Microsoft Technology Licensing, LLC

Abhishek Sagar

Jason Joseph Weber

Charles Strempler

Mara Beth Fortini

Richard Joseph Murillo

Brian Keith Catlin

Sinclaire Renee Hamilton

Michael David Mccormack

Christian Stockwell

Tristan Anthony Brown

James Anthony Schwartz, Jr

Paresh J Maisuria

Christian Seifert

M Nashaat Soliman

Ali Alabbas

Fredric W Pullen, Iii

Robert G Lefferts

Paresh Maisuria

Nerses Ghevondyan

Devanshi M Gajjar

Millen May T Angeles

Cristian C Berejan

Shreya Salikram Chowdhary

Svetoslav G Paregov

Rupo Zhang

Embodiments of the technology described herein identify and mitigate phishing attempts by analyzing user input received at the operating system level. Initially, a credential, such as a username or password, is registered with the threat detection system. The technology described herein intercepts user input at the operating system level, generates a hash of the input, and compares it with a hash of a credential being monitored. The technology described herein will perform a threat assessment when a secret entry is detected. The threat assessment may use the application context and the network context as inputs to the assessment. When the threat assessment results in an unknown classification or when the snapshot is otherwise requested, a snapshot is captured to supplement the threat assessment. Based on user settings, the snapshot is consumed by a snapshot phishing machine learning model. Various mitigation actions may be taken when a threat is detected.

Snapshot phishing detection and threat analysis

The technology described herein identifies and mitigates phishing attempts by analyzing user input received at the operating system level. Initially, a credential, such as a username or password, is registered with the threat detection system. The technology described herein intercepts user input at the operating system level, generates a hash of the input, and compares it with a hash of a credential being monitored. A credential entry is detected when a hash for the character string entered matches a hash for a credential being monitored. The technology described herein will perform a threat assessment when a secret entry is detected. The threat assessment may use the application context and the network context as inputs to the assessment. Various mitigation actions may be taken when a threat is detected.

Credential input detection and threat analysis

An operating system of a computing device determines an importance of the threads running on the computing device, such as assigning the importance of the threads as critical or non-critical. The operating system determines when there are no threads having at least a threshold importance (e.g., no critical threads), and forces one or more components of the computing device into a forced idle state in response to determining that there are no threads having at least the threshold importance. The forced idle state of a device component is a low power state, such as a state in which program instructions are not executed, so the computing device is forced into a forced idle state that reduces power usage in the computing device despite there being threads (e.g., non-critical threads) to be executed.

Power conservation of computing components using forced idle state

One or more techniques and/or systems are provided for dynamically applying power policies to a computing environment. For example, a computing environment may comprise one or more activity components (e.g., a display driver, an audio driver, an application, etc.) that may provide status information used to identify a scenario (e.g., a video game scenario, a full screen video playback scenario, etc.) that is activated for the computing environment. A power policy assigned to a currently identified scenario may be applied to the computing environment to dynamically improve performance and/or power conservation, for example. Activity components, scenarios, and/or power policies may be maintained in an extensible manner such that activity components, scenarios, and/or power polices may be added, removed, and/or modified by merely updating corresponding data structures, such as tables or registry keys, as opposing to updating power management software code.

Scenario power management

Growing community of inventors

Redmond, WA, United States of America

Abhishek Sagar