# US 2014/0157411 A1 · Safety protection method and safety protection device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157411 A1
- Document ID: US20140157411A1
- Status: Published application
- Kind: A1
- Application number: 13/716,217
- Filed: 2012-12-17
- Published: 2014-06-05
- Earliest claimed: 2012-12-03
- Assignees: Institute for Information Industry
- Applicants: Institute for Information Industry
- Inventors: Wei-Chao HSU; Fu-Hau HSU; Chieh-Wen CHEN; Ju-Hsuan HE
- Web page: https://patentgrep.com/patent/US20140157411A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A safety protection method which is performed with a controller includes steps of providing an index table, calling one of the APIs (API), filtering the called API based on a predetermined condition, and blocking the API if the API confirms the predetermined condition. Furthermore, a safety protection device is also disclosed herein.

## Claims

### Claim 1

A safety protection method, wherein the safety protection method is implemented by a controller and comprises:
providing an index table, wherein the index table records a plurality of positions where a plurality of Application Programming Interfaces (API) is stored in a storing device;
calling one of the APIs;
filtering the called API according to a predetermined condition; and
blocking the called API if the called API conforms the predetermined condition.

### Claim 2 (depends on 1)

The safety protection method according to claim 1, wherein the predetermined condition comprises a condition of the called API being corresponding to a protected process.

### Claim 3 (depends on 1)

The safety protection method according to claim 1, wherein the predetermined condition comprises a condition of the called API being used to amend or terminate a protected process.

### Claim 4 (depends on 1)

The safety protection method according to claim 1, wherein the predetermined condition comprises a condition of the called API being corresponding to a protected Dynamic Link Library (DLL).

### Claim 5 (depends on 1)

The safety protection method according to claim 1, wherein the predetermined condition comprise condition of the called API being used to uninstall a protected DLL.

### Claim 6 (depends on 1)

The safety protection method according to claim 1, wherein the predetermined condition comprises a condition of the called API being used to amend an API of a registry.

### Claim 7

A safety protection device, wherein the safety protection device stores an index table therein, and the index table records a plurality of positions where a plurality of APIs is stored, and wherein the safety protection device comprises:
an interceptor, wherein when one of the APIs is called, the interceptor is configured to hook the called API;
a filter being configured to filter the called API according to a predetermined condition; and
a blocker being configured to block the called API if the called API conforms the predetermined condition.

### Claim 8 (depends on 7)

The safety protection device according to claim 7, wherein the predetermined condition comprises a condition of the called API being corresponding to a protected process.

### Claim 9 (depends on 7)

The safety protection device according to claim 7, wherein the predetermined condition comprises condition of the called API being used to amend or terminate a protected process.

### Claim 10 (depends on 7)

The safety protection device according to claim 7, wherein the predetermined condition comprises a condition of the called API being corresponding to a protected DLL.

### Claim 11 (depends on 7)

The safety protection device according to claim 7, wherein the predetermined condition comprises a condition of the called API being used to uninstall a protected DLL.

### Claim 12 (depends on 7)

The safety protection device according to claim 7, wherein the predetermined condition comprises a condition of the called API being used to amend an API of a registry.