Microsoft Technology Licensing, LLC

Gretchen L Loihle

Yi-Min Wang

Scott Field

Yun Lin

Jack Wilson Stokes, Iii

Mihai Costea

Alexey A Polyakov

David Gregory Grant

Silviu C Calinoiu

Kevin Bartz

Ryan S Kivett

Vincent R Orgovan

Robert J Hensing, Jr

Techniques for determining similarity between error reports received by an error reporting service. An error report may be compared to other previously-received error reports to determine similarity and facilitate diagnosing and resolving an error that generated the error report. In some implementations, the similarity may be determined by comparing frames included in a callstack of an error report to frames included in callstacks in other error reports to determine an edit distance between the callstacks, which may be based on the number and type of frame differences between callstacks. Each type of change may be weighted differently when determining the edit distance. Additionally or alternatively, the comparison may be performed by comparing a type of error, process names, and/or exception codes for the errors contained in the error reports. The similarity may be expressed as a probability that two error reports were generated as a result of a same error.

Similarity detection for error reports

Embodiments of a RootKit detector are directed to identifying a RootKit on a computer that is designed to conceal malware. Aspects of the RootKit detector leverage services provided by kernel debugger facilities to automatically obtain data in specified data structures that are maintained by an operating system. Then the data obtained from the kernel debugger facilities is processed with an integrity checker that determines whether the data contains properties sufficient to declare that a RootKit is resident on the computer.

Automated rootkit detector

Growing community of inventors

Redmond, WA, United States of America

Gretchen L Loihle