Symantec Corporation

Jonathan San Jose

Ian Oliver

Rei Resurreccion

A computer-implemented method to scan memory for a threat is described. At least one application programming interface (API) is monitored. A back-trace operation is performed from the at least one API to identify a process that called the at least one API. An address in memory is retrieved for the identified process. At least a portion of the memory associated with the address of the identified process is scanned. A signature based on the scanned portion of the memory is generated.

Systems and methods to scan memory for a threat

A computer-implemented method to detect malicious code in a script attack, is described. An activity associated with calling a function is detected. An operation code set associated with the activity to call the function is identified. A predetermined sequence of characters included in the operation code set is identified. The identified predetermined sequence of characters is analyzed. The operation code set is classified as malicious or non-malicious based on the analysis of the predetermined sequence of characters.

Growing community of inventors

Southbank, Australia

Jonathan San Jose