Method of detecting malicious code
US7131036B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Jul 2, 2001 |
| Grant date | Oct 31, 2006 |
| Priority date | — |
| Expiry date | Nov 11, 2022 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/56
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Malicious code in a code-executing device is detected by generating test data, which is substantially unsusceptible to compression without reducing its information content, and storing it as image data in memory external to the device. The test data is stored into memory of the device. A checksum calculation is performed on the test data stored in the memory of the device to generate a first checksum value. A corresponding checksum calculation is performed on the image data to generate a second checksum value. The first value is compared with the second value to determine whether or not the test data in the memory of the device has been corrupted. These steps are repeated until sufficient test data in the memory of the device is checksum tested to determine whether or not malicious code is present in the device. The malicious code is difficult to conceal itself from the checksums. Hence, it is possible to determine whether or not the device has been compromised.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.