The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Oct. 17, 2017

Filed:

Nov. 02, 2015
Applicant:

Fireeye, Inc., Milpitas, CA (US);

Inventors:

Osman Abdoul Ismael, Palo Alto, CA (US);

Dawn Song, San Francisco, CA (US);

Ashar Aziz, Coral Gables, FL (US);

Noah Johnson, Oakland, CA (US);

Prshanth Mohan, San Jose, CA (US);

Hui Xue, San Jose, CA (US);

Assignee:

FireEye, Inc., Milpitas, CA (US);

Attorney:
Primary Examiner:
Int. Cl.
CPC ...
G06F 21/00 (2013.01); G06F 11/36 (2006.01); G06N 99/00 (2010.01); G06F 21/54 (2013.01); G06F 21/57 (2013.01); G06F 21/56 (2013.01); G06F 21/53 (2013.01); H04L 29/06 (2006.01);
U.S. Cl.
CPC ...
G06F 11/3604 (2013.01); G06F 11/3612 (2013.01); G06F 21/53 (2013.01); G06F 21/54 (2013.01); G06F 21/563 (2013.01); G06F 21/566 (2013.01); G06F 21/577 (2013.01); G06N 99/005 (2013.01); H04L 63/1433 (2013.01); G06F 2221/033 (2013.01);
Abstract

A method is described that includes receiving an application and generating a representation of the application that describes specific states of the application and specific state transitions of the application. The method further includes identifying a region of interest of the application based on rules and observations of the application's execution. The method further includes determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest. The method further includes enabling one or more monitors within the application's run time environment and applying the stimuli. The method further includes generating monitoring information from the one or more monitors. The method further includes applying rules to the monitoring information to determine a next set of stimuli to be applied to the application in pursuit of determining whether the region of interest corresponds to improperly behaving code.


Find Patent Forward Citations

Loading…