1. A method of inspecting content intended for a workstation to inspect content that performs exploits, comprising:
receiving the content for inspection at an inspection server using a processor and memory
loading a virtual machine at the inspection server with an operating system and processes for inspecting the content, wherein the operating system and processes are similar to those executed at the intended workstation;
activating the content in the virtual machine; and,
tracing the activity of the virtual machine to form trace data by using features of the processor;
wherein upon occurrence of an exception control is transferred to an analyzer that analyzes the trace data based on a context of the exception; and a notification is provided if suspicious activity is detected.
2. A method according to claim 1, wherein the inspection server intercepts the content before being provided to the workstation.
3. A method according to claim 1, wherein the inspection server receives the content from the workstation.
4. A method according to claim 1, wherein the trace includes recording details of flow control instructions executed by the virtual machine.
5. A method according to claim 1, wherein the trace includes recording a list of modules inside processes executed by the virtual machine and the addresses of memory pages used by the modules.
6. A method according to claim 1, wherein the trace includes recording a page dump of memory pages used by modules of processes executed by the virtual machine when initializing the modules.
7. A method according to claim 1, wherein the trace includes recording a page dump of a memory page used by modules of processes executed by the virtual machine before starting to execute code from the memory page.
8. A method according to claim 1, wherein the exception includes a change in the executed page address due to transfer of control from one process to another by the operating system.
9. A method according to claim 1, wherein the exception includes receiving notification that a memory for storing details of flow control instructions executed by the virtual machine is full.
10. A method according to claim 1, wherein the exception includes receiving notification if the processor is set to execute code from a user mode memory page while the current privilege level of the processor is lower than 3.
11. A method according to claim 1, wherein the trace includes recording a page dump of a memory page wherein the page permission changed from-non executable to executable.
12. A method according to claim 1, wherein the exception includes receiving notification that the process crashed or that the operating system crashed.
13. A method according to claim 1, wherein the trace includes receiving a memory page marked as readwriteexecute and changing the memory page permissions in the shadow page table to readwrite; and,
if an attempt to execute code from the page occurs, then changing the memory age permissions in the shadow page table to readexecute and dumping the page content;
then, if an attempt to write to the page occurs changing the memory page permissions in the shadow page table to readwrite.
14. A method according to claim 1, wherein activity is suspicious if activation of the content leads to detection of jump oriented programming (JOP) patterns.
15. A method according to claim 1, wherein activity is suspicious if activation of the content leads to detection of return oriented programming (ROP) patterns.
16. A method according to claim 1, wherein activity is suspicious if activation of the content leads to a crash of the process or of the operating system in the virtual machine.
17. A method according to claim 1, wherein activity is suspicious if activation of the content leads to the processor being set to a different execution level than a memory page with the code being executed.
18. An inspection server for inspecting content intended for a workstation to detect content that performs malicious exploits, comprising:
a general purpose computer using a processor and memory to serve as the inspection server receiving the content for inspection;
a hypervisor application in the inspection server for loading a virtual machine with an operating system and processes, wherein the operating system and processes are similar to those executed at the intended workstation; and,
an analyzer application;
wherein the inspection server is programmed to activate the content and trace activity of the virtual machine to form trace data by using features of the processor; and upon occurrence of art exception the analyzer analyzes the trace data based on a context of the exception and notifies if suspicious activity is detected.
19. An inspection server according to claim 18, wherein the operating system is halted when the analyzer application is executed in the virtual machine.
20. A non-transitory computer readable medium comprising computer code to be executed by a general purpose computer for performing a method according to claim 1.
21. A method of detecting potentially malicious content, comprising:
identifying the content for inspection;
upon occurrence of an application processing the content on a processor, tracing the activity of the processor in order to form trace data, by using features of the processor;
upon occurrence of an exception, transferring control to an analyzer that detects suspicious activity according to the trace data based on a context of the exception;
22. A method according to claim 21, wherein identifying the content is performed by identifying attachments in email with potentially malicious file types.
23. A method according to claim 21, wherein identifying the content is performed by identifying content in data received from a web site with potentially malicious data types.
24. A method according to claim 21, wherein the trace includes recording details of flow control instructions executed by the workstation
25. A method according to claim 21, wherein the trace includes recording a list of Modules inside processes executed by the workstation and the addresses of memory pages used by the modules.
26. A method according to claim 21, wherein the trace includes recording a page dump of memory pages used by modules of processes executed by the workstation.
27. A method according to claim 21, wherein the trace includes recording a page dump of a memory page used by modules of processes executed by the workstation before starting to execute code from the memory page.
28. A method according to claim 21, wherein a notification is provided upon the detection of suspicious activity.
29. A method according to claim 21, wherein a virtual machine is loaded for activating the content.
30. A method according to claim 21, wherein an inspection server intercepts the content before being provided to a workstation.
31. A method according to claim 21, wherein an inspection server receives the content from a workstation.
32. A computer system for detecting potentially malicious content, comprising:
a storage medium for storing computer components; and
a computerized processor for executing the computer components comprising:
a first computer component for identifying content for inspection;
a second computer component for tracing the activity of the processor processing the content in order to form trace data, by using features of the processor
a third computer component for, upon occurrence of an exception, transferring control to an analyzer that detects suspicious activity according to the trace data based on
a context of the exception;
a fourth computer component for, detecting suspicious activity according to the trace data based on a context of the exception.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A rotary pulse type filter dust collector comprising:
a dust collector body having an intermediate plate;
a number of filter bags arranged vertically in the dust collector body;
a compressed air tank located inside a machine room formed on the intermediate plate, and movably mounted above the intermediate plate by means of driving means, the compressed air tank receiving compressed air introduced from the outside;
a number of nozzles perforating the compressed air tank;
diaphragm valves connected to the nozzles respectively and correspondingly;
mechanical 3-way valves for driving the plurality of nozzles and diaphragm valves of the compressed air tank by predetermined groups in order to clean the corresponding filter bags, the mechanical 3-way valves of the same number as the groups being mounted in the compressed air tank;
a number of protrusions formed on the inner walls of the machine room to change the air flow direction of the 3-way valves by pressing manipulation levers of the 3-way valves;
a reduction motor and an mechanical transmitting device for driving the compressed air tank; and
an inverter controller for controlling a cleaning interval of the dust collector by controlling the rotational speed of the driving means.
2. The rotary pulse type filter dust collector according to claim 1, wherein the 3-way valve includes:
a valve entrance hole for receiving compressed air from the compressed air tank;
a valve exit hole for discharging the compressed air to a side of the diaphragm valve; and
a manipulation lever for generating signals in contact with the protrusions to change it’s air flow direction.
3. The rotary pulse type filter dust collector according to claim 1, wherein the compressed air tank is formed in a fan shape or a rectangular-shape according to the shape of the dust collector body.
4. The rotary pulse type filter dust collector according to claim 3, wherein if the compressed air tank is in the fan shape, the 3-way valve is located on the circumferential surface of the compressed air tank, and is in contact or not in contact with the protrusions formed on the inner walls of the machine room when the fan-shaped compressed air tank is rotated on the center of the intermediate plate.
5. The rotary pulse type filter dust collector according to claim 3, wherein if the compressed air tank is in a hexahedral shape, the 3-way valves are located on both side surfaces of the compressed air tank, and is in contact or not in contact with the protrusions formed on side surfaces of the machine room when the compressed air tank performs a reciprocating motion.
6. The rotary pulse type filter dust collector according to claim 1, wherein the driving means is arranged on the side surface or the upper portion of the machine room.
7. The rotary pulse type filter dust collector according to claim 6, wherein the driving means arranged on the side surface of the machine room includes:
at least one wheel mounted on the lower end of the compressed air tank in a rolling way;
a reduction motor;
a driving shaft and a driving sprocket connected to the reduction motor;
a driven shaft and a driven sprocket separated from the driving sprocket at opposite side;
a chain for connecting the driving sprocket and the driven sprocket with each other; and
a protrusion formed on the chain for driving the compressed air tank.
8. The rotary pulse type filter dust collector according to claim 4, 6, 7, wherein the inverter controller controls the cleaning interval by means of controls the rotational speed of the reduction motor.