STEVEN WHITE, AGPCNP-BC
Nursing at 23 St, New York, NY

5440723, Aug 8, 1995

Jan 19, 1993

8/004872

William C. Arnold - Mahopac NY
David M. Chess - Mohegan Lake NY
Jeffrey O. Kephart - Yorktown Heights NY
Steven R. White - New York NY

International Business Machines Corporation - Armonk NY

G06F 1100

395181

A method includes the following component steps, or some functional subset of these steps: (A) periodic monitoring of a data processing system (10) for anomalous behavior that may indicate the presence of an undesirable software entity such as a computer virus, worm, or Trojan Horse; (B) automatic scanning for occurrences of known types of undesirable software entities and taking remedial action if they are discovered; (C) deploying decoy programs to capture samples of unknown types of computer viruses; (D) identifying machine code portions of the captured samples which are unlikely to vary from one instance of the virus to another; (E) extracting an identifying signature from the executable code portion and adding the signature to a signature database; (F) informing neighboring data processing systems on a network of an occurrence of the undesirable software entity; and (G) generating a distress signal, if appropriate, so as to call upon an expert to resolve difficult cases. A feature of this invention is the automatic execution of the foregoing steps in response to a detection of an undesired software entity, such as a virus or a worm, within a data processing system. The automatic extraction of the identifying signature, the addition of the signature to a signature data base, and the immediate use of the signature by a scanner provides protection from subsequent infections of the system, and also a network of systems, by the same or an altered form of the undesirable software entity.

5907834, May 25, 1999

Mar 18, 1996

8/619866

Jeffrey Owen Kephart - Yorktown Heights NY
Gregory Bret Sorkin - New York NY
Gerald James Tesauro - Croton-on-Hudson NY
Steven Richard White - New York NY

International Business Machines Corporation - Armonk NY

G06F 1518, G06F 1100

706 20

A data string is a sequence of atomic units of data that represent information. In the context of computer data, examples of data strings include executable programs, data files, and boot records consisting of sequences of bytes, or text files consisting of sequences of bytes or characters. The invention solves the problem of automatically constructing a classifier of data strings, i. e. , constructing a classifier which, given a string, determines which of two or more class labels should be assigned to it. From a set of (string, class-label) pairs, this invention provides an automated technique for extracting features of data strings that are relevant to the classification decision, and an automated technique for developing a classifier which uses those features to classify correctly the data strings in the original examples and, with high accuracy, classify correctly novel data strings not contained in the example set. The classifier is developed using "adaptive" or "learning" techniques from the domain of statistical regression and classification, such as, e. g. , multi-layer neural networks.