US5983348A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Computer network malicious code scanner
Assignee: Trend Micro Inc
•
Filing: 1997-09-10
•
Granted: 1999-11-09
•
Expires: 2017-09-10
Abstract
Abstract A network scanner for security checking of application programs (e.g. Java applets or Active X controls) received over the Internet or an Intranet has both static (pre-run time) and dynamic (run time) scanning. Static scanning at the HTTP proxy server identifies suspicious instructions and instruments them e.g. a pre-and-post filter instruction sequence or otherwise. The instrumented applet is then transferred to the client (web browser) together with security monitoring code. During run time at the client, the instrumented instructions are thereby monitored for security policy violations, and execution of an instruction is prevented in the event of such a violation.
Inventors
- 👤 Shuang Ji
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-02 14:33
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/563; G06F21/51; G06F21/52; G06F21/53; G06F21/54; G06F21/554; G06F21/566; H; H04; H04L; H04L63/00; H04L63/14; H04L63/1441; H04L63/145; H04L63/12; H04L63/123; H04L63/20
Claims Analysis
Total Claims: 44
Claim 1
Independent Claim
127 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction, wherein the altering includes inserting a first predefined call before the instruction and a second predefined call after the instruction; and wherein the first or second predefined call changes a session state of the application program.
Claim 2
Independent Claim
127 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction, wherein the altering includes inserting a first predefined call before the instruction and a second predefined call after the instruction; and wherein the first or second predefined call changes a session state of the application program.
Claim 3
Dependent Claim
14 words
The method of claim 1, further comprising associating monitoring code with the application program.
Claim 4
Dependent Claim
17 words
The method of claim 1, wherein the altering includes replacing the instruction with a predefined second instruction.
Claim 5
Dependent Claim
12 words
The method of claim 1, wherein the application program is an applet.
Claim 6
Dependent Claim
13 words
The method of claim 4, wherein the applet is in the Java language.
Claim 7
Dependent Claim
15 words
The method of claim 1, wherein the computer network is an Intranet or the Internet.
Claim 8
Dependent Claim
18 words
The method of claim 1 wherein the first predefined call is a call to check a security policy.
Claim 9
Dependent Claim
13 words
The method of claim 7, wherein the security policy is a state machine.
Claim 10
Dependent Claim
25 words
The method of claim 1, wherein the inserting is repeated for each instruction in the application program that is a member of the particular set.
Claim 11
Dependent Claim
20 words
The method of claim 1, wherein the particular set of instructions includes instructions that access a predefined set of files.
Claim 12
Dependent Claim
39 words
The method of claim 1, wherein the computer network includes a server and a client coupled to the server, and wherein the altering takes place at the server, wherein the executing the application program takes place at the client.
Claim 13
Dependent Claim
11 words
The method of claim 1, wherein the instructions are problematic instructions.
Claim 14
Dependent Claim
17 words
The method of claim 1, wherein the application program is altered at the point of the instruction.
Claim 15
Independent Claim
111 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; determining if the application program includes an authentication; verifying the authentication; and replacing the verified authentication with a second authentication.
Claim 16
Independent Claim
111 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; determining if the application program includes an authentication; verifying the authentication; and replacing the verified authentication with a second authentication.
Claim 17
Independent Claim
129 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; providing all dependency files associated with the application program; providing a single monitoring package performing the step of determining for the application program and its associated dependency files; and executing the application program and its associated dependency files.
Claim 18
Independent Claim
129 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; providing all dependency files associated with the application program; providing a single monitoring package performing the step of determining for the application program and its associated dependency files; and executing the application program and its associated dependency files.
Claim 19
Dependent Claim
126 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instructions; wherein the instrumenter inserts a first predefined call before the instruction and a second predefined call after the instruction; and wherein the first or second predefined call changes a session state of the application program.
Claim 20
Dependent Claim
126 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instructions; wherein the instrumenter inserts a first predefined call before the instruction and a second predefined call after the instruction; and wherein the first or second predefined call changes a session state of the application program.
Claim 21
Dependent Claim
17 words
The scanner of claim 16, further comprising a packer which associates monitoring code with the application program.
Claim 22
Dependent Claim
16 words
The scanner of claim 16, wherein the instrumenter replaces the instruction with a predefined second instruction.
Claim 23
Dependent Claim
12 words
The scanner of claim 16, wherein the application program is an applet.
Claim 24
Dependent Claim
13 words
The scanner of claim 19, wherein the applet is in the Java language.
Claim 25
Dependent Claim
15 words
The scanner of claim 16, wherein the computer network is an Intranet or the Internet.
Claim 26
Dependent Claim
18 words
The scanner of claim 16, wherein the first predefined call is a call to check a security policy.
Claim 27
Dependent Claim
13 words
The scanner of claim 22, wherein the security policy is a state machine.
Claim 28
Dependent Claim
26 words
The scanner of claim 16, wherein the instrumenter repeats the inserting for each instruction in the application program that is a member of the particular set.
Claim 29
Dependent Claim
20 words
The scanner of claim 16, wherein the particular set of instructions includes instructions that access a predefined set of files.
Claim 30
Dependent Claim
42 words
The scanner of claim 16, wherein the computer network includes a server and a client coupled to the server, wherein the altering by the instrumenter takes place at the server, and wherein the executing the application program takes place at the client.
Claim 31
Dependent Claim
18 words
The scanner of claim 16, wherein the instructions that are members of the particular set are problematic instructions.
Claim 32
Dependent Claim
15 words
The scanner of claim 16, wherein the alteration is at the point of the instruction.
Claim 33
Dependent Claim
118 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; a verifier which determines if the application program includes an authentication and verifies the authentication; and a signer which replaces the verified authentication with a second authentication.
Claim 34
Dependent Claim
118 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; a verifier which determines if the application program includes an authentication and verifies the authentication; and a signer which replaces the verified authentication with a second authentication.
Claim 35
Dependent Claim
123 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; a prefetcher which fetches all dependency files associated with the application program; and a security policy generator which provides a single monitoring package for the application program and its associated dependency files.
Claim 36
Dependent Claim
123 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; a prefetcher which fetches all dependency files associated with the application program; and a security policy generator which provides a single monitoring package for the application program and its associated dependency files.
Claim 37
Independent Claim
132 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; wherein the computer network includes a server and a client coupled to the server, and wherein the altering takes place at the server, wherein the executing the application program takes place at the client; and performing the monitoring at the client.
Claim 38
Independent Claim
132 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction; wherein the computer network includes a server and a client coupled to the server, and wherein the altering takes place at the server, wherein the executing the application program takes place at the client; and performing the monitoring at the client.
Claim 39
Independent Claim
114 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction, and carrying out the method for each of a plurality of application programs as each application program is provided from the computer network.
Claim 40
Independent Claim
114 words
A method of detecting and preventing execution of instructions in an application program provided from a computer network, comprising: providing the application program over the computer network; determining whether the provided application program includes any instructions that are members of a particular set of instructions; executing the application program if it is determined that no members of the set are included in the application program; if it is determined that an instruction is a member of the set, then altering the application program, thereby allowing monitoring of execution of the instruction, and carrying out the method for each of a plurality of application programs as each application program is provided from the computer network.
Claim 41
Dependent Claim
137 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; wherein the computer network includes a server and a client coupled to the server, wherein the altering by the instrumenter takes place at the server, and wherein the executing the application program takes place at the client; and wherein the monitoring is performed at the client.
Claim 42
Dependent Claim
137 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; wherein the computer network includes a server and a client coupled to the server, wherein the altering by the instrumenter takes place at the server, and wherein the executing the application program takes place at the client; and wherein the monitoring is performed at the client.
Claim 43
Dependent Claim
113 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; and wherein the instrumenter alters each of a plurality of application programs as each application program is provided from the computer network.
Claim 44
Dependent Claim
113 words
A scanner for detecting and preventing execution of instructions in an application program provided from a computer network, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing execution of the application program if it is determined that no members of the set are included in the application program; and comprising: an instrumenter which alters the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction; and wherein the instrumenter alters each of a plurality of application programs as each application program is provided from the computer network.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-11-08 | 2003-05-10 | 2003-11-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-11-08 | 2007-05-10 | 2007-11-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-11-08 | 2011-05-10 | 2011-11-09 | $7700.00 | Window Closed / Lapsed |