08601322 is referenced by 9 patents and cites 56 patents.

Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.

Title
Methods, media, and systems for detecting anomalous program executions
Application Number
13/301741
Publication Number
8601322 (B2)
Application Date
November 21, 2011
Publication Date
December 3, 2013
Inventor
Stylianos Sidiroglou
Astoria
NY, US
Angelos D Keromytis
New York
NY, US
Salvatore J Stolfo
Ridgewood
NJ, US
Agent
Byrne Poh
Assignee
The Trustees of Columbia University in the City of New York
NY, US
IPC
G06F 11/00
View Original Source