Cyphort Inc.

Stackrox, Inc.

Ali Golshan

Fengmin Gong

Frank Jas

Manikandan A Kenyan

Alexander Burt

Yucheng Ting

Shishir Singh

Liang Han

James S Binder

Mikola Bilogorskiy

McEnroe Navaraj

Neal Vu

Dhananjay Sampath

Anthony James

Nick Bilogorskiy

Sameer Bhalotra

Chenghuai Lu

Vishwanath Raman

A server has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to collect operating signals from machines, where each operating signal characterizes the state or a change in operational state of a designated application operating within a designated container, where the designated container is an isolated process in user space designated by an operating system kernel. The operating signals are compared to models that incorporate summarizations of data sets that represent observed benign operating signals and malicious operating signals for the designated application operating within the designated container. Risks associated with the operating signals are characterized.

System and method for providing security in a distributed computation system utilizing containers

A system configured to detect malware is described. The system configured to detect malware including a data collector configured to detect at least a first hypertext transfer object in a chain of a plurality of hypertext transfer objects. The data collector further configured to analyze at least the first hypertext transfer object for one or more events. And, the data collector configured to generate a list of events based on the analysis of at least the first hypertext transfer object.

System and method for detection of malicious hypertext transfer protocol chains

A system configured to detect malware is described. The system including an infection verification pack configured to perform behavior detonation; identify a malware object based on machine-learning; and select one or more persistent artifacts of the malware on the target system based on one or more algorithms applied to behavior traces of the malware object to select one or more persistent artifacts of the malware on the target system.

System and method for verifying and detecting malware

Systems and methods for virtualized malware enabled detection are described. In some embodiments, a method comprises intercepting an object provided from a first digital device, determining one or more resources the object requires, instantiating a virtual environment with the one or more resources, processing the object within the virtual environment, tainting operations of the object within the virtual environment, monitoring the operations of the object, identifying an additional resource of the object while processing that is not provided in the virtual environment, re-instantiating the virtual environment with the additional resource, monitoring the operations of the object while processing within the re-instantiated virtual environment, identifying untrusted actions from the monitored operations, and generating a report identifying the operations and the untrusted actions of the object.

Systems and methods for virtualized malware detection

Systems and methods for monitoring malware events in a computer networking environment are described. The systems and methods including the steps of identifying suspect objects; transmitting the suspect objects to an inspection service, wherein the inspection service inspects the suspect objects using a plurality of inspection methods to create digital information about the nature of the potential threat posed by the suspect objects; transmitting said digital information to an analytical service operating, wherein the analytical service performs a plurality of analytical algorithms to categorize the suspect objects with one or more scores for each suspect object based on their security threat; transmitting said one or more scores to a correlation facility which aggregates a plurality of scores; and generating an infection verification pack comprising routines which, when run on an end-point machine within the computer networking environment, will mitigate a suspected security threat.

Systems and methods for malware detection and mitigation

Systems and methods for virtualization and emulation assisted malware detection are described. In some embodiments, a method comprises intercepting an object; instantiating and processing the object in a virtualization environment; tracing operations of the object while processing within the virtualization environment; detecting suspicious behavior associated with the object; instantiating an emulation environment in response to the detected suspicious behavior; processing, recording responses to, and tracing operations of the object within the emulation environment; detecting a divergence between the traced operations of the object within the virtualization environment to the traced operations of the object within the emulation environment; re-instantiating the virtualization environment; providing the recorded response from the emulation environment to the object in the virtualization environment; monitoring the operations of the object within the re-instantiation of the virtualization environment; identifying untrusted actions from the monitored operations; and generating a report regarding the identified untrusted actions of the object.

Systems and methods for virtualization and emulation assisted malware detection

Growing community of inventors

Santa Clara, CA, United States of America

Ali Golshan