Ying Lin

US Patent:

8402541, Mar 19, 2013

Filed:

Mar 12, 2009

Appl. No.:

12/402861

Inventors:

Cristian Craioveanu - Redmond WA, US
Ying Lin - Redmond WA, US
Peter Ferrie - Redmond WA, US
Bruce Dang - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 21/00

US Classification:

726 23, 726 22, 726 24, 726 25, 726 26, 726 27, 712233, 713188

Abstract:

Malware detection systems and methods for determining whether a collection of data not expected to include executable code is suspected of containing malicious executable code. In some embodiments, a malware detection system may disassemble a collection of data to obtain a sequence of possible instructions and determine whether the collection of data is suspected of containing malicious executable code based, at least partially, on an analysis of the sequence of possible instructions. In one embodiment, the analysis of the sequence of possible instructions may comprise determining whether the sequence of possible instructions comprises an execution loop. In a further embodiment, a control flow of the sequence of possible instructions may be analyzed. In a further embodiment, the analysis of the sequence of possible instructions may comprise assigning a weight that is indicative of a level of suspiciousness of the sequence of possible instructions. In a further embodiment, the sequence of possible instructions may begin with a possible instruction that comprises at least one candidate operation code (opcode) that has been determined to occur frequently in executable code.

US Patent:

20180004754, Jan 4, 2018

Filed:

Jan 14, 2015

Appl. No.:

15/543879

Inventors:

Ying LIN - Redmond WA, US
Mathias JOURDAIN - Redmond WA, US
Guang YANG - Redmond WA, US
- Redmond WA, US

Assignee:

MICROSOFT TECHNOLOGY LICENSING, LLC - Redmond WA

International Classification:

G06F 17/30

Abstract:

Examples of the present disclosure describe content creation of at least one abstract from extracted content. Input information is received that comprises a link to a landing page and keyword information. The landing page is evaluated and content including at least one of image data and text data is extracted from the landing page. Properties of the content extracted are analyzed. The content extracted is ranked based on the analyzed properties and application of at least two ranking algorithms. A first ranking algorithm applied ranks the content based on relevance to the landing page and a second ranking algorithm applied ranks the content extracted based on relevance to the keyword information. The ranked content is filtered to remove content or portions of content that are determined to be unappealing based on applying filtering rules to the ranked content. At least one abstract is created from the filtered and ranked content.