Microsoft Technology Licensing, LLC

Ying Lin

Guang Yang

Adrian Mihail Marinescu

Alexey A Polyakov

Jigar J Mody

Mathias Jourdain

Tony Lee

Cristian Craioveanu

Bruce Dang

Peter Ferrie

Examples of the present disclosure describe content creation of at least one abstract from extracted content. Input information is received that comprises a link to a landing page and keyword information. The landing page is evaluated and content including at least one of image data and text data is extracted from the landing page. Properties of the content extracted are analyzed. The content extracted is ranked based on the analyzed properties and application of at least two ranking algorithms. A first ranking algorithm applied ranks the content based on relevance to the landing page and a second ranking algorithm applied ranks the content extracted based on relevance to the keyword information. The ranked content is filtered to remove content or portions of content that are determined to be unappealing based on applying filtering rules to the ranked content. At least one abstract is created from the filtered and ranked content.

Content creation from extracted content

Malware detection systems and methods for determining whether a collection of data not expected to include executable code is suspected of containing malicious executable code. In some embodiments, a malware detection system may disassemble a collection of data to obtain a sequence of possible instructions and determine whether the collection of data is suspected of containing malicious executable code based, at least partially, on an analysis of the sequence of possible instructions. In one embodiment, the analysis of the sequence of possible instructions may comprise determining whether the sequence of possible instructions comprises an execution loop. In a further embodiment, a control flow of the sequence of possible instructions may be analyzed. In a further embodiment, the analysis of the sequence of possible instructions may comprise assigning a weight that is indicative of a level of suspiciousness of the sequence of possible instructions. In a further embodiment, the sequence of possible instructions may begin with a possible instruction that comprises at least one candidate operation code (opcode) that has been determined to occur frequently in executable code.

Proactive exploit detection

The present invention is directed to a method and system for automatically classifying an application into an application group which is previously classified in a knowledge base. More specifically, a runtime behavior of an application is captured as a series of events which are monitored and recorded during the execution of the application. The series of events are analyzed to find a proper application group which shares common runtime behavior patterns with the application. The knowledge base of application groups is previously constructed based on a large number of sample applications. The construction of the knowledge base is done in such a manner that each sample application can be classified into application groups based on a set of classification rules in the knowledge base. The set of classification rules are applied to a new application in order to classify the new application into one of the application groups.

Classification of malware using clustering that orders events in accordance with the time of occurance

Growing community of inventors

Sammamish, WA, United States of America

Ying Lin