1.-11. (canceled)
12. A method of performing for performing data-dependent MSMS analysis in a mass spectrometer, comprising:
acquiring an MS spectrum of ions generated from a sample;
identifying a plurality of precursor ion species for MSMS analysis based on the acquired MS spectrum;
sorting the plurality of precursor ion species according to at least one parameter to produce an ordered list of precursor ion species, the at least one parameter selected from the group consisting of charge state and mass-to-charge ratio; and
acquiring MSMS spectra of the precursor ion species in the sequence of the ordered list.
13. The method of claim 12, wherein the step of identifying a plurality of precursor ion species includes identifying the precursor ion species based on ion intensities in the MS spectrum.
14. The method of claim 12, wherein the step of acquiring an MS spectrum is performed at a first mass analyzer, and the step of acquiring MSMS spectra is performed at a second mass analyzer.
15. A method of performing mass spectrometry analysis in a mass spectrometer instrument having an ion store for accumulating a desired population of ions for subsequent analysis, and a mass analyzer for acquiring a mass spectrum of ions, the accumulation and acquisition operations occurring concurrently, the method comprising:
setting an ideal target population and a minimum target population;
identifying a plurality of ion species to be analyzed in an ordered sequence;
determining an analysis time for each of at least a subset of the plurality of precursor ion species, the analysis time being the total time required to complete an analysis cycle for acquisition of a mass spectrum;
calculating, for each of at least a subset of the plurality of ion species, an injection time based on the analysis time of a preceding ion species in the ordered sequence, the injection time yielding a population of the ion species that lies between the minimum target population and the ideal target population; and
accumulating each ion species in the ion store for the corresponding calculated injection time.
16. The method of claim 15, wherein the step of setting the ideal target population and the minimum target population includes receiving operator input representative of at least one of the ideal and minimum target populations.
17. A method of performing mass spectrometry analysis in a mass spectrometer instrument having an ion store for accumulating a desired population of ions for subsequent analysis, and a mass analyzer for acquiring a mass spectrum of ions, the accumulation and mass analysis operations occurring concurrently, the method comprising:
identifying a plurality of ion species to be analyzed;
determining, for each one of the plurality of ion species, an associated injection time and an analysis time;
constructing an ordered list of ion species by matching the analysis time of each of at least a subset of the plurality ion species to the injection time of another one of the ion species; and
performing repeated operations of concurrently accumulating in the ion store the Nth ion species on the ordered list and mass analyzing the N\u22121th ion species on the ordered list.
18. The method of claim 17, wherein the step of constructing an ordered list of ion species comprises:
repeatedly performing steps of:
selecting the ion species that has been most recently assigned to the ordered list;
identifying, from the group of ion species that have not yet been assigned to the ordered list, a next ion species having an injection time that most closely matches the analysis time of the selected ion species; and
assigning the identified next ion species to the ordered list after the selected ion species;
wherein the first ion species on the ordered list is selected by application of an intensity criterion.
19. The method of claim 17, wherein the step of constructing an ordered list of ion species comprises applying a travelling salesman algorithm.
20. A method of performing mass spectrometry analysis in a mass spectrometer instrument having an ion store for accumulating a desired population of ions for subsequent analysis, and a mass analyzer for acquiring a mass spectrum of ions, the accumulation and mass analysis operations occurring concurrently, the method comprising:
identifying a plurality of ion species to be analyzed;
constructing an ordered list of ion species;
determining, for each of at least a subset of ion species on the ordered list, an associated injection time; and
performing repeated operations of concurrently accumulating in the ion store the Nth ion species on the ordered list and mass analyzing the N\u22121th ion species on the ordered list; wherein at least one mass analysis parameter employed for mass analyzing the N\u22121th species is adjusted to match an analysis time of the N\u22121th ion species to the injection time of the Nth ion species.
21. The method of claim 20, wherein the mass analyzer is an orbital electrostatic trap, and the at least one mass analysis parameter is the transient duration.
22. The method of claim 20, wherein the mass analyzer is a two-dimensional quadrupole ion trap, and the at least one mass analysis parameter is the scan rate.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A method for detecting sources that are accessible over a network and which install spyware or other undesired content, comprising the steps of:
(a) producing a virtual machine on a computing device and installing an operating system on the virtual machine to create a virtual machine environment useful for testing a potential source accessible on the network, which may at least attempt to install spyware on the computing device of a user;
(b) automatically loading a potential source available on the network, within the virtual machine environment; and
(c) determining if the potential source has at least attempted to install spyware in the virtual machine environment.
2. The method of claim 1, wherein the potential sources include a Web page component that is capable of being rendered by a browser program, and wherein the step of loading the potential source within the virtual machine environment comprises the steps of:
(a) executing a browser program within the virtual machine environment;
(b) requesting the page that may comprise one of the potential sources from a remote site on the network using the browser program;
(c) loading the page into the browser program so that it is rendered;
(d) detecting any of a plurality of predefined triggers that are fired as a result of the page being loaded into the browser program and rendered; and
(e) if any of the plurality of predefined triggers is detected, determining that the page is at least attempting to perform a drive-by attack in the virtual machine environment.
3. The method of claim 2, wherein if any of the plurality of predefined triggers is detected, further comprising the step of executing anti-spyware software within the virtual machine environment to perform a spyware scan of the virtual machine environment to test for a definitive indication that spyware has been installed in the virtual machine environment.
4. The method of claim 1, wherein the potential sources include an executable file, and wherein the step of loading the potential source within the virtual machine environment comprises the steps of:
(a) installing the executable file within the virtual machine environment; and
(b) analyzing the virtual machine environment after the executable file is installed, to determine if installation of the executable file has caused any attack to be made within the virtual machine environment, the attack comprising executable code that is installed by a piggy-backed software module included with the executable file.
5. The method of claim 4, wherein the step of installing the executable file comprises the step of employing heuristics to emulate a user navigating and making selections in an installation process carried out by the executable file, when the executable file is executed within the virtual machine environment.
6. The method of claim 4, wherein the step of analyzing the virtual machine environment comprises the steps of:
(a) installing and executing an anti-spyware software program within the virtual machine environment; and
(b) employing the anti-spyware software program to analyze the virtual machine environment using predefined criteria, to determine whether installation of the executable file has caused any spyware to be installed within the virtual machine environment.
7. The method of claim 1, further comprising the step of automatically searching the network to find potential sources that attempt to attack a computing device of a user.
8. The method of claim 7, wherein the step of searching the network comprises the step of employing a crawler program to access a plurality of sites on the network.
9. The method of claim 8, wherein the crawler program successively follows links on pages on a site, to access other pages and other sites over the network.
10. The method of claim 1, further comprising the step of retaining data identifying each potential source that was found to have at least attempted an attack within the virtual machine environment.
11. A machine readable memory medium having machine instructions stored thereon for carrying out the steps of claim 1.
12. A system for detecting sources that are accessible over a network and which at least attempt an attack, where the attack can include installing spyware or other undesired content, comprising:
(a) a computing device having a memory, and a processor coupled to the memory for executing machine instructions that are stored therein; and
(b) an interface coupling the computing device in communication with the network, wherein the machine instructions cause the processor to automatically carry out a plurality of functions using the interface to communicate over the network, including:
(i) creating a virtual machine environment in which to test potential sources found on the network to determine if they at least attempt an attack, the machine instructions also causing the processor to install a clean operating system within the virtual machine environment;
(ii) automatically loading a potential source accessed over the network into the virtual machine environment for testing; and
(iii) determining if the potential source has at least attempted an attack in the virtual machine environment.
13. The system of claim 12, wherein the machine instructions stored in the memory further cause the processor to:
(a) execute a browser program in the virtual machine environment;
(b) from a remote site, automatically download a page having a component that is capable of being rendered as part of the page by a browser program, wherein the component may comprise a potential source that may at least attempt an attack in the virtual machine environment, the page being loaded into and rendered in the browser program;
(c) detecting any of a plurality of predefined triggers that are fired as a result of the page being loaded into the browser program and rendered; and
(d) if any of the plurality of predefined triggers is detected, determining that the page is at least attempting a drive-by attack in the virtual machine environment.
14. The system of claim 13, wherein if any of the plurality of predefined triggers is detected, the machine instructions further cause the processor to execute anti-spyware software within the virtual machine environment to perform a spyware scan of the virtual machine environment and test for a definitive indication that spyware has been installed in the virtual machine environment during an attack.
15. The system of claim 12, wherein a potential source that may at least attempt to install spyware comprises an executable file, so that the machine language instructions cause the processor to:
(a) install the executable file within the virtual machine environment; and
(b) analyze the virtual machine environment after the executable file is installed to determine if installation of the executable file has caused any drive-by attack to be made in the virtual machine environment by the executable file.
16. The system of claim 14, wherein to install the executable file, the machine language instructions cause the processor to employ heuristics to emulate a user navigating and making selections in an installation process carried out by the executable file, when the executable file is executed within the virtual machine environment.
17. The system of claim 14, wherein to analyze the virtual machine environment, the machine language instructions cause the processor to:
(a) install and execute an anti-spyware software program within the virtual machine environment; and
(b) employ the anti-spyware software program to analyze the virtual machine environment using predefined criteria, to determine whether installation of the executable file has caused any spyware to also be installed within the virtual machine environment, wherein installation of spyware comprises an attack.
18. The system of claim 12, wherein execution of the machine instructions define a crawler program and further cause the processor to employ the crawler program to access a plurality of sites on the network to search the network for potential sources of an attack.
19. The system of claim 18, wherein execution of the machine instructions further cause the processor to employ the crawler program to successively follow links on pages on a site, to access other pages and other sites on the network.
20. The system of claim 12, wherein execution of the machine instructions further cause the processor to retain data in the memory that identify each potential source that was found to have at least attempted an attack in the virtual machine environment.
21. A method for detecting a potential source that may at least attempt an attack on a user’s computing device if downloaded from a site, the potential source being detected in real-time and on-the-fly, in response to a user attempting to access the potential source at the site over a network, the method comprising the steps of:
(a) producing a virtual machine on a computing device that is also coupled to the site, to create a virtual machine environment that is configured for testing whether a potential source may attempt an attack after the user accesses the Web site with the browser program of the user;
(b) detecting that the user has initiated downloading the potential source from the site and into the browser program of the user, and in response, automatically loading the potential source in the virtual machine environment before enabling a browser program of the user to fully access the potential source;
(c) determining if the potential source has at least attempted an attack in the virtual machine environment; and
(d) if the potential source has attempted an attack in the virtual machine environment, prohibiting the browser program of the user from fully accessing the potential source.
22. The method of claim 21, further comprising the step of enabling installation of a module in the browser program of the user, the module being configured to prohibit the browser program of the user from fully accessing the potential source, if the potential source has attempted an attack in the virtual machine environment.
23. The method of claim 21, wherein the user initiates downloading of a page into the browser program of the user, and wherein the page includes a component that is capable of being rendered by a browser program and which may at least attempt an attack, further comprising the steps of:
(a) executing a browser program within the virtual machine environment;
(b) loading the page into the browser program executed within the virtual machine environment so that the page is rendered in said browser program;
(c) detecting any of a plurality predefined triggers that are fired as a result of the page being loaded into and rendered in the browser program executed within the virtual machine environment, wherein the plurality of triggers are indicative that the page may be at least attempting an attack; and
(d) if any of the plurality of predefined triggers is detected, determining that the page is at least attempting to perform a drive-by attack in the virtual machine environment.
24. The method of claim 23, wherein the page is downloaded into a sandbox that is not immediately accessible by the browser program of the user, while being also downloaded into the browser program executed within the virtual machine environment, the page downloaded into the sandbox not being transferred and enabled to be rendered for display in the browser program of the user unless none of the plurality of predefined triggers is detected in the virtual machine environment.
25. The method of claim 23, wherein the virtual machine environment is installed on a centralized computing device accessible by a plurality of client computing devices over a network, further comprising the step of employing the centralized computing device as a proxy for connecting each client computing device to selected sites over the network.
26. The method of claim 25, further comprising the step of storing data for safe sources that have previously been downloaded and determined not to have attempted an attack, so that when the browser program of the user is subsequently used to initiate a download of one of the safe sources, the safe source is transferred to the browser program of the user from the stored data for use therein without checking the safe source again to determine if it attempts an attack.
27. The method of claim 26, further comprising the steps of:
(a) hashing each safe source that was found not to have attempted an attack;
(b) storing a hash value for the safe source with the data for the safe source;
(c) when the user subsequently initiates access of a site to again download a potential source with the browser program of the user, and if the potential source generally corresponds to one of the safe sources for which the data are stored, hashing the potential source to produce a hash value for the potential source;
(d) comparing the hash value stored with the data for the safe source with the hash value for the potential source;
(e) providing the safe source to the browser program of the user for use therein if the hash value of the potential source matches the hash value of the safe source; and otherwise,
(f) testing the potential source in the virtual machine environment to determine if the potential source at least attempts an attack in the virtual machine environment before enabling the browser program of the user to fully access the potential source.
28. The method of claim 23, wherein if any of the plurality of predefined triggers is detected, further comprising the step of executing an anti-spyware program within the virtual machine environment for confirming whether the Web page is a potential source of spyware.
29. The method of claim 21, wherein the user initiates downloading of an executable file from the Web site with the browser program of the user, wherein the executable file may be a potential source if it includes a piggy-backed module that may at least attempt an attack when the executable file is executed.
30. The method of claim 29, further comprising the steps of
(a) installing the executable file in the virtual machine environment; and
(b) analyzing the virtual machine environment after the executable file is installed within the virtual machine environment, to determine if installation of the executable file has caused an attack in the virtual machine environment.
31. The method of claim 30, wherein the step of prohibiting the browser program of the user from completing access of the potential source comprises the step of preventing the browser program of the user from completing downloading of the executable file from the Web site.
32. The method of claim 30, wherein the step of installing the executable file within the virtual machine environment comprises the step of employing heuristics to emulate a user navigating and making selections in an installation process carried out by the executable file, when the executable file is executed within the virtual machine environment.
33. The method of claim 30, wherein the step of analyzing the virtual machine environment comprises the steps of:
(a) installing and executing an anti-spyware software program within the virtual machine environment; and
(b) employing the anti-spyware software program to analyze the virtual machine environment using predefined criteria, to determine whether installation of the executable file has caused any spyware to also be installed within the virtual machine environment.
34. The method of claim 21, further comprising the step of retaining data identifying each potential source that was found to have at least attempted an attack in the virtual machine environment.
35. The method of claim 21, wherein the potential source includes a plurality of components, further comprising the step of enabling successive components to be downloaded for access by the browser program of the user after each component has been determined not to have attempted an attack in the virtual machine environment, so that access of the plurality of components by the browser program of the user is staged to occur as quickly as the component has been found to be safe for use by the browser program of the user.
36. A machine readable memory medium having machine instructions stored thereon for carrying out the steps of claim 21.
37. A system for detecting a potential source of an attack by a Web page component in real-time and on-the-fly, where the potential source is downloadable from a site, the system acting in response to a user attempting to access the potential source at the site over a network, comprising:
(a) a client computing device running a user environment;
(b) a network interface that couples to the site over the network;
(c) a memory in which machine instructions are stored; and
(d) a processor, which is coupled to the network interface, and the memory, the processor executing the machine instructions stored in the memory to carry out a plurality of functions, including:
(i) producing a virtual machine, the virtual machine running an operating system to provide a virtual machine environment that is separate from the user environment;
(ii) in response to the user attempting to access a potential source of an attack from within the user environment, downloading the potential source into the virtual machine environment for testing of the potential source on-the-fly, wherein the testing must be completed before full access of the potential source is allowed to complete in the user environment; and
(iii) if the potential source is found to have at least attempted an attack within the virtual machine environment, precluding completion of the full access of the potential source within the user environment.
38. The system of claim 37, wherein the potential source of attack comprises a Web page, the machine language instructions further causing the processor to detect firing of any of a plurality of triggers that are predefined, represent events, and are employed for enabling a determination of whether the potential source is at least attempting an attack within the virtual machine environment.
39. The system of claim 38, wherein the plurality of predefined triggers include at least two of:
(a) launching of a new process within the virtual machine environment;
(b) creating a new file;
(c) modifying an existing file; and
(d) modifying a registry of the operating system within the virtual machine environment.
40. The system of claim 38, wherein if any of the plurality of triggers has been fired, the machine language instructions further cause the processor to run an anti-spyware scan in the virtual machine environment, as a definitive test for spyware that has been installed by the prospective source, and enabling completion of the full access of the prospective source of spyware within the user environment only if the anti-spyware scan fails to detect spyware in the virtual machine environment.
41. The system of claim 37, wherein while the potential source of an attack is being tested in the virtual machine environment, the machine instructions further cause the processor to enable download of the potential source into the user environment, but not access thereof, to reduce a delay before access of the potential source within the user environment can be enabled.
42. The system of claim 37, wherein the potential source includes an executable file that may carry out an attack when the executable file is executed, the machine instructions causing the processor to download and execute the executable file within the virtual machine environment, so that any attempt to carry out an attack in the virtual machine environment can be detected, causing execution of the executable file in the user environment to be precluded.
43. The system of claim 42, wherein the machine instructions further cause the processor to employ heuristics that simulate interaction and input of a user during an installation process, when automatically installing the executable file in the virtual machine environment.
44. The system of claim 42, wherein the machine instructions further cause the processor to run an anti-spyware scan in the virtual machine environment, as a definitive test for spyware that has been installed by the prospective source, and to execution of the executable file within the user environment only if the anti-spyware scan fails to detect spyware in the virtual machine environment.
45. The system of claim 37, wherein the processor and memory are installed on a proxy computing device that links the client computing device to the site, the virtual machine environment being disposed on the proxy computing device, which controls access of the potential source by the user environment.
46. The system of claim 45, wherein the proxy computing device stores data concerning potential sources of an attack that were previously tested and found to be safe by virtue of not attempting an attack, so that an attempt to access a potential source that has previously been tested and found not to have at least attempted an attack within the virtual machine environment will cause the processor to enable immediate access of the data corresponding to the potential source, by the user environment.
47. The system of claim 46, wherein the proxy computing device stores a hash value for each potential source that was previously tested and found to be safe, and wherein the machine instructions further cause the processor to determine if the potential source that a user is attempting to access at a site on the network is unchanged from the corresponding potential source that was previously tested and found safe, by comparing hash values of the potential source being accessed by the user with that of the corresponding potential source found safe.
48. The system of claim 37, wherein the potential source includes a plurality of components, execution of the machine instructions further causing the processor to enable transmission of each component to the client computing device in a staged fashion, after the component has been tested by the processor and found not to have attempted any attack within the virtual machine environment, so that tested components of the potential source are successively available for use in the user environment as soon as each component is tested and found safe for use therein.
49. The system of claim 37, wherein the user environment is running a browser program for accessing the Web site, further comprising a software module that is adapted to install within the browser program running in the user environment, the software module being controlled in response to the testing of the potential source of spyware being carried out in the virtual machine environment and being capable of precluding the browser program running in the user environment from completing access of the potential source, if the testing indicates that the potential source may have at least attempted an attack within the virtual machine environment.