Computer network malicious code scanner
First Claim
1. A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising:
- providing the application program over the computer network;
determining whether the provided application program includes any instructions that are members of a particular set of instructions;
executing the application program if it is determined that no members of the set are included in the application program;
if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction, wherein the altering includes inserting a first predefined call before the instruction and a second predefined call after the instruction; and
wherein the first or second predefined call changes a session state of the application program.
2 Assignments
0 Petitions
Accused Products
Abstract
A network scanner for security checking of application programs (e.g. Java applets or Active X controls) received over the Internet or an Intranet has both static (pre-run time) and dynamic (run time) scanning. Static scanning at the HTTP proxy server identifies suspicious instructions and instruments them e.g. a pre-and-post filter instruction sequence or otherwise. The instrumented applet is then transferred to the client (web browser) together with security monitoring code. During run time at the client, the instrumented instructions are thereby monitored for security policy violations, and execution of an instruction is prevented in the event of such a violation.
-
Citations
34 Claims
-
1. A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising:
-
providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction, wherein the altering includes inserting a first predefined call before the instruction and a second predefined call after the instruction; and wherein the first or second predefined call changes a session state of the application program. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
-
-
14. A method of detecting and preventing execution of instructions in an application program provided from a computer network comprising:
-
providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; determining if the application program includes an authentication; verifying the authentication; and replacing the verified authentication with a second authentication.
-
-
15. A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising:
-
providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; providing all dependency files associated with the application program; providing a single monitoring package performing the step of determining for the application program and its associated dependency files; and executing the application program and its associated dependency files.
-
-
16. A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program;
- and comprising;
an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instructions; wherein the instrumenter inserts a first predefined call before the instruction and a second predefined call after the instruction; and wherein the first or second predefined call changes a session state of the application program. - View Dependent Claims (17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
- and comprising;
-
29. A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program;
- and comprising;
an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; a verifier which determines if the application program includes an authentication and verifies the authentication; and a signer which replaces the verified authentication with a second authentication.
- and comprising;
-
30. A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program;
- and comprising;
an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; a prefetcher which fetches all dependency files associated with the application program; and a security policy generator which provides a single monitoring package for the application program and its associated dependency files.
- and comprising;
-
31. A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising:
-
providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; wherein the computer network includes a server and a client coupled to the server, and wherein the altering takes place at the server, wherein the executing the application program takes place at the client; and performing the monitoring at the client.
-
-
32. A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising:
-
providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction, and carrying out the method for each of a plurality of application programs as each application program is provided from the computer network.
-
-
33. A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program;
- and comprising;
an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; wherein the computer network includes a server and a client coupled to the server, wherein the altering by the instrumenter takes place at the server, and wherein the executing the application program takes place at the client; and wherein the monitoring is performed at the client.
- and comprising;
-
34. A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program;
- and comprising;
an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; and wherein the instrumenter alters each of a plurality of application programs as each application program is provided from the computer network.
- and comprising;
Specification