Patents
Literature
Patsnap Copilot is an intelligent assistant for R&D personnel, combined with Patent DNA, to facilitate innovative research.
Patsnap Copilot

37results about How to "Efficient and scalable" patented technology

Detection method for APTs (Advanced Persistent Threat) based on instruction monitoring

The invention discloses a detection method for APTs (Advanced Persistent Threat) based on instruction monitoring. The method is characterized in that identification for virtual machine execution behaviors on an Hypervisor level is realized through an ExKVM and a virtual machine introspection library LibVMI, monitoring outside a virtual machine for an operating state of a malicious code in the virtual machine is realized and vulnerability exploitation attacks are discovered by use of a dynamic offline taint analysis method; monitoring for a user-layer API and kernel-layer API execution is carried out without an invasion by use of a #BP address injection method outside the virtual machine; and tracking for kernel stack allocation is realized through the injection of the kernel memory allocation function and the kernel module structure operating function of Windows. The offline taints are analyzed and the malicious behaviors are discovered through tracking and recording write, exchange and branch instructions between a memory and a register during the malicious code execution. According to the invention, the vulnerability exploitation during the APT attack can be monitored effectively and the detection rate of malicious samples is improved.
Owner:CHINA ELECTRONICS TECH CYBER SECURITY CO LTD
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products