Automatic analysis of a computer virus structure and means of attachment to its hosts
Patent 5485575 Issued on January 16, 1996. Estimated Expiration Date: 
November 21, 2014. Estimated Expiration Date is calculated based on simple USPTO term provisions. It does not account for terminal disclaimers, term adjustments, failure to pay maintenance fees, or other factors which might affect the term of a patent.
November 21, 2014. Estimated Expiration Date is calculated based on simple USPTO term provisions. It does not account for terminal disclaimers, term adjustments, failure to pay maintenance fees, or other factors which might affect the term of a patent.Patent ReferencesMethod for recovery of a computer program infected by a computer virus Method for securing software against corruption by computer viruses Patent #: 5359659 InventorsApplicationNo. 342949 filed on 11/21/1994US Classes:714/38, Of computer software713/188COMPUTER VIRUS DETECTION BY CRYPTOGRAPHYExaminersPrimary: Beausoliel, Robert W. Jr.Assistant: Chung, Phung M. Attorney, Agent or FirmInternational ClassG06F 011/34AbstractInformation pertaining to the verification of the identity of, and reversal of, a transformation of computer data is derived automatically based on a set of samples. The most important class of transformations is computer viruses. The process extracts this information for a large, fairly general class of viruses. Samples consisting of host programs infected with the virus and sample pairs consisting of an infected host and the corresponding original, uninfected host are obtained. A description of how the virus attaches to the host program, including locations within uninfected host of components of both the original host and the virus is generated. Viral code is matched across samples to obtain a description of "invariant" regions of the virus. Host bytes embedded within the virus are located. A description of the original host locations permits ant-virus software on a user's machine to restore the bulk of a program that has been infected. Characterization of the correspondence between invariable portions of the virus and destroyed parts of the host enables anti-virus software to complete the repair.Other References
| |
