Abstract: The invention is a security system providing domain name authentication for intrusion and malware prevention. The system is configured to analyze domain names, specifically analyze network metadata associated with said domain names, and further identify domain names attempting to impersonate or spoof domain names associated with a trusted entity or party.

Abstract: The invention is a security system providing domain name authentication for intrusion and malware prevention. The system is configured to analyze domain names, specifically analyze network metadata associated with said domain names, and further identify domain names attempting to impersonate or spoof domain names associated with a trusted entity or party.

Abstract: Identifying a malicious web page that impersonates a legitimate web page, including extracting HMTL source and a certificate for a specified web page, parsing the extracted HTML to identify objects, forms, links, templates, images and logos embedded in the HTML, and determining whether or not the HTML source harvests user credentials. If the determining is negative, then marking the specified web page as clean. If the determining is affirmative, then verifying the origin and ownership of the extracted certificate by examining its digital signature to determine a possibility of an impersonation attempt, applying image recognition to the identified images and logos, and comparing the identified images and logos to known images and brand logos of the certificate owner. If the comparing is affirmative, then mark the web page as clean. If the comparing is negative, then mark the web page as suspicious and block the web page from being accessed.

Abstract: A method for protecting a computer, including receiving a data block, discovering code within the data block that can be disassembled for a machine instruction, building an execution path from the machine instructions, including parsing the machine instructions, and following the flow of the execution path, including conditional and unconditional branches of the machine instructions, validating an incremented location by scanning the execution path for machine instructions that increment a register that stores a location on the execution path, finding a self-modifying artifact by scanning remaining machine instructions in the execution path for an arithmetic or logic operation performed on a register that currently or previously held a location in the incremented location, finding a modified loop index by scanning remaining machine instructions in the execution path for registers that hold a loop value that is incremented or decremented, and blocking the data when finding the modified loop index.

Abstract: The invention is a security system providing domain name authentication for intrusion and malware prevention. The system is configured to analyze domain names, specifically analyze network metadata associated with said domain names, and further identify domain names attempting to impersonate or spoof domain names associated with a trusted entity or party.

Abstract: A method for protecting a computer, including receiving a data block, discovering code within the data block that can be disassembled for a machine instruction, building an execution path from the machine instructions, including parsing the machine instructions, and following the flow of the execution path, including conditional and unconditional branches of the machine instructions, validating an incremented location by scanning the execution path for machine instructions that increment a register that stores a location on the execution path, finding a self-modifying artifact by scanning remaining machine instructions in the execution path for an arithmetic or logic operation performed on a register that currently or previously held a location in the incremented location, finding a modified loop index by scanning remaining machine instructions in the execution path for registers that hold a loop value that is incremented or decremented, and blocking the data when finding the modified loop index.

Abstract: A method that includes receiving a data entity by the computer; storing the data entity in a first sector of the memory; wherein the first sector is isolated from another memory sector and executable code in the first sector is prevented from performing a write action to the other memory sector; generating, by the processor, an intermediate representation of the data entity; searching, by the processor, for an executable code that was not expected to be included in the data entity in the intermediate representation of the data entity; and when finding the executable code that was not expected to be included in the data entity then preventing a copying of the data entity to the other memory sector.

Abstract: A method that includes receiving a data entity by the computer; storing the data entity in a first sector of the memory; wherein the first sector is isolated from another memory sector and executable code in the first sector is prevented from performing a write action to the other memory sector; generating, by the processor, an intermediate representation of the data entity; searching, by the processor, for an executable code that was not expected to be included in the data entity in the intermediate representation of the data entity; and when finding the executable code that was not expected to be included in the data entity then preventing a copying of the data entity to the other memory sector.