Microsoft Technology Licensing, LLC

Ning Sun

Christopher S Hargarten

Chengyun Chu

Tony Lee

Monique H Ozoux-Dean

Jigar J Mody

Jason Geffner

Hong Jia

Patrick Winkler

Frank Swiderski

Christopher G Kaler

Marc E Seinfeld

Alexey A Polyakov

Meng Jin

Nicolas Kicillof

Brad Albrecht

Pat Winkler

Yiming Cao

Sergio F Mera

Andrey Arkharov

Automated malware signature generation is disclosed. Automated malware signature generation includes monitoring incoming unknown files for the presence of malware and analyzing the incoming unknown files based on both a plurality of classifiers of file behavior and a plurality of classifiers of file content. An incoming file is classified as having a particular malware classification based on the analyzing of incoming unknown files and a malware signature is generated for the incoming unknown file based on the particular malware classification. Access is provided to the malware signature.

Automated malware signature generation

A computing system is disclosed including a computer processor configured to receive a selection of a template and identify a data field in the template. The data field indicates financial data to fill in the data field. The computer processor is configured to retrieve the financial data for the data field from stored financial data and generate a document according to the selected template. The generated document has the financial data within the data field.

Generating documents using templates

Generating financial data documents using templates

Descriptions of communication interactions can be used to create a simulation of actual systems that send and receive communications including but not limited to messages complying with a protocol, events and so on. The communication interaction, event, state and state transitions of protocol or software components can be modeled to determine outcome and to validate the format and semantics of events, interaction values, etc. to identify variances against established policies or architectural guidelines.

Simulation of interactions between network endpoints

A malware analysis system is described that provides information about malware execution history on a client computer and allows automated back-end analysis for faster creation of identification signatures and removal instructions. The malware analysis system collects threat information on client computers and sends the threat information to a back-end analysis component for automated analysis. The back-end analysis component analyzes the threat information by comparing the threat information to information about known threats. The system builds a signature for identifying the threat family and a mitigation script for neutralizing the threat. The system sends the signature and mitigation data to client computers, which use the information to mitigate the threat. Thus, the malware analysis system detects and mitigates threats more quickly than previous systems by reducing the burden on technicians to manually create environments for reproducing the threats and manually analyze the threat behavior.

Collecting and analyzing malware data

A method of transferring data from a financial program to a word processing program to view and modify financial documents in the word processing program is disclosed. The method may entail selecting a template in an accounting program wherein the template has a field related to the selected template, identifying an open field in the selected template that can be filled in with data from the accounting program, selecting data stored by the accounting program that is appropriate to fill in the open field in the selected template, communicating the selected data and the selected template to the word processor and opening a document in the word processing program that displays the selected template and the selected data in the appropriate field as a word processing document.

Using a word processor with accounting data

A binary function database system is provided in which binary functions are extracted from compiled and linked program files and stored in a database as robust abstractions which can be matched with others using one or more function matching heuristics. Such abstraction allows for minor variations in function implementation while still enabling matching with an identical stored function in the database, or with a stored function with a given level of confidence. Metadata associated with each function is also typically generated and stored in the database. In an illustrative example, a structured query language database is utilized that runs on a central database server, and that tracks function names, the program file from which the function is extracted, comments and other associated information as metadata during an analyst's live analysis session to enable known function information that is stored in the database to be applied to binary functions of interest that are disassembled from the program file.

Binary function database system

Growing community of inventors

Redmond, WA, United States of America

Ning Sun