Symantec Corporation

Ca, Inc.

Alexander Danileiko

Sourabh Satish

Mark Kevin Kennedy

Spencer Dale Smith

Haik A Mesropian

Patrick Gardner

Charlotte Chang

Christopher J Peterson

Huawei Xing

Ming-Jen Wang

Joao M Forcada

Artem Egoyan

Methods, systems, and devices for protecting against abnormal computer behavior are described. The method may include monitoring a computer process related to an application running on a computing device of one or more computing devices, analyzing a database including a set of digital fingerprints, where a digital fingerprint of the set of digital fingerprints relates to the application, the digital fingerprint including an indication of a set of computer processes related to the application that are classified as normal computer processes for the application, determining that the computer process related to the application is an abnormal computer process based on analyzing, and performing a security action on the computing device to protect the computing device against the abnormal computer process based on the determining.

Application behavioral fingerprints

The disclosed computer-implemented method for thwarting unauthorized attempts to disable security managers within runtime environments may include (1) monitoring a runtime environment that (A) facilitates execution of an application and (B) includes a security manager that prevents the application from performing unauthorized actions while running within the runtime environment, (2) detecting, while monitoring the runtime environment, an attempt to disable the security manager such that the security manager no longer prevents the application from performing the unauthorized actions, (3) identifying a source of the attempt to disable the security manager, (4) determining that the source of the attempt is not authorized to disable the security manager, and then (5) blocking the attempt to disable the security manager such that the security manager continues to prevent the application from performing the unauthorized actions while running within the runtime environment. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for thwarting unauthorized attempts to disable security managers within runtime environments

The launch of an installer or uninstaller is detected. A process lineage tree is created representing the detected launched installer/uninstaller process, and all processes launched directly and indirectly thereby. The detected installer/uninstaller process is represented by the root node in the process lineage tree. Launches of child processes by the installer/uninstaller process and by any subsequently launched child processes are detected. The launched child processes are represented by child nodes in the tree. As long as the installer/uninstaller process represented by the root node in the tree is running, the processes represented by nodes in tree are exempted from anti-malware analysis. The termination of the installer/uninstaller process is detected, after which the processes represented by nodes in the process lineage tree are no longer exempted from anti-malware analysis.

Malware detection efficacy by identifying installation and uninstallation scenarios

A method and apparatus of detecting executable software in alternate data streams to secure operation of a computer comprises processing information regarding a file requested for execution and determining an alternate data stream associated with the file, wherein the alternate data stream comprises executable software.

Method and apparatus for detecting executable software in an alternate data stream

Growing community of inventors

Irvine, CA, United States of America

Alexander Danileiko