MX345979B - Localizacion de virus usando aplicación de funcion hash criptografica. - Google Patents

Localizacion de virus usando aplicación de funcion hash criptografica.

Info

Publication number
MX345979B
MX345979B MX2009004666A MX2009004666A MX345979B MX 345979 B MX345979 B MX 345979B MX 2009004666 A MX2009004666 A MX 2009004666A MX 2009004666 A MX2009004666 A MX 2009004666A MX 345979 B MX345979 B MX 345979B
Authority
MX
Mexico
Prior art keywords
hashes
file
virus
calculating
file blocks
Prior art date
Application number
MX2009004666A
Other languages
English (en)
Other versions
MX2009004666A (es
Inventor
Di Crescenzo Giovanni
Vakil Faramak
Original Assignee
Tti Invent C Llc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tti Invent C Llc filed Critical Tti Invent C Llc
Publication of MX2009004666A publication Critical patent/MX2009004666A/es
Publication of MX345979B publication Critical patent/MX345979B/es

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/58—Random or pseudo-random number generators
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00—Digital computers in general; Data processing equipment in general
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/565—Static detection by checking file integrity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • Virology (AREA)
  • General Health & Medical Sciences (AREA)
  • Computational Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

Métodos para usar técnicas de revisión de integridad para identificar y localizar virus de computadora son provistos. Un método para localización de virus para cada uno de tres tipos de infecciones de virus es previsto, incluyendo los pasos de calcular una secuencia de bloques de archivo, calcular valores hash para las secuencias de los bloques de archivo a partir de un archivo hospedero y calcular valores hash para las mismas secuencias o secuencias relacionadas de los bloques de archivo tal que cuando algunos de dichos primeros valores hash y dichos segundos valores hash no concuerdan, una localización de un virus es emitida. Métodos son provistos para calcular la secuencia de bloques de archivo dependiendo del tipo de infección de virus, y para calcular los valores hash usando una función hash resistente a colisiones, un esquema de firma digital, un código de autenticación de mensaje, o una función pseudos-aleatoria.
MX2009004666A 2006-10-31 2007-10-30 Localizacion de virus usando aplicación de funcion hash criptografica. MX345979B (es)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US85571006P 2006-10-31 2006-10-31
PCT/US2007/022899 WO2008054732A2 (en) 2006-10-31 2007-10-30 Virus localization using cryptographic hashing

Publications (2)

Publication Number Publication Date
MX2009004666A MX2009004666A (es) 2010-02-17
MX345979B true MX345979B (es) 2017-02-24

Family

ID=39344881

Family Applications (1)

Application Number Title Priority Date Filing Date
MX2009004666A MX345979B (es) 2006-10-31 2007-10-30 Localizacion de virus usando aplicación de funcion hash criptografica.

Country Status (7)

Country Link
US (3) US8191146B2 (es)
EP (1) EP2080312B1 (es)
JP (1) JP4997373B2 (es)
KR (1) KR101303532B1 (es)
CN (1) CN101641675B (es)
MX (1) MX345979B (es)
WO (1) WO2008054732A2 (es)

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9652613B1 (en) 2002-01-17 2017-05-16 Trustwave Holdings, Inc. Virus detection by executing electronic message code in a virtual machine
US8402529B1 (en) 2007-05-30 2013-03-19 M86 Security, Inc. Preventing propagation of malicious software during execution in a virtual machine
US20090235357A1 (en) * 2008-03-14 2009-09-17 Computer Associates Think, Inc. Method and System for Generating a Malware Sequence File
US10262136B1 (en) 2008-08-04 2019-04-16 Zscaler, Inc. Cloud-based malware detection
GB0822619D0 (en) * 2008-12-11 2009-01-21 Scansafe Ltd Malware detection
US8676759B1 (en) 2009-09-30 2014-03-18 Sonicwall, Inc. Continuous data backup using real time delta storage
US8640241B2 (en) * 2009-11-16 2014-01-28 Quatum Corporation Data identification system
JP5340185B2 (ja) * 2010-01-19 2013-11-13 日本放送協会 ファイル処理装置及びプログラム
JP5553670B2 (ja) * 2010-04-19 2014-07-16 キヤノン株式会社 管理装置、その制御方法およびプログラム
US8769691B1 (en) * 2011-02-14 2014-07-01 Trend Micro, Inc. Network traffic reduction
US9652616B1 (en) * 2011-03-14 2017-05-16 Symantec Corporation Techniques for classifying non-process threats
US8745750B2 (en) 2011-04-21 2014-06-03 Microsoft Corporation Origination verification using execution transparent marker context
US8584235B2 (en) * 2011-11-02 2013-11-12 Bitdefender IPR Management Ltd. Fuzzy whitelisting anti-malware systems and methods
CN102970294A (zh) * 2012-11-21 2013-03-13 网神信息技术（北京）股份有限公司 安全网关的病毒检测方法及装置
US9852290B1 (en) * 2013-07-12 2017-12-26 The Boeing Company Systems and methods of analyzing a software component
US9280369B1 (en) 2013-07-12 2016-03-08 The Boeing Company Systems and methods of analyzing a software component
US9336025B2 (en) 2013-07-12 2016-05-10 The Boeing Company Systems and methods of analyzing a software component
US9396082B2 (en) 2013-07-12 2016-07-19 The Boeing Company Systems and methods of analyzing a software component
US9479521B2 (en) 2013-09-30 2016-10-25 The Boeing Company Software network behavior analysis and identification system
CN106682506B (zh) * 2016-05-06 2020-03-17 腾讯科技（深圳）有限公司 一种病毒程序检测方法和终端
RU2634178C1 (ru) * 2016-10-10 2017-10-24 Акционерное общество "Лаборатория Касперского" Способ обнаружения вредоносных составных файлов
GB2562079B (en) * 2017-05-04 2021-02-10 Arm Ip Ltd Continuous hash verification
RU2659739C1 (ru) * 2017-09-29 2018-07-03 Акционерное общество "Лаборатория Касперского" Способ контроля доступа к составным файлам
JP6911723B2 (ja) * 2017-11-16 2021-07-28 富士通株式会社 ネットワーク監視装置、ネットワーク監視方法及びネットワーク監視プログラム
CN109766084B (zh) * 2018-12-28 2021-04-23 百富计算机技术（深圳）有限公司 支付应用的定制开发方法、装置、计算机设备和存储介质

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5408642A (en) * 1991-05-24 1995-04-18 Symantec Corporation Method for recovery of a computer program infected by a computer virus
US5485575A (en) * 1994-11-21 1996-01-16 International Business Machines Corporation Automatic analysis of a computer virus structure and means of attachment to its hosts
US5613002A (en) * 1994-11-21 1997-03-18 International Business Machines Corporation Generic disinfection of programs infected with a computer virus
US7234167B2 (en) * 2001-09-06 2007-06-19 Mcafee, Inc. Automatic builder of detection and cleaning routines for computer viruses
GB2392590B (en) 2002-08-30 2005-02-23 Toshiba Res Europ Ltd Methods and apparatus for secure data communication links
US7055008B2 (en) 2003-01-22 2006-05-30 Falconstor Software, Inc. System and method for backing up data
US7373519B1 (en) * 2003-04-09 2008-05-13 Symantec Corporation Distinguishing legitimate modifications from malicious modifications during executable computer file modification analysis
EP1533695B1 (en) * 2003-11-19 2013-08-07 TELEFONAKTIEBOLAGET LM ERICSSON (publ) Updating data in a mobile terminal
US20040172551A1 (en) * 2003-12-09 2004-09-02 Michael Connor First response computer virus blocking.
US7475427B2 (en) * 2003-12-12 2009-01-06 International Business Machines Corporation Apparatus, methods and computer programs for identifying or managing vulnerabilities within a data processing network

Also Published As

Publication number Publication date
KR20090113247A (ko) 2009-10-29
US8578498B2 (en) 2013-11-05
US20120159181A1 (en) 2012-06-21
WO2008054732A3 (en) 2008-08-07
EP2080312B1 (en) 2015-07-08
JP4997373B2 (ja) 2012-08-08
US20120167223A1 (en) 2012-06-28
JP2010508573A (ja) 2010-03-18
MX2009004666A (es) 2010-02-17
CN101641675B (zh) 2014-06-25
EP2080312A4 (en) 2013-09-25
US20080134337A1 (en) 2008-06-05
CN101641675A (zh) 2010-02-03
US8191146B2 (en) 2012-05-29
US8572743B2 (en) 2013-10-29
EP2080312A2 (en) 2009-07-22
WO2008054732A2 (en) 2008-05-08
KR101303532B1 (ko) 2013-09-03

Similar Documents

Publication Publication Date Title
MX345979B (es) Localizacion de virus usando aplicación de funcion hash criptografica.
US10162967B1 (en) Methods and systems for identifying legitimate computer files
CN102810138B (zh) 一种用户端文件的修复方法和系统
RU2014121249A (ru) Системы и способы защиты от вредоносного программного обеспечения на основе нечеткого вайтлистинга
US8713686B2 (en) System and method for reducing antivirus false positives
JP6340842B2 (ja) データ配信パスの検証
US9361458B1 (en) Locality-sensitive hash-based detection of malicious codes
JP2012501009A5 (es)
RU2015141552A (ru) Система и способ формирования набора антивирусных записей, используемых для обнаружения вредоносных файлов на компьютере пользователя
US20180101682A1 (en) System and method for detecting malicious compound files
ATE500677T1 (de) Ids-virtualisierung auf der basis des quellen- /zielbetriebssystemtyps
US8621625B1 (en) Methods and systems for detecting infected files
US10243977B1 (en) Automatically detecting a malicious file using name mangling strings
RU2009141594A (ru) Доверительная среда для обнаружения вредоносных программ
DE69912303D1 (de) Antivirenbeschleuniger für computernetzwerke
KR20120105759A (ko) 악성 코드 시각화 장치와 악성 코드 탐지 장치 및 방법
EP4332863A3 (en) Method and system for consent to time-bound queries in a blockchain
JP2024509486A (ja) 不変（ｆｉｘｉｔｙ）データ処理
CN103440461B (zh) 一种pdf格式文档安全审计方法
CN104331666A (zh) 一种计算机系统可信度量方法
CN102799824B (zh) 一种针对具有数字签名信息的病毒文件的防御方法及系统
KR102029465B1 (ko) 검색 또는 패턴 매칭 엔진 및 이를 구비한 단말장치와 그 방법
CN1329828C (zh) 一种防止计算机病毒的方法及装置
KR20180084502A (ko) Isp를 사용한 바이러스 사전 탐지 장치 및 방법
Flouri et al. GapMis-OMP: Pairwise short-read alignment on multi-core architectures

Legal Events

Date Code Title Description
GB Transfer or rights

Owner name: TTI INVENTIONS C LLC

HH Correction or change in general
GB Transfer or rights

Owner name: TTI INVENTIONS C LLC

FG Grant or registration