Symantec Corporation

Qualys, Inc.

Abhijit V Limaye

Anand Bodke

Ankur S Tyagi

Prabhat Kumar Singh

Sumedh Thakar

Sujit Magar

Akhil Srivastava

Embodiments disclosed herein are directed to intelligent malware detection. A scanner server is used to scan an endpoint device for malware. Various attributes and behaviors of the endpoint device are identified in retrieved scan data. Identified attributes and behaviors are then evaluated according to a malware detection framework, which is used to determine whether (as well as to what extent) the identified attributes and behaviors are indicative of malware. In this manner, potential security risks associated with the malware may be identified. The framework is constructed through a machine learning process that aggregates attributes and behaviors common amongst members of malware families. Advantageously, the framework enables the scanner server to detect unknown variants of known malware families.

Method and apparatus for intelligent aggregation of threat behavior for the detection of malware

Method, apparatus, and computer readable medium for detecting malware on a target computer system is described. A threat profile is obtained at the target computer, the threat profile having manifestation information for known malware, the manifestation information including effects of the known malware on computer systems infected by the known malware. Using the threat profile, at least a portion of the manifestation information is detected on the target computer. A confidence level for detection of potential malware is determined based on the at least a portion of the manifestation information detected. The potential malware on the target computer is convicted as malware for remediation if the confidence level satisfies a threshold confidence level.

Method and apparatus for detecting malware on a computer system

A computer-implemented method for data loss prevention may include 1) identifying a network configured with a data loss prevention system including at least one data loss prevention policy directed to textual data expressed in a primary natural language, 2) identifying a textual object subject to a data loss prevention assessment within the network, 3) determining that the textual object includes a textual component that is not expressed in the primary natural language, 4) in response to determining that the textual object includes the textual component, translating the textual component from a secondary natural language that the data loss prevention policy does not recognize into the primary natural language that the data loss prevention policy does recognize, and 5) after translating the textual component into the primary natural language, applying the data loss prevention policy to a modified textual object including the translated textual component. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for data loss prevention in bilingual text messages with a data loss policy which recognizes only one primary language

A computer-implemented method for analyzing malware may include: 1) identifying a set of malware samples, 2) identifying, for each malware sample in the set of malware samples, a set of static strings present in the malware sample, and then 3) clustering the set of malware samples based on the set of static strings present in each malware sample. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Pune, India

Abhijit V Limaye