×

Automatic analysis of a computer virus structure and means of attachment to its hosts

  • US 5,485,575 A
  • Filed: 11/21/1994
  • Issued: 01/16/1996
  • Est. Priority Date: 11/21/1994
  • Status: Expired due to Fees
First Claim
Patent Images

1. A method for automatically deriving verification and removal information for a function-preserving transformation of computer data from a set of untransformed data samples and corresponding transformed data samples, comprising the steps of:

  • obtaining a set of "sample pairs", each sample pair consisting of a transformed data sample and a corresponding original, untransformed data sample;

    locating one or more fragments of each original data sample within a corresponding transformed data sample to obtain a generalized description, applicable to each of the sample pairs, of locations of fragments of each original data sample and locations of new data regions added by the function-preserving transformation that applies to each of the sample pairs;

    matching new data regions added by the function-preserving transformation across different samples to obtain a description of portions of the new data regions that are "invariant" across different samples;

    locating within other, variable portions of the new data regions any data from an original data sample embedded there;

    generating a prescription for verifying with high confidence that any given data sample has resulted from an application of the function-preserving transformation; and

    generating a prescription for restoring a data sample that has been transformed by the function-preserving transformation to a form functionally equivalent to that prior to the transformation.

View all claims
  • 1 Assignment
Timeline View
Assignment View
    ×
    ×