Generic method for detecting attack programs hidden in data chains
AssigneeFrance Telecom
InventorsHerve Debar, Dominique Assing, Benjamin Morin
Life of this patent
Estimating the term…
Abstract
This invention concerns a method for processing computer system input data including at least one detection step for a specific word INSTR present among said data. In the method according to the invention, the specific word to be detected represents an instruction necessary for the execution of a program present among said data. Because it focuses detection on the means necessary for the execution of an attack program that thus reveal the presence of said program, the invention can be used to simply and effectively detect different types of attacks.
Claims7
A method for processing input data of a computer system for detecting a polymorphic attack program, the method comprising;
- a first step of monitoring the input data to determine if said data contains a program having a decoder adapted to decode a series of encoded instructions, said series of encoded instructions being intended to produce a harmful effect when decoded and executed, and said program also having a specific word that corresponds to an instruction for generating a particular numerical value signaling the end of the decoder and being required to trigger the decoding of said series of encoded instructions by the decoder;
- a second step of searching for said specific word in said input data and;
- a third step of signaling the computer system of the presence of the polymorphic attack program in said input data to be flagged and analyzed by said computer system, when said specific word is detected.
Dependencies are inferred from the claim text.