Detection and identification methods for software
First Claim
Patent Images
1. A method for creating a superfingerprint for identifying a software comprising:
- executing said software at least once;
in each execution, selecting specified portions of at least one of said executing software and of results of executing said software;
in each execution, performing computations on said selected portions to obtain a collection of fingerprints; and
combining said collections of fingerprints found in each execution into the superfingerprint of said software according to a combining rule.
5 Assignments
0 Petitions
Accused Products
Abstract
Software is identified while in main memory by examining small portions of its executable image or by examining the results of its execution. These portions, or an encoding of them, are then compared with previously stored identifying information about at least one Software through an approximate matching process.
30 Citations
50 Claims
-
1. A method for creating a superfingerprint for identifying a software comprising:
-
executing said software at least once;
in each execution, selecting specified portions of at least one of said executing software and of results of executing said software;
in each execution, performing computations on said selected portions to obtain a collection of fingerprints; and
combining said collections of fingerprints found in each execution into the superfingerprint of said software according to a combining rule. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25)
-
-
26. A method for identifying a first software comprising the steps of:
-
storing previously created superfingerprints for at least one software;
executing said first software at least once;
selecting specified portions of at least one of said executing software and of the results of executing said software on each execution;
performing specified computations on said selected portions to obtain a collection of fingerprints;
comparing said collection of fingerprints to said previously computed superfingerprint of at least one second software to determine whether there is an approximate match; and
declaring said first software to be the same as said second software if an approximate match is found. - View Dependent Claims (27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48)
-
-
49. A method for identifying a software group of a first software comprising the steps of:
-
storing previously created superfingerprints for at least one software group;
executing said first software at least once;
selecting specified portions of said executing first software and of the results of executing said first software on each execution;
performing specified computations on said selected portions to obtain a collection of fingerprints;
comparing said collection of fingerprints to said previously computed superfingerprint of at least one second software group to determine whether there is an approximate match; and
declaring said first software to be a member of said second software group if an approximate match is found.
-
-
50. A method for identifying a software that is a member of a group of software comprising the steps of
storing previously created superfingerprints for at least one software group and for members of that group; -
executing said software at least once;
selecting specified portions of said executing software and of the results of executing said software on each execution;
performing computations on said selected portions to obtain a collection of fingerprints;
comparing said collection of fingerprints to said previously computed superfingerprint of at least one second software group and the superfingerprints of the members of said second software group to determine whether there is an approximate match with said group and at least one of said superfingerprints of said members of said group; and
declaring said software to be the same as a particular member of said second software group if an approximate match is found.
-
Specification