Microsoft Technology Licensing, LLC

Chad E Verbowski

Yi-Min Wang

Roussi A Roussev

John David Dunagan

Juhan Lee

Shuo Chen

Shan Lu

Arunvijay Kumar

Brad Daniels

John Carlton Platt

Yu Chen

Jiahe Helen Wang

Bryan M Willman

Adam D Barr

Sean Selitrennikoff

Sadagopan Rajaram

Bradford Daniels

Ruyun Zhang

Aaron Roy Johnson

Per-Ake Larson

Lili Qiu

Jacob Rubin Lorch

Rina Panigrahy

Yinglian Xie

Ming Ma

Douglas Reed Beck

Helen Jiahe Wang

Demetrios Achlioptas

Gautam Das

Douglas L Beck

Xiaogang Liu

Junfeng Yang

Binh Dou Vo

David C Ladd

John D Dungan

Samuel King

Ding Yuan

Apparatus and methods for intercepting and analyzing threads are disclosed. In one embodiment, a thread data recorder is configured to instrument one or more existing functions by modifying computer executable instructions in the functions to intercept threads calling the functions. In one possible implementation, the number of existing functions instrumented can be reduced by instrumenting choke point functions. The instrumented functions can also capture data associated with the threads as the threads execute at the function. This data can be saved to memory and compressed into logs. In one aspect, the data can be saved and/or compressed at a time when processor resources are being used at or below a predetermined level. The captured data can be used to analyze a functioning of a computer system in which the threads were produced.

Thread interception and analysis

A technique for automatically detecting and correcting configuration errors in a computing system. In a learning process, recurring event sequences, including e.g., registry access events, are identified from event logs, and corresponding rules are developed. In a detecting phase, the rules are applied to detected event sequences to identify violations and to recover from failures. Event sequences across multiple hosts can be analyzed. The recurring event sequences are identified efficiently by flattening a hierarchical sequence of the events such as is obtained from the Sequitur algorithm. A trie is generated from the recurring event sequences and edges of nodes of the trie are marked as rule edges or non-rule edges. A rule is formed from a set of nodes connected by rule edges. The rules can be updated as additional event sequences are analyzed. False positive suppression policies include a violation-consistency policy and an expected event disappearance policy.

Fingerprinting event logs for system management troubleshooting

In an embodiment of isolation environment-based information access, programs&#x2014;including operating systems and applications&#x2014;running on a computing-based device can be isolated in an environment such as a virtual machine. Information including commands and/or data transmitted between the computing-based device and the program(s) being run, as well as information associated with the program(s) and the computing-based device, is accessed without being detected by the program(s). In one implementation, the information includes state information as well as commands and/or data&#x2014;including sensitive information, such as usernames and passwords. In another implementation, the information can be used to secretly access the program(s).

Isolation environment-based information access

A method and system for identifying a configuration parameter of a 'sick' computer system that is at fault for causing an undesired behavior based on analysis of configuration parameters from other computer systems is provided. In one embodiment, a troubleshooting system collects 'suspect' values for &#x201c;suspect&#x201d; configuration parameters used by a &#x201c;sick&#x201d; application when the undesired behavior was exhibited by the sick computer system. The troubleshooting system then compares the suspect values to sample values of the suspect configuration parameters retrieved from sample computer systems. The troubleshooting system uses that comparison to identify one or more suspect configuration parameters that are likely at fault for causing the application to exhibit the undesired behavior.

Method and system for troubleshooting a misconfiguration of a computer system based on configurations of other computer systems

Apparatus and methods for intercepting and analyzing threads are disclosed. In one embodiment, a thread data recorder is configured to instrument one or more existing functions by modifying computer executable instructions in the functions to intercept threads calling the functions. In one possible implementation, the number of existing functions instrumented can be reduced by instrumenting choke point functions. The instrumented functions can also capture data associated with the threads as the threads execute at the function. This data can be saved to memory and compressed into logs. In one aspect, the data can be saved and/or compressed at a time when processor resources are being used at or below predetermined level. The captured data can be used to analyze a functioning of a computer system in which the threads were produced.

A technique for identifying dependencies of an application upon a given security context includes monitoring security checks generated by the application. The security checks requiring elevated rights are identified and the state of execution of the application corresponding to the identified security checks may be logged. The security checks requiring elevated rights may be identified by monitoring access checks, monitoring privilege checks, checking user/group identifiers against a list of known identifiers associated with elevated rights, or the like.

Identifying dependencies of an application upon a given security context

As computer programs grow more complex, extensible, and connected, it becomes increasingly difficult for users to understand what has changed on their machines and what impact those changes have. An embodiment of the invention is described via a software tool, called AskStrider, that answers those questions by correlating volatile process information with persistent-state context information and change history. AskStrider scans a system for active components, matches them against a change log to identify recently updated and hence more interesting state, and searches for context information to help users understand the changes. Several real-world cases are provided to demonstrate the effectiveness of using AskStrider to quickly identify the presence of unwanted software, to determine if a software patch is potentially breaking an application, and to detect lingering components left over from an unclean uninstallation.

Changed file identification, software conflict resolution and unwanted file removal

An exemplary method includes providing a typographically erroneous domain name, tracing the domain name where tracing includes entering the domain name as part of a URL and recording one or more subsequent URLs, identifying a domain parking service for the domain name based at least in part on information in one of the recorded URLs, determining client identification information in at least one of the recorded URLs where the client identification information identifies a customer of the domain parking service and blocking one or more domain names based at least in part on the client identification information. Other exemplary technologies are also disclosed.

Cybersquatter patrol

Systems and methods for implementing system management which are based on reviewing of the interactions between one or more programs and the persistent state they tend to represent. The system provides for detection of modifications that occur within a system, verifying whether the modifications are approved or not and generating notifications on detecting unknown modifications.

Program modification and loading times in computing devices

A method and system for detecting that a software system has been infected by software that attempts to hide properties related to the software system is provided. A detection system identifies that a suspect operating system has been infected by malware by comparing properties related to the suspect operating system as reported by the suspect operating system to properties as reported by another operating system that is assumed to be clean. The detection system compares the reported properties to the actual properties to identify any significant differences. A significant difference, such as the presence of an actual file not reported by the suspect operating system, may indicate that the suspect storage device is infected.

Method and system for detecting infection of an operating system

A method and system for analyzing the impact on software of an update to a software system is provided. The impact analysis system identifies resources that are affected by an update to the software system and identifies resources that are accessed by various software components during execution of the software components. To analyze the effects of an update, the impact analysis system identifies those accessed resources of the software components that are affected by the update as being impacted resources. The impact analysis system considers those software components that access the impacted resources to be impacted software components. The impact analysis system provides a user interface through which a user can view and analyze the impact of an update.

Method and system for analyzing the impact of a software update

Growing community of inventors

Bellevue, WA, United States of America

Chad E Verbowski