Symantec Corporation

Rolf Repasi

Simon Clausen

Ian Oliver

Ryan Pereira

Neil Younusov

A method, system, computer readable medium of instructions and/or computer program product. The method comprises receiving, in a proxy server, response data from a remote processing system, according to a request from the client processing system to download data from the remote processing system; using, in one or more emulated operating systems of the proxy server, the downloaded data; monitoring behavior of the use of the data in the one or more emulated operating systems; and in response to detecting malicious behavior indicative of a threat, restricting the client processing system being compromised with the threat of the response data.

Restricting a processing system being compromised with a threat

A method, system, computer program product, and/or a computer readable medium of instructions for detecting a malicious message for an instant messaging service. In one form, the method comprises: receiving a message in a first processing system; analyzing the message to determine if the message is malicious; and in response to detecting that the message is malicious, restricting the message from threatening: the first processing system; and a second processing system in data communication with the first processing system. In another form, the method comprises receiving, in a first processing system, input data indicative of an instruction to transfer a message to a second processing system; analyzing the message to be transferred to determine if the message is malicious; and in response to detecting that the message is malicious, restricting the message from being transferred to the second processing system.

Instant message scanning

A method/system of determining if one or more entities in a data storage medium of a processing system are malicious, wherein the method comprises recording entity properties of the one or more entities when at least part of the processing system is in a range of operating usage; and determining, using the entity properties, if the one or more entities are malicious.

Determination of malicious entities

A method of verifying content, for example webpage content, including receiving, at an indexing system (), a first copy () of a document () from a hosting server (), then processing the first copy () to obtain first indicating data including one or more properties of the first copy (). Also obtaining second indicating data, the second indicating data obtained by processing a second copy () of the document () from the hosting server (), the second copy () received by a client terminal (), the second indicating data including one or more properties of the second copy (). Then the first indicating data and the second indicating data can be compared, and the first copy () of the document () received by the indexing system () can be determined to be verified or not verified based on a comparison between the first indicating data and the second indicating data.

Distributed content verification and indexing

A method, system, computer program product and/or computer readable medium of instructions to detect malicious activity. The method comprises intercepting an activity in a processing system, wherein a requesting entity requests the activity to be performed in relation to a target entity; determining, using a filter module if the activity is suspicious or non-suspicious; and in response to determining that the activity is suspicious, analysing at least one of the activity, the requesting entity and the target entity using an analysis module to detect malicious activity. There is also disclosed a method, system, computer program product and/or computer readable medium of instructions to facilitate the detection of malicious activity.

Detecting malicious activity

A method of (and associated system and computer program product for) providing a rating for a web site (). The rating is obtained from a plurality of member users. A member user () submits () feedback data (), that may be stored in a database (), using an interface () provided on a member user terminal (), the feedback data () related to the web site. A member user submitting feedback data () has a member user weighting, a member user weighting is preferably obtained () from one or more other member users, or may be initially allocated as a default weighting. The rating for the web site () is determined () at least partially based on the feedback data () and the member user weighting of the member user who submitted the feedback data (). The rating may be determined or adjusted by feedback data and respective member user weightings received from other member users.

Providing a rating for a web site based on weighted user feedback

A method of (and associated system and computer program product for) providing a rating for an event. A user submits feedback data using an interface provided on a user terminal, the feedback data related to the event. A user submitting feedback data may have a member user weighting, preferably obtained from one or more other member users, or may be initially allocated as a default weighting. The rating for the event is determined at least partially based on the feedback data, and may also be based on the member user weighting of the member user who submitted the feedback data. The rating may be determined or adjusted by feedback data and respective member user weightings received from other member users. An event may be a broadcast, concert, exhibition, tour, show, movie, competition, party, and/or function.

Providing rating information for an event based on user feedback

A method/system for restricting recordal of user activity in a processing system. In one form, the method comprises intercepting a kernel API call of the processing system, determining if a process initiating the kernel API call is malicious, and in response to a positive determination, terminating the determined process. A table can be updated with request information of the process and it can be determined if a trend of requests exists for the status of the input device, and in response to a positive determination of a trend, the process may be terminated.

Restricting recordal of user activity in a processing system

A method of configuring a processing system to perform application setting activity using a removable storage device in data communication with the processing system includes a) selecting an application, where setting activity associated with the selected application is to be performed using the removable storage device, b) installing, in the processing system, an interception module to intercept application setting activity associated with the selected application; and c) in response to the interception module intercepting application setting activity associated with the selected application, performing the application setting activity using the removable storage device, thereby storing application setting data associated with the selected application in the removable storage device.

Performing application setting activity using a removable storage device

A method/system/computer program for obtaining the network origin of a downloaded entity of interest (e.g. a threat or malicious software). The method includes recording the network locations of at least some files downloaded to a processing system and recording the physical locations of the at least some files stored in one or more storage devices of the processing system. Then, identifying an entity of interest in the processing system and searching the recorded network locations and the recorded physical locations for the network location and the physical location of the entity of interest. Then, if the network location and the physical location of the entity of interest is identified, transmitting the network location and the physical location of the entity of interest to a remote processing system.

Obtaining network origins of potential software threats

A method, system, computer program product and/or computer readable medium of instructions for detecting if a processing system has been compromised with audio/visual threat. The method comprises steps of intercepting one or more requests to perform an activity associated with an audio and/or visual communication device of the processing system; and performing a behavioural analysis of the processing system to determine if the processing system exhibits behavioural characteristics indicative of the processing system having been compromised with an audio/visual threat.

Detecting an audio/visual threat

A method, system and computer program product for detecting a malicious entity in a processing system. The method () comprises booting the processing system into a boot module prior to loading an operating system (); and detecting, using the boot module, if the processing system comprises a malicious entity ().

Method and system to detect malicious software

A method, system, computer program product and/or computer readable medium of instructions for detecting malicious software, comprising intercepting a request to perform an activity in a processing system; determining an entity associated with the activity, wherein the entity comprises at least one of: a requesting entity of the activity; and a target entity of the activity; analysing the entity and the activity to determine if the request is associated with malicious software; and in the event that the request is determined to be associated with malicious software, restricting the request to perform the activity in the processing system.

Real time malicious software detection

A method, system and computer program product for scanning firmware of a processing system for malware. The method () comprises obtaining a copy of firmware stored in the processing system (); and analysing the copy of the firmware to determine if the firmware has been modified or infected by malware ().

Method and system to scan firmware for malware

A method, system, computer program product, and/or computer readable medium of instructions for identifying a malicious entity in a processing system, comprising determining an entity threat value for an entity, the entity threat value being indicative of a level of threat that the entity represents to the processing system, wherein the entity threat value is determined based on one or more characteristics of the entity; and compare the entity threat value to an entity threat threshold to identify if the entity is malicious. In another form, there is provided a method, system, computer program product, and/or computer readable medium of instructions for identifying a malicious entity in a processing system, comprising determining one or more input values indicative of an entity; and performing a fuzzy logic analysis in relation to the one or more input values to identify if the entity is malicious.

Growing community of inventors

Sunrise Beach, Australia

Rolf Repasi