Title: Methods, media, and systems for detecting attack on a digital processing device

Abstract

Methods, media, and systems for detecting attack are provided. In some embodiments, the methods include: comparing at least part of a document to a static detection model; determining whether attacking code is included in the document based on the comparison of the document to the static detection model; executing at least part of the document; determining whether attacking code is included in the document based on the execution of the at least part of the document; and if attacking code is determined to be included in the document based on at least one of the comparison of the document to the static detection model and the execution of the at least part of the document, reporting the presence of an attack. In some embodiments, the methods include: selecting a data segment in at least one portion of an electronic document; determining whether the arbitrarily selected data segment can be altered without causing the electronic document to result in an error when processed by a corresponding program; in response to determining that the arbitrarily selected data segment can be altered, arbitrarily altering the data segment in the at least one portion of the electronic document to produce an altered electronic document;more » and determining whether the corresponding program produces an error state when the altered electronic document is processed by the corresponding program. « less

Inventors:

Stolfo, Salvatore J.; Li, Wei-Jen; Keromytis, Angelos D.; Androulaki, Elli

Issue Date:

2017-02-21

Research Org.:

Pacific Northwest National Lab. (PNNL), Richland, WA (United States)

Sponsoring Org.:

USDOE

OSTI Identifier:

1344482

Patent Number(s):

9576127

Application Number:

14/336,649

Assignee:

The Trustees of Columbia University in the City of New York

Patent Classifications (CPCs):

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

Show more

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

G06F21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
G06F21/562 - {Static detection}
G06F21/50 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
G06F21/566 - {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}

Show less

DOE Contract Number:  

AC05-76RL01830

Resource Type:

Patent

Resource Relation:

Patent File Date: 2014 Jul 21

Country of Publication:

United States

Language:

English

Subject:

99 GENERAL AND MISCELLANEOUS; 97 MATHEMATICS AND COMPUTING