Detection of polymorphic script language viruses by data driven lexical analysis
First Claim
1. A method of detecting script language viruses in data streams comprising:
- preparing language description data corresponding to at least one script language;
preparing detection data for viral code corresponding to the script language virus; and
lexically analyzing a data stream using the language description data and the detection data to detect the viral code.
1 Assignment
0 Petitions
Accused Products
Abstract
A method and apparatus for detecting script language viruses is provided. The apparatus includes a script language processor, a detection data processor and a detection engine. The script language processor prepares language description data corresponding to at least one script language. The detection data processor prepares detection data for viral code corresponding to the script language virus. The detection engine lexically analyzes a data stream using the language description data and the detection data to detect the viral code. The language description data may correspond to language definition rules and language check rules. The data stream may be converted to a stream of tokens, wherein the lexical analysis is performed on the token stream. The script language virus detection apparatus may be a computer program stored on a computer readable medium and/or transmitted via a computer network or other transmission medium.
-
Citations
23 Claims
-
1. A method of detecting script language viruses in data streams comprising:
-
preparing language description data corresponding to at least one script language;
preparing detection data for viral code corresponding to the script language virus; and
lexically analyzing a data stream using the language description data and the detection data to detect the viral code. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 17, 18, 19, 20, 21, 22, 23)
-
-
13. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for detecting script language viruses, the method steps comprising:
-
preparing language description data corresponding to at least one script language;
preparing detection data for viral code corresponding to the script language virus; and
lexically analyzing a data stream using the language description data and the detection data to detect the viral code.
-
-
14. A computer system, comprising:
-
a processor; and
a program storage device readable by the computer system, tangibly embodying a program of instructions executable by the processor to perform method steps for detecting script language viruses, the method steps comprising;
preparing language description data corresponding to at least one script language;
preparing detection data for viral code corresponding to the script language virus; and
lexically analyzing a data stream using the language description data and the detection data to detect the viral code.
-
-
15. A computer data signal embodied in a transmission medium which embodies instructions executable by a computer for detecting a script language virus, comprising:
-
a first segment including script language processor code to prepare language description data corresponding to at least one script language;
a second segment including detection data processor code to prepare detection data for viral code corresponding to the script language virus; and
a third segment including detection engine code to lexically analyze a data stream using the language description data and the detection data to detect viral code.
-
-
16. An apparatus for detecting script language viruses, comprising:
-
a script language processor, wherein the script language processor prepares language description data corresponding to at least one script language;
a detection data processor, wherein the detection data processor prepares detection data for viral code corresponding to a script language virus; and
a detection engine, wherein the detection engine lexically analyzes a data stream using the language description data and the detection data to detect the viral code.
-
Specification