ZA200410384B - Detection of code-free files - Google Patents
Detection of code-free files Download PDFInfo
- Publication number
- ZA200410384B ZA200410384B ZA200410384A ZA200410384A ZA200410384B ZA 200410384 B ZA200410384 B ZA 200410384B ZA 200410384 A ZA200410384 A ZA 200410384A ZA 200410384 A ZA200410384 A ZA 200410384A ZA 200410384 B ZA200410384 B ZA 200410384B
- Authority
- ZA
- South Africa
- Prior art keywords
- file
- status
- recited
- parser
- input file
- Prior art date
Links
- 238000001514 detection method Methods 0.000 title description 25
- 238000000034 method Methods 0.000 claims description 24
- 150000001875 compounds Chemical class 0.000 claims description 14
- 230000004044 response Effects 0.000 claims description 5
- 230000015654 memory Effects 0.000 description 16
- 230000003287 optical effect Effects 0.000 description 9
- 241000700605 Viruses Species 0.000 description 8
- 230000000840 anti-viral effect Effects 0.000 description 7
- 238000010586 diagram Methods 0.000 description 6
- 238000004891 communication Methods 0.000 description 5
- 238000011835 investigation Methods 0.000 description 4
- 230000007246 mechanism Effects 0.000 description 3
- 230000006855 networking Effects 0.000 description 3
- 230000002093 peripheral effect Effects 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 238000012545 processing Methods 0.000 description 3
- 230000008570 general process Effects 0.000 description 2
- 208000036142 Viral infection Diseases 0.000 description 1
- 230000005055 memory storage Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 238000012552 review Methods 0.000 description 1
- 238000013515 script Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000007723 transport mechanism Effects 0.000 description 1
- 230000009385 viral infection Effects 0.000 description 1
- 230000003612 virological effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
- G06F21/563—Static detection by source code analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F15/00—Digital computers in general; Data processing equipment in general
- G06F15/16—Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Information Transfer Between Computers (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Communication Control (AREA)
- Debugging And Monitoring (AREA)
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/769,106 US7721334B2 (en) | 2004-01-30 | 2004-01-30 | Detection of code-free files |
Publications (1)
Publication Number | Publication Date |
---|---|
ZA200410384B true ZA200410384B (en) | 2006-09-27 |
Family
ID=34654378
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
ZA200410384A ZA200410384B (en) | 2004-01-30 | 2004-12-23 | Detection of code-free files |
Country Status (13)
Country | Link |
---|---|
US (1) | US7721334B2 (ja) |
EP (1) | EP1560112B1 (ja) |
JP (1) | JP2005216286A (ja) |
KR (1) | KR101098652B1 (ja) |
CN (1) | CN1648812A (ja) |
AU (1) | AU2004237916A1 (ja) |
BR (1) | BRPI0405400A (ja) |
CA (1) | CA2491114C (ja) |
HK (1) | HK1080163A1 (ja) |
MX (1) | MXPA04012866A (ja) |
RU (1) | RU2004138761A (ja) |
TW (1) | TW200525346A (ja) |
ZA (1) | ZA200410384B (ja) |
Families Citing this family (31)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7617492B2 (en) * | 2004-06-28 | 2009-11-10 | Microsoft Corporation | Extensible command line parsing |
US8060860B2 (en) * | 2005-04-22 | 2011-11-15 | Apple Inc. | Security methods and systems |
US20060271597A1 (en) * | 2005-05-31 | 2006-11-30 | Microsoft Corporation | Code-enabled/code-free files |
GB2427048A (en) * | 2005-06-09 | 2006-12-13 | Avecho Group Ltd | Detection of unwanted code or data in electronic mail |
US8060747B1 (en) | 2005-09-12 | 2011-11-15 | Microsoft Corporation | Digital signatures for embedded code |
CN100447783C (zh) * | 2005-12-30 | 2008-12-31 | 英业达股份有限公司 | 文件格式识别系统及方法 |
US8190902B2 (en) * | 2006-02-27 | 2012-05-29 | Microsoft Corporation | Techniques for digital signature formation and verification |
US8205087B2 (en) * | 2006-02-27 | 2012-06-19 | Microsoft Corporation | Tool for digitally signing multiple documents |
US8458789B1 (en) * | 2006-03-09 | 2013-06-04 | Mcafee, Inc. | System, method and computer program product for identifying unwanted code associated with network communications |
US20080010538A1 (en) * | 2006-06-27 | 2008-01-10 | Symantec Corporation | Detecting suspicious embedded malicious content in benign file formats |
US20080115016A1 (en) * | 2006-11-13 | 2008-05-15 | Electronics And Telecommunications Research Institute | System and method for analyzing unknown file format to perform software security test |
US9729513B2 (en) | 2007-11-08 | 2017-08-08 | Glasswall (Ip) Limited | Using multiple layers of policy management to manage risk |
US20080134333A1 (en) * | 2006-12-04 | 2008-06-05 | Messagelabs Limited | Detecting exploits in electronic objects |
GB2444514A (en) | 2006-12-04 | 2008-06-11 | Glasswall | Electronic file re-generation |
CN100483419C (zh) * | 2007-07-27 | 2009-04-29 | 华为技术有限公司 | 一种数据格式的校验方法及装置 |
US20100037317A1 (en) * | 2008-08-06 | 2010-02-11 | Jeong Wook Oh | Mehtod and system for security monitoring of the interface between a browser and an external browser module |
GB2466455A (en) * | 2008-12-19 | 2010-06-23 | Qinetiq Ltd | Protection of computer systems |
GB0918478D0 (en) * | 2009-10-22 | 2009-12-09 | Qinetiq Ltd | Checking data content |
CN102043915B (zh) * | 2010-11-03 | 2013-01-23 | 厦门市美亚柏科信息股份有限公司 | 一种非可执行文件中包含恶意代码的检测方法及其装置 |
CN102831215B (zh) * | 2012-08-17 | 2016-06-08 | 芯原微电子(北京)有限公司 | 一种基于嵌入元语言指令的文本处理方法及装置 |
GB2518880A (en) | 2013-10-04 | 2015-04-08 | Glasswall Ip Ltd | Anti-Malware mobile content data management apparatus and method |
US9330264B1 (en) | 2014-11-26 | 2016-05-03 | Glasswall (Ip) Limited | Statistical analytic method for the determination of the risk posed by file based content |
RU2606559C1 (ru) * | 2015-10-22 | 2017-01-10 | Акционерное общество "Лаборатория Касперского" | Система и способ оптимизации антивирусной проверки файлов |
CN106682505B (zh) * | 2016-05-04 | 2020-06-12 | 腾讯科技(深圳)有限公司 | 一种病毒检测方法、终端、服务器及系统 |
TWI622894B (zh) * | 2016-12-13 | 2018-05-01 | 宏碁股份有限公司 | 電子裝置及偵測惡意檔案的方法 |
US11537713B2 (en) * | 2017-08-02 | 2022-12-27 | Crashplan Group Llc | Ransomware attack onset detection |
TWI760655B (zh) * | 2019-09-26 | 2022-04-11 | 阿證科技股份有限公司 | 資料掃描系統 |
CN111416812B (zh) * | 2020-03-16 | 2022-06-21 | 深信服科技股份有限公司 | 一种恶意脚本检测方法、设备及存储介质 |
KR102326490B1 (ko) * | 2020-03-25 | 2021-11-15 | 주식회사 티맥스 소프트 | 스텝 입출력 데이터 셋 파이프라이닝 |
RU2757408C1 (ru) * | 2020-09-24 | 2021-10-15 | Акционерное общество "Лаборатория Касперского" | Система и способ формирования правила проверки файла на вредоносность |
CN114244599B (zh) * | 2021-12-15 | 2023-11-24 | 杭州默安科技有限公司 | 一种干扰恶意程序的方法 |
Family Cites Families (39)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5754761A (en) | 1995-03-06 | 1998-05-19 | Willsey; John A. | Universal sofeware key process |
US6067410A (en) | 1996-02-09 | 2000-05-23 | Symantec Corporation | Emulation repair system |
US7058822B2 (en) * | 2000-03-30 | 2006-06-06 | Finjan Software, Ltd. | Malicious mobile code runtime monitoring system and methods |
US5960170A (en) * | 1997-03-18 | 1999-09-28 | Trend Micro, Inc. | Event triggered iterative virus detection |
KR100204917B1 (ko) | 1997-05-17 | 1999-06-15 | 윤종용 | 디지탈 무선 이동 통신을 위한 에이치엘알 시스템의 데이타베이스 변경을 위한 방법 |
US5948104A (en) | 1997-05-23 | 1999-09-07 | Neuromedical Systems, Inc. | System and method for automated anti-viral file update |
US6006329A (en) | 1997-08-11 | 1999-12-21 | Symantec Corporation | Detection of computer viruses spanning multiple data streams |
US6021510A (en) | 1997-11-24 | 2000-02-01 | Symantec Corporation | Antivirus accelerator |
JP2926590B1 (ja) | 1998-08-25 | 1999-07-28 | 日本電気マイコンテクノロジー株式会社 | プログラムデバッガ,プログラムデバッグ方法および記録媒体 |
US6401210B1 (en) | 1998-09-23 | 2002-06-04 | Intel Corporation | Method of managing computer virus infected files |
US6230288B1 (en) | 1998-10-29 | 2001-05-08 | Network Associates, Inc. | Method of treating whitespace during virus detection |
JP2001101049A (ja) * | 1999-09-28 | 2001-04-13 | Mitsubishi Electric Corp | ファイル復元装置 |
US6892303B2 (en) | 2000-01-06 | 2005-05-10 | International Business Machines Corporation | Method and system for caching virus-free file certificates |
WO2001088673A2 (en) | 2000-05-17 | 2001-11-22 | Finjan Software, Ltd. | Malicious mobile code runtime monitoring system and methods |
CN1260724C (zh) | 2000-05-25 | 2006-06-21 | 日本胜利株式会社 | 一种内容重放方法 |
GB0016835D0 (en) | 2000-07-07 | 2000-08-30 | Messagelabs Limited | Method of, and system for, processing email |
US8341743B2 (en) | 2000-07-14 | 2012-12-25 | Ca, Inc. | Detection of viral code using emulation of operating system functions |
US7093239B1 (en) * | 2000-07-14 | 2006-08-15 | Internet Security Systems, Inc. | Computer immune system and method for detecting unwanted code in a computer system |
WO2002013469A2 (en) | 2000-08-08 | 2002-02-14 | Tumbleweed Communications Corp. | Recipient-specified automated processing in a secure data file delivery system |
EP1202148A1 (en) | 2000-10-31 | 2002-05-02 | Hewlett-Packard Company, A Delaware Corporation | Virus check on altered data |
US7111075B2 (en) | 2000-12-18 | 2006-09-19 | Microsoft Corporation | Method and system for processing data records having multiple formats |
US6898712B2 (en) | 2001-02-20 | 2005-05-24 | Networks Associates Technology, Inc. | Test driver ordering |
US7096497B2 (en) | 2001-03-30 | 2006-08-22 | Intel Corporation | File checking using remote signing authority via a network |
US7310817B2 (en) | 2001-07-26 | 2007-12-18 | Mcafee, Inc. | Centrally managed malware scanning |
US7543334B2 (en) | 2001-08-27 | 2009-06-02 | Mcafee, Inc. | Update status alerting for a malware scanner |
US7340774B2 (en) | 2001-10-15 | 2008-03-04 | Mcafee, Inc. | Malware scanning as a low priority task |
US7107617B2 (en) | 2001-10-15 | 2006-09-12 | Mcafee, Inc. | Malware scanning of compressed computer files |
US20030079142A1 (en) | 2001-10-22 | 2003-04-24 | Aladdin Knowledge Systems Ltd. | Classifying digital object security category |
US7150043B2 (en) | 2001-12-12 | 2006-12-12 | International Business Machines Corporation | Intrusion detection method and signature table |
US7631184B2 (en) | 2002-05-14 | 2009-12-08 | Nicholas Ryan | System and method for imposing security on copies of secured items |
US7058975B2 (en) | 2001-12-14 | 2006-06-06 | Mcafee, Inc. | Method and system for delayed write scanning for detecting computer malwares |
US20030115479A1 (en) | 2001-12-14 | 2003-06-19 | Jonathan Edwards | Method and system for detecting computer malwares by scan of process memory after process initialization |
GB0130805D0 (en) | 2001-12-22 | 2002-02-06 | Koninkl Philips Electronics Nv | Dealing with a computer virus which self-propagates by e-mail |
JP2003242092A (ja) | 2002-02-08 | 2003-08-29 | Koshu Sai | 電子メールウイルス予防システムの隔離検出方法、交互授権方法、隔離検出プログラムおよび交互授権プログラム |
WO2003090050A2 (en) | 2002-04-13 | 2003-10-30 | Computer Associates Think, Inc. | System and method for detecting malicicous code |
US7418729B2 (en) | 2002-07-19 | 2008-08-26 | Symantec Corporation | Heuristic detection of malicious computer code by page tracking |
GB2391965B (en) * | 2002-08-14 | 2005-11-30 | Messagelabs Ltd | Method of, and system for, heuristically detecting viruses in executable code |
KR20030096167A (ko) | 2003-11-26 | 2003-12-24 | (주) 소프트길드 | 수신자 상태 체크가 가능한 대용량 파일송수신 시스템 |
US20060136389A1 (en) * | 2004-12-22 | 2006-06-22 | Cover Clay H | System and method for invocation of streaming application |
-
2004
- 2004-01-30 US US10/769,106 patent/US7721334B2/en not_active Expired - Fee Related
- 2004-12-03 EP EP04028765.8A patent/EP1560112B1/en not_active Not-in-force
- 2004-12-07 TW TW093137805A patent/TW200525346A/zh unknown
- 2004-12-07 BR BR0405400-8A patent/BRPI0405400A/pt not_active IP Right Cessation
- 2004-12-10 KR KR1020040104254A patent/KR101098652B1/ko active IP Right Grant
- 2004-12-14 AU AU2004237916A patent/AU2004237916A1/en not_active Abandoned
- 2004-12-16 MX MXPA04012866A patent/MXPA04012866A/es not_active Application Discontinuation
- 2004-12-20 JP JP2004368217A patent/JP2005216286A/ja active Pending
- 2004-12-23 ZA ZA200410384A patent/ZA200410384B/en unknown
- 2004-12-23 CA CA2491114A patent/CA2491114C/en not_active Expired - Fee Related
- 2004-12-28 CN CNA2004100615642A patent/CN1648812A/zh active Pending
- 2004-12-29 RU RU2004138761/09A patent/RU2004138761A/ru not_active Application Discontinuation
-
2006
- 2006-01-04 HK HK06100062.7A patent/HK1080163A1/xx not_active IP Right Cessation
Also Published As
Publication number | Publication date |
---|---|
CA2491114C (en) | 2014-08-12 |
CA2491114A1 (en) | 2005-07-30 |
EP1560112B1 (en) | 2014-05-14 |
KR20050078192A (ko) | 2005-08-04 |
US7721334B2 (en) | 2010-05-18 |
EP1560112A1 (en) | 2005-08-03 |
CN1648812A (zh) | 2005-08-03 |
KR101098652B1 (ko) | 2011-12-23 |
BRPI0405400A (pt) | 2005-09-20 |
RU2004138761A (ru) | 2006-06-10 |
MXPA04012866A (es) | 2005-08-03 |
HK1080163A1 (en) | 2006-04-21 |
US20050172339A1 (en) | 2005-08-04 |
AU2004237916A1 (en) | 2005-08-18 |
TW200525346A (en) | 2005-08-01 |
JP2005216286A (ja) | 2005-08-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7721334B2 (en) | Detection of code-free files | |
US11188650B2 (en) | Detection of malware using feature hashing | |
US8819835B2 (en) | Silent-mode signature testing in anti-malware processing | |
US20160171242A1 (en) | System, method, and compuer program product for preventing image-related data loss | |
US20090235357A1 (en) | Method and System for Generating a Malware Sequence File | |
US20040205411A1 (en) | Method of detecting malicious scripts using code insertion technique | |
US9106688B2 (en) | System, method and computer program product for sending information extracted from a potentially unwanted data sample to generate a signature | |
JP6708794B2 (ja) | 判定装置、判定方法、および、判定プログラム | |
US10747879B2 (en) | System, method, and computer program product for identifying a file used to automatically launch content as unwanted | |
US10621345B1 (en) | File security using file format validation | |
US11550920B2 (en) | Determination apparatus, determination method, and determination program | |
US8726377B2 (en) | Malware determination | |
JP2008140102A (ja) | 情報処理装置及び漏洩情報判定方法及びプログラム | |
US20130247182A1 (en) | System, method, and computer program product for identifying hidden or modified data objects | |
KR20160112744A (ko) | 문서 보안시스템 및 문서 보안방법 | |
US8484725B1 (en) | System, method and computer program product for utilizing a threat scanner for performing non-threat-related processing | |
CN114647849A (zh) | 潜在危险文件的检测方法、装置、电子设备及存储介质 | |
CN113287105A (zh) | 良性文件列表生成 |