International Business Machines Corporation

Trusteer, Ltd.

Emc Corporation

Amit Klein

Shmuel Regev

Michael Boodaei

Eldan Ben-Haim

Oleg Izmerly

Ron Peleg

Zohar Basil

Gal Frishman

Ronen Heled

Lior Golan

Avner Gideoni

Yaron Dycian

Zohar Golan

A computer security method including preventing access by a computer in a first computer network to a resource at a location within the first computer network responsive to the computer accessing a computer-readable document retrieved from a second computer network, wherein a reference to the resource is associated with the computer-readable document.

Computer network cross-boundary protection

A process for finding potentially harmful malware dropper on an infected computer system includes the steps of a) identifying an executable file that is about to run, and b) providing a storage agent that stores a copy of said executable file for a later inspection.

Malware dropper discovery method and system

A computer security method including detecting access, by a computer in a first computer network, to a computer-readable document, determining whether the computer-readable document was retrieved from a second computer network, identifying a reference, associated with the computer-readable document, to a resource at a location within the first computer network, and preventing access by the computer to the resource at the location within the first computer network responsive to determining that the computer-readable document was retrieved from the second computer network.

Detecting heap spraying on a computer by determining that values of characteristics of a plurality of requests to allocate portions of heap memory are consistent with benchmark values of the characteristics, wherein the benchmark values of the characteristics are associated with heap spraying; and performing a computer-security-related remediation action responsive to determining that the values of the characteristics are consistent with the benchmark values of the characteristics.

Detecting heap spraying on a computer

Detecting malware-related activity on a computer by detecting activity associated with the creation of a data object, where the activity is performed by a process, where the process is an instance of a computer software application that resides in a computer memory and that is executed by a computer, and where the data object is configured to persist after termination of the process, determining a string that identifies the data object, searching for a portion of the string that identifies the data object within any areas of the computer memory storing static portions of the computer software application, and performing a computer-security-related remediation action responsive to determining that the portion of the string that identifies the data object is absent from the searched areas of the computer memory.

Detecting malware-related activity on a computer

Dynamic verification of a computer software application execution path by detecting execution of a target instruction of a computer software application, wherein the computer software application is configured to generate a token at an instruction near a waypoint instruction of the computer software application, and wherein the waypoint instruction lies along an execution path that leads to the target instruction. Determining, responsive to detecting execution of the target instruction, whether a token exists. Performing a computer-security-related remediation action responsive to determining that the token does not exist.

Dynamic verification of a computer software application execution path

System and method for determining, by a security application, whether an examined software code is a malware, according to which the system detects whenever the examined process code performs system calls and further detects a call site. Pieces of code in the surrounding area of the site and/or in branches related to the site are analyzed and the properties of the analyzed pieces of code are compared with a predefined software code patterns, for determining whether the examined process code corresponds to one of the predefined software code patterns. Then the examined process code is classified according to the comparison results.

Method for detecting a malware

A method for detecting malware in a user terminal device that has been infected by malware via a browser running on the user terminal device, according to which upon detecting a predetermined a triggering event on the user terminal, a security application installed on the terminal automatically activates a transparent browser to navigate to one or more predetermined URLs. Then the security application checks the code of an inspected webpage that has been received immediately after it is opened by the transparent browser and rechecks the code after being at least partially processed by the transparent browser. If a change the code is detected, an alert is issued, indicating that the terminal has been infected by malware.

Client based local malware detection method

Detecting the operation of a virtual machine by identifying seed candidates from sets of random numbers generated at a computer, where each of the sets includes multiple random numbers, identifying candidate performance counter frequencies from the seed candidates and from timing information associated with the sets of random numbers, and determining that the computer is operating as a virtual machine if any of the candidate performance counter frequencies is consistent with a predefined virtual machine performance counter frequency.

Detecting operation of a virtual machine

Detecting heap spraying on a computer by detecting a plurality of requests to allocate portions of heap memory, measuring the plurality of requests to determine a value of a characteristic of the plurality of requests, identifying an activity consistent with heap spraying by determining that the value of the characteristic is consistent with a benchmark value of the characteristic, wherein the benchmark value of the characteristic is associated with heap spraying, and performing a computer-security-related remediation action responsive to determining that the value of the characteristic is consistent with the benchmark value of the characteristic.

A process for identifying potentially harmful malware, comprises the steps of: a) identifying an executable that is about to run; b) providing a monitoring agent that monitors all threads that are descendent of a thread initiated by the process of said executable; and c) configuring said monitoring agent to conclude that a high probability of malware presence exists, if one of said descendent threads reaches a target process in which suspicious patches are created.

Malware discovery method and system

A method for preventing the acquisition of data by a screen capturing malware, comprises preventing an unidentified process that does not open a window from performing screen capture.

Method and system for prevention of windowless screen capture

Detecting proxy-based communications via a computer network by sending a uniform resource locator via a computer network to a recipient at a first computer network address, identifying a request associated with the uniform resource locator, where the request is associated with a second computer network address, and determining that a value of a characteristic of the second computer network address is inconsistent with a value associated with the recipient, thereby identifying the first computer network address as being associated with a proxy.

Detecting proxy-based communication

A method for detecting HTML-modifying malware present in a computer includes providing a server which serves a web page (HTML) to a browser. A determination is made whether a modified string exists in the page received by the browser and if a modifying element is found, determining the malware is present in the computer.

Growing community of inventors

Herzliya, Israel

Amit Klein