1
William C Arnold, David M Chess, Jeffrey O Kephart, Steven R White: Automatic immune system for computers and computer networks. International Business Machines Corporation, Perman & Green, August 8, 1995: US05440723 (508 worldwide citation)

A method includes the following component steps, or some functional subset of these steps: (A) periodic monitoring of a data processing system (10) for anomalous behavior that may indicate the presence of an undesirable software entity such as a computer virus, worm, or Trojan Horse; (B) automatic s ...


2
William C Arnold, David M Chess, John F Morar, Alla Segal, Morton G Swimmer, Ian N Whalley, Steve R White: Method and apparatus for replicating and analyzing worm programs. International Business Machines Corporation, Rafael Perez Pineiro, Harrington & Smith, December 27, 2005: US06981279 (187 worldwide citation)

A system and a method are disclosed for dynamically analyzing software, some of whose potentially-important behaviors (such as worm-like behavior) may only be displayed when the software is executed in an environment where it has, or appears to have, access to a production network and/or to the glob ...


3
David M Chess, Gregory Bret Sorkin, Steve Richard White: System and method for protecting integrity of alterable ROM using digital signatures. International Business Machines Corporation, Perman & Green, September 1, 1998: US05802592 (181 worldwide citation)

A system and method for verifying the integrity of a computer system's BIOS programs stored in alterable read only memory (such as FLASH ROM), and preventing malicious alteration thereof. The system and method regularly check the contents of the alterable read only memory using a digital signature e ...


4
William C Arnold, David M Chess, John F Morar, Alla Segal, Ian N Whalley, Steve R White: Method and apparatus for the automatic determination of potentially worm-like behavior of a program. International Business Machines Corporation, Harrington & Smith PC, February 3, 2009: US07487543 (136 worldwide citation)

A method and system for the automatic determination of the behavioral profile of a program suspected of having worm-like characteristics includes analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like chara ...


5
David M Chess, Jeffrey O Kephart, Gregory B Sorkin: Automatic analysis of a computer virus structure and means of attachment to its hosts. International Business Machines Corporation, Robert Tassinari, Whitham Curtis Whitham & McGinn, January 16, 1996: US05485575 (132 worldwide citation)

Information pertaining to the verification of the identity of, and reversal of, a transformation of computer data is derived automatically based on a set of samples. The most important class of transformations is computer viruses. The process extracts this information for a large, fairly general cla ...


6
William C Arnold, David M Chess, John F Morar, Alla Segal, Ian N Whalley, Steve R White: Method and apparatus for the automatic determination of potentially worm-like behavior of a program. Trend Micro Incorporated, Okamoto & Benedicto, August 9, 2011: US07996905 (130 worldwide citation)

A method and system for the automatic determination of the behavioral profile of a program suspected of having worm-like characteristics includes analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like chara ...


7
David M Chess: Discrimination of malicious changes to digital information using multiple signatures. International Business Machines Corporation, Louis J Percello, Ronald L Drumheller, November 5, 1996: US05572590 (97 worldwide citation)

The present system and method uses information about digital information (objects) to determine whether or not changes to the objects were caused by a normal system operation or by a malicious program. The invention uses a reference separation algorithm to separate, at a reference time, one or more ...


8

9
David M Chess: System and method for generating trusted descriptions of information products. International Business Machines Corporation, David M Shofi Esq, McGinn & Gibb P C, February 15, 2000: US06026374 (71 worldwide citation)

A system and method using of a trusted third party to provide a description of an information product to potential buyers without disclosing the entire contents of the information products, which might compromise the interests of the seller. The buyer trusts the third party to give an accurate descr ...


10
William C Arnold, David M Chess, Jeffrey O Kephart, Gregory B Sorkin, Steve R White: Searching for patterns in encrypted data. International Business Machines Corporation, Robert P Tassinari, Whitham Curtis Whitham & McGinn, August 15, 1995: US05442699 (69 worldwide citation)

A searching method determines, given a specified encryption method (or set of encryption methods) and a specified pattern (or set of patterns), whether a given text contains an encryption, with any key, of anything fitting the pattern or patterns. The procedure detects and locates patterns that are ...