Symantec Corporation

Ca, Inc.

Nortonlifelock Inc.

Andrew B Gardner

Mark Kevin Kennedy

Aleatha Parker-Wood

Nikolaos Vasiloglou

Javier Echauz

Jasjeet Dhaliwal

Carey S Nachenberg

Walter Bogorad

Petrus Johannes Viljoen

Jun Mao

Saurabh Shintre

Reuben Feinman

Douglas Schlatter

Jugal Parikh

Melanie Beck

Geoffrey So

John Keith Kenemer

Vincent Cheong

Machine learning adversarial campaign mitigation on a computing device. The method may include deploying an original machine learning model in a model environment associated with a client device; deploying a classification monitor in the model environment to monitor classification decision outputs in the machine learning model; detecting, by the classification monitor, a campaign of adversarial classification decision outputs in the machine learning model; applying a transformation function to the machine learning model in the model environment to transform the adversarial classification decision outputs to thwart the campaign of adversarial classification decision outputs; determining a malicious attack on the client device based in part on detecting the campaign of adversarial classification decision outputs; and implementing a security action to protect the computing device against the malicious attack.

Machine learning adversarial campaign mitigation on a computing device

Identifying and protecting against a computer security threat while preserving privacy of individual client devices using differential privacy for text documents. In some embodiments, a method may include receiving, at the remote server device, text documents from one or more local client devices, generating, at the remote server device, a differential privacy document vector for each of the text documents, identifying, at the remote server device, a computer security threat to a first one of the one or more local client devices using the differential privacy document vectors, and, in response to identifying the computer security threat, protecting against the computer security threat by directing performance, at the first local client device or the remote server device, of a remedial action to protect the first local client device from the computer security threat.

Identifying and protecting against a computer security threat while preserving privacy of individual client devices using differential privacy for text documents

A computer-implemented method for selecting features for classification may include (1) generating a matrix X, a column vector Y, and a matrix Z from a training dataset that includes a plurality of samples with a plurality of features, (2) generating an augmented matrix from the matrix X, the column vector Y, and the matrix Z, (3) identifying one or more most-relevant features from the plurality of features by iteratively applying a sweep operation to the augmented matrix, and (4) training a classification model using the most-relevant features from the plurality of features rather than all of the plurality of features. Various other methods, systems, and computer-readable media may have similar features.

Systems and methods for selecting features for classification

The disclosed computer-implemented method for trichotomous malware classification may include (1) identifying a sample potentially representing malware, (2) selecting a machine learning model trained on a set of samples to distinguish between malware samples and benign samples, (3) analyzing the sample using a plurality of stochastically altered versions of the machine learning model to produce a plurality of classification results, (4) calculating a variance of the plurality of classification results, and (5) classifying the sample based at least in part on the variance of the plurality of classification results. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for trichotomous malware classification

Methods and apparatus for optimizing computer detection of malware using pattern recognition by refreshing random classification forests are described. In one embodiment, one or more selected trees of a random forest on a computing system may be replaced by one or more new trees. As new categorized data becomes available, one or more new trees may be generated using the new categorized data. Once the one or more new trees are available, the performance of the one or more new trees may be compared to the performance of the trees in the current random forest. Based on this comparison, one or more trees of the random forest may be selected to be replaced by one or more of the new trees.

Tree rotation in random classification forests to improve efficacy

A computer-implemented method for detecting malware using machine learning may include (1) identifying data to be analyzed for malware, (2) classifying, using a classifier created by a combination of at least one deep learning neural network and at least one supervised data mining method, the data to be analyzed for malware, (3) determining, based on a predefined threshold, that the classification of the data indicates potential malware on the computing device, and (4) performing a security action based on the determination of potential malware on the computing device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting malware using machine learning

A computer implemented method is provided for processing sparse data. A sparse data set is received. A modified sparse data set is calculated by replacing all nonzero values in the sparse data set with a common positive integer. The modified sparse data set is transposed to create a transposed data set. A covariance matrix is calculated by multiplying the transposed data set by the modified sparse data set. A tree of a predefined depth is generated by assigning columns of the sparse data set to right and left nodes based on co-occurrence with a first anchor column and a second anchor column. The first anchor column and the second anchor column are determined based on the covariance matrix.

Sparse data set processing

Suspicious file prospecting activity is detected based on patterns of file system access. A user's file system access is monitored over a specific time period. A sequence of the file accesses (e.g., represented as path names) made by the user during the time period is recorded. Distances between the recorded file accesses are determined, for example as edit distances. A distance sequence is recorded, comprising a record of the determined distances. The distance sequence is reduced to one or more baseline statistics describing the pattern of the user's access of the file system during the given period of time. At least one subsequent anomaly in the user's access of the file system is detected, by comparing at least one subsequently calculated statistic representing at least one subsequent pattern of the user's file system access to the at least one baseline statistic.

Detecting suspicious file prospecting activity from patterns of user activity

The disclosed computer-implemented method for improving the classification accuracy of trustworthiness classifiers may include (1) identifying a set of training data that is available for training trustworthiness classifiers used to classify computing resources as clean or malicious, (2) selecting, based at least in part on a characteristic of a specific organization, a subset of training data from the set of training data that is available for training trustworthiness classifiers, (3) training a trustworthiness classifier for the specific organization using the subset of training data selected based at least in part on the characteristic of the specific organization, and then (4) applying the trustworthiness classifier to at least one computing resource encountered by the specific organization to classify the computing resource as clean or malicious. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for improving the classification accuracy of trustworthiness classifiers

Techniques for automated application analysis are disclosed. In one embodiment, the techniques may be realized as a method comprising detecting a code creation activity; detecting the presence of a previously-unknown application; associating the detected application with the code creation activity; and permitting the application to run based on associating the detected application with the code creation activity.

Growing community of inventors

Roswell, GA, United States of America

Andrew B Gardner