System and method for protecting systems from malicious attacks
First Claim
1. A method of disarming malicious code in a computer system having a processor, the method comprising:
- receiving, by the computer system, input content; and
automatically applying, by the processor, a data value alteration model to the input content, the data value alteration model being configured to disarm malicious code included in the input content without interfering with an intended use of the input content and being applied without first detecting malicious code in the input content and without knowing a location of data units in the input content including malicious code, the data value alteration model including operations for;
selecting, by the processor, at least a portion of a plurality of data units included in the input content, the portion being determined randomly or pseudo-randomly based on the data value alteration model determining that at least one of the data units of the portion is statistically likely to include any malicious code; and
altering respective data values of the selected portion of the plurality of data units included in the input content.
1 Assignment
0 Petitions
Accused Products
Abstract
The disclosed embodiments include a method of disarming malicious code in a computer system having a processor. The method comprises receiving, by the computer system, input content, and rendering, by the processor, any malicious code included in the input content inactive for its intended malicious purpose without applying a malware detection algorithm to the input content. The rendering is performed by automatically applying, using the processor, a data value alteration model to the input content for altering select data values within the input content, and outputting a new content reflecting the application of the data value alteration model to the input content. The processor renders any malicious code included in the input content inactive for its intended malicious purpose without regard to any structure used to encapsulate the input content. The input content includes media content.
-
Citations
20 Claims
-
1. A method of disarming malicious code in a computer system having a processor, the method comprising:
-
receiving, by the computer system, input content; and automatically applying, by the processor, a data value alteration model to the input content, the data value alteration model being configured to disarm malicious code included in the input content without interfering with an intended use of the input content and being applied without first detecting malicious code in the input content and without knowing a location of data units in the input content including malicious code, the data value alteration model including operations for; selecting, by the processor, at least a portion of a plurality of data units included in the input content, the portion being determined randomly or pseudo-randomly based on the data value alteration model determining that at least one of the data units of the portion is statistically likely to include any malicious code; and altering respective data values of the selected portion of the plurality of data units included in the input content. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15)
-
-
16. A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform operations for disarming malicious code in a computer system, the operations comprising:
-
receiving input content; and automatically applying a data value alteration model to the input content, the data value alteration model being configured to disarm malicious code included in the input content without interfering with an intended use of the input content and being applied without first detecting malicious code in the input content and without knowing a location of data units in the input content including malicious code, and without regard to any structure used to encapsulate the input content, the data value alteration model including steps for; selecting at least a portion of a plurality of data units included in the input content, the portion being determined randomly or pseudo-randomly based on the data value alteration model determining that at least one of the data units of the portion is statistically likely to include any malicious code; and altering respective data values of the selected portion of the plurality of data units included in the input content. - View Dependent Claims (17)
-
-
18. A system for disarming malicious code, the system comprising:
-
a memory device storing a set of instructions; and a processor configured to execute the set of instructions to; receive input content; and automatically apply a data value alteration model to the input content, the data value alteration model being configured to disarm malicious code included in the input content without interfering with an intended use of the input content and being applied without first detecting malicious code in the input content and without knowing a location of data units in the input content including malicious code, the data value alteration model including operations for; selecting at least a portion of a plurality of data units included in the input content, the portion being determined randomly or pseudo-randomly based on the data value alteration model determining that at least one of the data units of the portion is statistically likely to include any malicious code; and altering respective data values of the selected portion of the plurality of data units included in the input content. - View Dependent Claims (19, 20)
-
Specification