Method and system for indicating an executable as trojan horse
US7603614B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | May 13, 2003 |
| Grant date | Oct 13, 2009 |
| Priority date | — |
| Expiry date | May 13, 2023 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG11C2029/0411
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A method and system for indicating an executable as Trojan Horse, based on the CRC values of the routines of an executable. The method comprising a preliminary stage in which the CRC values of the routines of known Trojan Horses are gathered in a database, and a stage in which indicating an executable as Trojan Horse is carried out by the correspondence of the CRC values of the routines of said executable to the CRC values of the known Trojan Horses, as gathered in said database. The system comprising means for calculating the CRC values of routines; means for identifying the borders of the routines of an executable; a database system, for storing the CRC values of routines of known Trojan Horses; and means for determining the correspondence between two groups of CRC values, thereby enabling detection of the correspondence of an executable to at least one known Trojan Horse.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.