Patents by Inventor Mohamed Al Sharnouby

Mohamed Al Sharnouby has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Anomaly detection using sequences of system calls
    Patent number: 10656981
    Abstract: Systems and methods of detecting a call sequence anomaly in a message-based operating system are provided. A message may be received that indicates a programmatic procedure of an operating system was invoked. The message may include a programmatic procedure identifier, a sender process identifier, and a receiver process identifier. An invocation hash may be generated based on the message. The invocation hash may be translated to a smaller invocation identifier. The invocation identifier may be included in a translated call sequence that comprises invocation identifiers for a series of invocations. Depending on whether the translated call sequence is included in previously generated predetermined call sequences, the translated call sequence may be determined as an anomaly or not an anomaly.
    Type: Grant
    Filed: March 25, 2019
    Date of Patent: May 19, 2020
    Assignee: BlackBerry Limited
    Inventor: Mohamed Al Sharnouby
  • ANOMALY DETECTION USING SEQUENCES OF SYSTEM CALLS
    Publication number: 20190220334
    Abstract: Systems and methods of detecting a call sequence anomaly in a message-based operating system are provided. A message may be received that indicates a programmatic procedure of an operating system was invoked. The message may include a programmatic procedure identifier, a sender process identifier, and a receiver process identifier. An invocation hash may be generated based on the message. The invocation hash may be translated to a smaller invocation identifier. The invocation identifier may be included in a translated call sequence that comprises invocation identifiers for a series of invocations. Depending on whether the translated call sequence is included in previously generated predetermined call sequences, the translated call sequence may be determined as an anomaly or not an anomaly.
    Type: Application
    Filed: March 25, 2019
    Publication date: July 18, 2019
    Applicant: 2236008 Ontario Inc.
    Inventor: Mohamed AL SHARNOUBY
  • Anomaly detection using sequences of system calls
    Patent number: 10241847
    Abstract: Systems and methods of detecting a call sequence anomaly in a message-based operating system are provided. A message may be received that indicates a programmatic procedure of an operating system was invoked. The message may include a programmatic procedure identifier, a sender process identifier, and a receiver process identifier. An invocation hash may be generated based on the message. The invocation hash may be translated to a smaller invocation identifier. The invocation identifier may be included in a translated call sequence that comprises invocation identifiers for a series of invocations. Depending on whether the translated call sequence is included in previously generated predetermined call sequences, the translated call sequence may be determined as an anomaly or not an anomaly.
    Type: Grant
    Filed: July 19, 2016
    Date of Patent: March 26, 2019
    Assignee: 2236008 Ontario Inc.
    Inventor: Mohamed Al Sharnouby
  • NON-COUPLED SOFTWARE LOCKSTEP
    Publication number: 20180089059
    Abstract: Systems and methods of detecting a difference in behavior of processes are provided.
    Type: Application
    Filed: September 1, 2017
    Publication date: March 29, 2018
    Applicant: 2236008 Ontario Inc.
    Inventors: Patrick Christopher Lee, Mohamed Al Sharnouby
  • ANOMALY DETECTION USING SEQUENCES OF SYSTEM CALLS
    Publication number: 20180024874
    Abstract: Systems and methods of detecting a call sequence anomaly in a message-based operating system are provided. A message may be received that indicates a programmatic procedure of an operating system was invoked. The message may include a programmatic procedure identifier, a sender process identifier, and a receiver process identifier. An invocation hash may be generated based on the message. The invocation hash may be translated to a smaller invocation identifier. The invocation identifier may be included in a translated call sequence that comprises invocation identifiers for a series of invocations. Depending on whether the translated call sequence is included in previously generated predetermined call sequences, the translated call sequence may be determined as an anomaly or not an anomaly.
    Type: Application
    Filed: July 19, 2016
    Publication date: January 25, 2018
    Inventor: Mohamed Al Sharnouby