 2002-12-06 | 2006-05-23 | @Stake, Inc. | Software analysis framework |
US7305663B1 (en) * | 2002-12-18 | 2007-12-04 | Advanced Micro Devices, Inc. | System and method for state-based profiling of multiprocessor systems |
US20040205419A1 (en) * | 2003-04-10 | 2004-10-14 | Trend Micro Incorporated | Multilevel virus outbreak alert based on collaborative behavior |
US7546598B2 (en) * | 2003-09-03 | 2009-06-09 | Sap Aktiengesellschaft | Measuring software system performance using benchmarks |
US7464158B2 (en) * | 2003-10-15 | 2008-12-09 | International Business Machines Corporation | Secure initialization of intrusion detection system |
US20050091535A1 (en) * | 2003-10-24 | 2005-04-28 | Microsoft Corporation | Application identity for software products |
US7743420B2 (en) * | 2003-12-02 | 2010-06-22 | Imperva, Inc. | Dynamic learning method and adaptive normal behavior profile (NBP) architecture for providing fast protection of enterprise applications |
US20070107052A1 (en) * | 2003-12-17 | 2007-05-10 | Gianluca Cangini | Method and apparatus for monitoring operation of processing systems, related network and computer program product therefor |
FR2864654B1 (fr) * | 2003-12-30 | 2007-02-23 | Trusted Logic | Procede de determination de caracteristiques operationnelles d'un programme |
US7506330B2 (en) * | 2004-02-12 | 2009-03-17 | International Business Machines Corporation | Method and apparatus for identifying differences in runs of a computer program due to code changes |
US7752662B2 (en) * | 2004-02-20 | 2010-07-06 | Imperva, Inc. | Method and apparatus for high-speed detection and blocking of zero day worm attacks |
US7984304B1 (en) * | 2004-03-02 | 2011-07-19 | Vmware, Inc. | Dynamic verification of validity of executable code |
EP1756708A4 (en) * | 2004-06-04 | 2010-04-07 | Fortify Software Inc | DEVICE AND METHOD FOR DEVELOPING, CHECKING AND MONITORING SAFE SOFTWARE |
US20050278178A1 (en) * | 2004-06-10 | 2005-12-15 | International Business Machines Corporation | System and method for intrusion decision-making in autonomic computing environments |
US7487545B2 (en) * | 2004-06-17 | 2009-02-03 | International Business Machines Corporation | Probabilistic mechanism to determine level of security for a software package |
US8640114B2 (en) * | 2006-09-07 | 2014-01-28 | Oracle America, Inc. | Method and apparatus for specification and application of a user-specified filter in a data space profiler |
US7865888B1 (en) * | 2004-12-21 | 2011-01-04 | Zenprise, Inc. | Systems and methods for gathering deployment state for automated management of software application deployments |
US7475387B2 (en) * | 2005-01-04 | 2009-01-06 | International Business Machines Corporation | Problem determination using system run-time behavior analysis |
US20060212931A1 (en) * | 2005-03-02 | 2006-09-21 | Markmonitor, Inc. | Trust evaluation systems and methods |
US7856658B2 (en) * | 2005-06-20 | 2010-12-21 | Lijit Networks, Inc. | Method and system for incorporating trusted metadata in a computing environment |
US20070044151A1 (en) * | 2005-08-22 | 2007-02-22 | International Business Machines Corporation | System integrity manager |
US20070180522A1 (en) * | 2006-01-30 | 2007-08-02 | Bagnall Robert J | Security system and method including individual applications |
KR100791290B1 (ko) * | 2006-02-10 | 2008-01-04 | 삼성전자주식회사 | 디바이스 간에 악성 어플리케이션의 행위 정보를 사용하는장치 및 방법 |
JP2008021274A (ja) * | 2006-06-15 | 2008-01-31 | Interlex Inc | プロセス監視装置及び方法 |
US20080016339A1 (en) * | 2006-06-29 | 2008-01-17 | Jayant Shukla | Application Sandbox to Detect, Remove, and Prevent Malware |
FI20060665A0 (fi) * | 2006-07-07 | 2006-07-07 | Nokia Corp | Poikkeavuuden havaitseminen |
JP2008077548A (ja) * | 2006-09-25 | 2008-04-03 | Matsushita Electric Ind Co Ltd | 移動体通信端末、移動体通信方法、移動体通信プログラム、移動体通信システム |
US8185953B2 (en) * | 2007-03-08 | 2012-05-22 | Extrahop Networks, Inc. | Detecting anomalous network application behavior |
US9378373B2 (en) * | 2007-09-24 | 2016-06-28 | Symantec Corporation | Software publisher trust extension application |
KR101489244B1 (ko) * | 2007-12-24 | 2015-02-04 | 삼성전자 주식회사 | 가상 머신 모니터 기반의 프로그램 실행 시스템 및 그 제어방법 |
US8700642B2 (en) * | 2010-03-22 | 2014-04-15 | Microsoft Corporation | Software agent for monitoring content relevance |
US8646072B1 (en) * | 2011-02-08 | 2014-02-04 | Symantec Corporation | Detecting misuse of trusted seals |
-
2008
- 2008-06-18 US US12/141,440 patent/US9779234B2/en not_active Expired - Fee Related
-
2009
- 2009-06-09 JP JP2011514694A patent/JP5736305B2/ja active Active
- 2009-06-09 EP EP09767475.8A patent/EP2316089B1/en active Active
- 2009-06-09 WO PCT/US2009/046700 patent/WO2009155165A1/en active Application Filing
- 2009-06-09 CN CN200980118751.0A patent/CN102037472B/zh active Active
Also Published As
Publication number | Publication date |
---|---|
WO2009155165A8 (en) | 2010-08-12 |
JP2011525662A (ja) | 2011-09-22 |
US20090319998A1 (en) | 2009-12-24 |
EP2316089A1 (en) | 2011-05-04 |
EP2316089B1 (en) | 2016-11-30 |
WO2009155165A1 (en) | 2009-12-23 |
CN102037472A (zh) | 2011-04-27 |
US9779234B2 (en) | 2017-10-03 |
CN102037472B (zh) | 2015-07-01 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP5736305B2 (ja) | ソフトウェア評価を確立し監視するシステムおよびプログラム | |
US11687653B2 (en) | Methods and apparatus for identifying and removing malicious applications | |
Song et al. | The effective ransomware prevention technique using process monitoring on android platform | |
US9888032B2 (en) | Method and system for mitigating the effects of ransomware | |
US10154066B1 (en) | Context-aware compromise assessment | |
CN109155774B (zh) | 用于检测安全威胁的系统和方法 | |
CN109074452B (zh) | 用于生成绊网文件的系统和方法 | |
US9183377B1 (en) | Unauthorized account monitoring system and method | |
US7665139B1 (en) | Method and apparatus to detect and prevent malicious changes to tokens | |
RU2535506C2 (ru) | Система и способ формирования сценариев модели поведения приложений | |
JP2009076069A (ja) | ソフトウエアメーカー信頼性延長アプリケーション | |
Continella et al. | Prometheus: Analyzing WebInject-based information stealers | |
JP5102659B2 (ja) | 悪性Webサイト判定装置、悪性Webサイト判定システム、それらの方法、プログラム | |
WO2018034916A1 (en) | Interrupt synchronization of content between client device and cloud-based storage service | |
US20230297676A1 (en) | Systems and methods for code injection detection | |
US9659182B1 (en) | Systems and methods for protecting data files | |
CN109997138A (zh) | 用于检测计算设备上的恶意进程的系统和方法 | |
Uma et al. | Survey on Android malware detection and protection using data mining algorithms | |
US8353032B1 (en) | Method and system for detecting identity theft or unauthorized access | |
CN116611058A (zh) | 一种勒索病毒检测方法及相关系统 | |
Helmer et al. | Anomalous intrusion detection system for hostile Java applets | |
Shahzad et al. | A survey on recent advances in malicious applications analysis and detection techniques for smartphones | |
Viswanathan et al. | Dynamic monitoring of website content and alerting defacement using trusted platform module | |
CN113836542B (zh) | 可信白名单匹配方法、系统和装置 | |
WO2024121950A1 (ja) | 配置場所選定装置、配置場所選定方法、及び配置場所選定プログラム |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
RD04 | Notification of resignation of power of attorney |
Free format text: JAPANESE INTERMEDIATE CODE: A7424 Effective date: 20120524 |
|
A621 | Written request for application examination |
Free format text: JAPANESE INTERMEDIATE CODE: A621 Effective date: 20120601 |
|
A977 | Report on retrieval |
Free format text: JAPANESE INTERMEDIATE CODE: A971007 Effective date: 20131029 |
|
A131 | Notification of reasons for refusal |
Free format text: JAPANESE INTERMEDIATE CODE: A131 Effective date: 20131126 |
|
A521 | Request for written amendment filed |
Free format text: JAPANESE INTERMEDIATE CODE: A523 Effective date: 20140226 |
|
A131 | Notification of reasons for refusal |
Free format text: JAPANESE INTERMEDIATE CODE: A131 Effective date: 20140805 |
|
TRDD | Decision of grant or rejection written | ||
A01 | Written decision to grant a patent or to grant a registration (utility model) |
Free format text: JAPANESE INTERMEDIATE CODE: A01 Effective date: 20150324 |
|
A61 | First payment of annual fees (during grant procedure) |
Free format text: JAPANESE INTERMEDIATE CODE: A61 Effective date: 20150420 |
|
R150 | Certificate of patent or registration of utility model |
Ref document number: 5736305 Country of ref document: JP Free format text: JAPANESE INTERMEDIATE CODE: R150 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
S111 | Request for change of ownership or part of ownership |
Free format text: JAPANESE INTERMEDIATE CODE: R313113 |
|
S531 | Written request for registration of change of domicile |
Free format text: JAPANESE INTERMEDIATE CODE: R313531 |
|
S533 | Written request for registration of change of name |
Free format text: JAPANESE INTERMEDIATE CODE: R313533 |
|
R350 | Written notification of registration of transfer |
Free format text: JAPANESE INTERMEDIATE CODE: R350 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |