Microsoft Technology Licensing, LLC

Vmware, Inc.

Microsoft Corporation

Adrian Mihail Marinescu

Marc E Seinfeld

Anil Francis Thomas

Mihai Costea

Michael Todd Kramer

Jack Wilson Stokes, Iii

David Allen Goebel

Karthik Selvaraj

George Cristian Chicioreanu

Scott Field

William Michael Zintel

Neill Michael Clift

Daron Spektor

David Bradley Probert, Jr

Ajith Kumar

Matthew I Braverman

Marius Gheorghe Gheorghescu

Daniel M Bodorin

Michael Jarrett

Catalin Daniel Sandu

Jonathan Mark Keller

Gheorghe Marius Gheorghescu

Adrian Emil Stepan

Joseph J Johnson

Rakshit Agrawal

John Carlton Platt

Jason Garms

Charles W Kaufman

Cenk Ergan

Michael Richard Fortin

Yu Wang

Cormac E Herley

Zheng Wang

Garret Buban

Thomas Dee McGuire

Scott Daniel Anderson

Hoi Huu Vo

Alexey A Polyakov

Yigal Mordechai Edery

Michael Joseph Healy

Carl M Carter-Schwendler

Genevieve Fernandes

Jeffrey M Cooperstein

Jack W Stokes

Dragos Sambotin

Md Nazmus Sakib

Jeffrey A Sutherland

Jigar J Mody

Glen McCready

Tahsin Erdogan

Tony Lee

Vishal Kapoor

Jeffrey S Williams

Deskin M Miller

Paul Brandon Luber

Deepak Jagannathan Manohar

Kyle A Larsen

Ying Lin

Joseph Leo Faulhaber

Nitin Sood

Robert Earhart

Gowtham Reddy Animireddygari

Randal Patrick Treit

Milind Amrutrao Pawar

Paul V Donlan

Vadim N Bluvstein

Matthew Ronald Shadbolt

Vladimir Soroka

Thorbjoern Donbaek

Shweta Jha

Hayk Hovsepyan

Chaohong Ou

Thomas Walter Caldwell, Iii

Patanjal Digant Vyas

Brian W Keogh

Aaron Michael Hulett

Stanislav Nurilov

Omer Ben Bassat

Gokhan Ozhan

David Torosyan

Timothy Jon Fraser

Nikos Karampatziakis

Alemeshet Yismaw Alemu

Adnan Ilik

Adrian Bivol

Jack Wilson Stokes Iii

Jack Wilson Iii Stokes

Gowtham R Animireddygari

A system and method for providing stringent tamper resistant protection against changes to key system security features. The tamper protection is configured such that any changes to the policy can only occur from a configuration manager console, thereby preventing local device admin users or other malicious actors from altering the setting. Thus, tamper protection locks the selected service and prevents security settings from being changed through third-party apps and methods. When a system administrator enables the feature for an enterprise's workstations, only administrators will be able to change the service settings across a company's computers. The tamper protection policy is digitally signed in the backend before being deployed to endpoints, and the endpoint verifies the validity and intent of the policy, establishing that it is a signed package that only security operations personnel with the necessary administrator rights can control.

Tamper-resistant service management for enterprise systems

The current document is directed to an efficient and non-blocking mechanism for flow control within a multi-processor or multi-core processor with hierarchical memory caches. Traditionally, a centralized shared-computational-resource access pool, accessed using a locking operation, is used to control access to a shared computational resource within a multi-processor system or multi-core processor. The efficient and non-blocking mechanism for flow control, to which the current document is directed, distributes local shared-computational-resource access pools to each core of a multi-core processor and/or to each processor of a multi-processor system, avoiding significant computational overheads associated with cache-controller contention-control for a traditional, centralized access pool and associated with use of locking operations for access to the access pool.

Non-blocking flow control in multi-processing-entity systems

Techniques for implementing content-based post-process data deduplication are provided. In one set of embodiments, a computer system can receive a write request comprising write data to be persisted to a storage system and can sample a portion of the write data. The computer system can further execute one or more analyses on the sampled portion in order to determine whether the write data is a good deduplication candidate that is likely to contain redundancies which can be eliminated via data deduplication. If the one or more analyses indicate that the write data is a good deduplication candidate, the computer system can cause the write data to be persisted to a staging storage component of the storage system. Otherwise, the computer system can cause the write data to be persisted to a primary storage component of the storage system that is separate from the staging storage component.

Content-based post-process data deduplication

Examples described herein generally relate to a computer device including a memory, and at least one processor configured to determine whether to allow execution of an application file on the computer device. The processor receives a command to execute a file. The processor determines whether the file is associated with a package reputation of an installation package. The processor determines a file reputation of the file. The processor determines whether to allow execution of the file based on a combination of the file reputation of the file and whether the file is associated with the good package reputation.

Binary authorization based on both file and package attributes

A system for operating system remediation intercepts input/output (I/O) requests to write to one or more files and stores, as file restore data, (i) a restore copy of the one or more files to the system cache prior to performing write operations of the I/O requests and (ii) identification information for one or more processes or entities making the corresponding I/O requests in the system cache. The system reverts to the restore copy of the one or more files using the file restore data and based at least on a later determination that one or more processes making the corresponding I/O requests was malware. A current version of the one or more files is thereby replaced with the restore copy of the one or more files with improved automatic remediation support and a greater likelihood that data can be restored from the cache in the case of malware attacks.

Anti-virus file system cache for operating system remediation

Implementations described herein disclose a malware sequence detection system for detecting presence of malware in a plurality of events. An implementation of the malware sequence detection includes receiving a sequence of a plurality of events, and detecting presence of a sequence of malware commands within the sequence of a plurality of events by dividing the sequence of plurality of events into a plurality of subsequences, performing sequential subsequence learning on one or more of the plurality of subsequences, and generating a probability of one or more of the plurality of subsequences being a malware based on the output of the sequential subsequence.

Malware sequence detection

Enhanced neural network architectures that enable the determination and employment of association-based or attention-based 'interrelatedness' of various portions of the input data are provided. A method of employing an architecture includes receiving a first input data element, a second input element, and a third input element. A first interrelated metric that indicates a degree of interrelatedness between the first input data element and the second input data element is determined. A second interrelated metric is determined. The second interrelated metric indicates a degree of interrelatedness between the first input data element and the third input data element. An interrelated vector is generated based on the first interrelated metric and the second interrelated metric. The neural network is employed to generate an output vector that corresponds to the first input vector and is based on a combination of the first input vector and the interrelated vector.

Neural network architectures employing interrelatedness

Technologies for detecting malware based on reinforcement learning model to detect whether a file is malicious or benign and to determine the best time to halt the file's execution in so detecting. The reinforcement learning model combined with an event classifier and a file classifier learns whether to halt execution after enough state information has been observed or to continue execution if more events are needed to make a highly confident determination. The algorithm disclosed allows the system to decide when to stop on a per file basis.

Deep reinforcement learning technologies for detecting malware

Described herein are various technologies pertaining detecting malware by monitoring execution of an instrumented process. An anti-malware engine can observe code obfuscation, suspicious patterns and/or behavior upon scanning a computer file. Based upon this observation, evidence can be submitted to a service (e.g., cloud-based service) and, in response, configuration setting(s) for restraining, containing and/or instrumenting a process for executing the file and/or instrumenting a process into which the file is loaded can be received. The configured process can be monitored. Based upon this monitoring, an action can be taken including determining the file to comprise malware and terminating the process. Upon detecting malware, a detection report, and a copy of the computer file, can be sent to a service (e.g., cloud-based). The service can independently verify that the reported file is malicious, and can protect other machines from executing or loading the same malicious file.

Detecting malware by monitoring execution of a configured process

The present invention extends to methods, systems, and computer program products for reverse replication to rollback corrupted files. When a computer system detects that a copy of a file includes inappropriate content, the computer system can coordinate with other computer systems (e.g., in replicated storage system) to determine that a viable (e.g., clean) copy of the file exists. The computer system can access the viable copy and replace the copy that includes the inappropriate content with the viable copy. As such, a computer system can 'reverse replicate' a file rather than break a synchronization relationship. Reverse replication can be used to rollback a copy of an infected file to another (possibly earlier) copy of the file that is not infected. Embodiments of the invention can be used to rollback data files, such as, for example, pictures, videos, documents, etc.

Reverse replication to rollback corrupted files

The present disclosure describes processing a write command directed to a block-based main storage device, and having a target logical sector and write data. The processing may include writing an address of a physical sector in the main storage device that contains the target logical sector to a header portion of a scratch block stored in a byte-addressable storage. The write data may be written to a slot the scratch block. The scratch block may be committed a scratch block in persistent storage. Subsequent to processing the write command, a write completion response may be signaled to the sender of the write command to indicate to the sender completion of the write command, without having committed the write data to the main storage device. Write data from several write commands may be subsequently committed to the main storage device.

Logical to physical sector size adapter

The current document is directed to a storage stack subsystem of a computer system that transfers data between memory and various data-storage devices and subsystems and that processes I/O requests. In one implementation, the disclosed storage stack includes a latency monitor, an I/O-scheduling bypass pathway, and short-circuit switch, controlled by the latency monitor. While the latency associated with I/O-request execution remains below a threshold latency, I/O-scheduling components of the storage stack are bypassed, with I/O requests routed directly to multiple input queues associated with one or more high-throughput multi-queue I/O device controllers. When the latency for execution of I/O requests rises above the threshold latency, I/O requests are instead directed to I/O-scheduling components of the storage stack, which attempt to optimally reorganize the incoming I/O-request stream and optimally distribute I/O-requests among multiple input queues associated I/O device controllers.

Method and system that increase storage-stack throughput

The present invention extends to methods, systems, and computer program products for scanning files for inappropriate content during file synchronization. Embodiments of the invention are mindful of the order of operations when scanning files for inappropriate content and in subsequent file processing. In some embodiments, during synchronization, an intermediary server scans a file for inappropriate content. The file is not permitted to be fully downloaded to a client device until the scan determines that the file does not contain inappropriate content. In other embodiments, during synchronization, a client device scans a newer version of a file for inappropriate content. An older version of the file is not deleted until the scan determines that the newer version of the file does not contain inappropriate content. In further embodiments, server side scanning and client side scanning are both used to enhance capabilities for detecting inappropriate content.

Scanning files for inappropriate content during synchronization

The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.

Discovering malicious input files and performing automatic and distributed remediation

Growing community of inventors

Sammamish, WA, United States of America

Adrian Mihail Marinescu