Ao Kaspersky Lab

Kaspersky Lab, Zao

Andrey P Doukhvalov

Dmitry A Kulagin

Pavel V Dyakin

Eugene V Kaspersky

Anton V Tikhomirov

Sergey Y Golovanov

Igor I Soumenkov

Alexey Y Voitovich

Sergey V Konoplev

Andrey B Lavrentyev

Stanislav Vladimirovich Moiseev

Ekaterina A Rudina

Semen S Kort

Viacheslav N Zolotnikov

Sergey B Lungu

Sergey V Gordeychik

Sergey G Zagorsky

Yury V Mashevsky

Andrey V Kryukov

The present disclosure provides systems and methods for increasing the cybersecurity of a control subject of an industrial technological system. In an exemplary aspect, the method comprises installing a protected Operating System (OS) on a control subject of the industrial technological system, receiving, by the protected OS, a plurality of log files from the control subject, analyzing, by the protected OS, the plurality of log files to determine if a suspicious action has been applied to the control subject, wherein the control subject is configured to apply a controlling action to the object of control, intercepting, by the protected OS, network packets transmitted by an application launched in a guest OS to the control subject, and preventing, by the protected OS, an interaction between the application and the control subject, in response to determining that the suspicious action has been applied to the control subject.

Increasing the cybersecurity of a control subject of a technological system by using a protected operating system

Disclosed are systems and methods for enabling transmission of data and commands between a mobile device and a vehicle. An exemplary method comprises connecting a security device to a vehicle and to a mobile device, the security device having a protected memory, verifying, by the security device, an authenticity of the mobile device, allowing, by the security device, transmission of data and commands between the mobile device and at least one actuating device of the vehicle when the mobile device is verified as being authentic, transmitting, by the security device, results of executions of commands from the at least one actuating device of the vehicle to the mobile device.

Systems and methods for enabling transmission of data and commands between a mobile device and a vehicle

The present disclosure provides systems and methods to stepwise increasing the IT security of elements of a technological system. In an exemplary aspect, the method comprises gathering data on technological systems and a plurality of elements comprising the technological system by intercepting traffic between the plurality of elements using data exchange protocols, identifying vulnerable elements of the technological system by one or more of: detecting suspicious actions on the vulnerable elements and statistical data relating to the elements, analyzing the vulnerable elements to generate a classification of severity of vulnerabilities of the vulnerable elements, identifying most vulnerable portions of the vulnerable elements as compared to other elements in the vulnerable elements, operating the most vulnerable portions of the vulnerable elements in a protected environment.

System and method of stepwise increasing the IT security of elements of a technological system

Disclosed herein are methods and systems for automated testing of hardware and software systems. An exemplary method comprises receiving a formalized architecture description describing an architecture of a system being designed, receiving a formalized threat description describing threats to systems similar to the system being designed, building, by a processor, a use model based on the formalized description, building, by a processor, a threat model based on the formalized threat description, determining, by a processor, kinds of use of the system by comparing the threat model to the use model and determining, by a processor, components of the system based on the kinds of use.

Method for automated testing of hardware and software systems

The present disclosure is directed to methods and systems for automated design of a system of hardware and software. In an exemplary embodiment, such a method comprises constructing, by a hardware processor, a model of use based on an architecture description of the system, constructing, by the hardware processor, threat model based on a threat description indicating known threats to the system, determining use of the system based on a comparison between the model of use and the threat model and selecting a configuration for realizing the system based on a result of the comparison.

System and method of automated design of hardware and software systems and complexes

Disclosed are systems and methods for securely controlling a vehicle using a mobile device. An exemplary method comprises authenticating, by a mobile device, a user attempting to perform commands controlling one or more vehicle systems of a coupled vehicle, retrieving profile information related to the user's preference associated with the coupled vehicle, establishing a connection between the mobile device and a security device of the coupled vehicle, authenticating the mobile device with the security device, forming, by the mobile device, commands to control the one or more vehicle systems based on command forming algorithms, the one or more vehicle systems comprising actuating devices of the vehicle and electronic systems of the vehicle, modifying the formed commands based on the profile information and safety information related to a location of the vehicle and transmitting the formed commands to the one or more vehicle systems via the security device to securely control the vehicle.

Systems and methods for securely controlling a vehicle using a mobile device

Disclosed are systems and methods for protection of a technological system (TS) from cyber attacks. An exemplary method comprises: obtaining a real state of the TS; initializing a cybernetic control system (CCS) by synchronizing the CCS with the TS; comparing, by the CCS, the real state of the TS with an ideal state of the TS; based on the comparison, identifying a deviation of the real state of the TS from the ideal state of the TS; when the deviation is identified, checking an integrity of at least functional interconnections of the states of one or more elements of the TS; determining whether the ideal state of the TS is a modeling error based on one or more confirmed sustained functional interconnections between elements of the TS; and identifying anomalies in the TS based on one or more disturbed functional interconnections between elements of the TS.

System and method of protection of technological systems from cyber attacks

A computer security architecture applies selected rules from among a set of rules defining one or more security policies to a given set of security context parameters to produce security verdicts, each representing whether a certain action requested by a subject entity is permissible. Each security policy is associated with a corresponding communication interface. A plurality of gateway engines are each associated with at least one of the subject entities and dedicated to interfacing with the security server. Each of the gateway engines carries out monitoring of requested actions by the associated subject entity and, for each requested action, identifies a security context. A security policy is determined for the requested action based on a corresponding security context, and a security verdict is obtained via a communication interface corresponding to the applicable security policy.

Secure gateway communication systems and methods

Disclosed are systems and methods for secure control of automotive systems using mobile devices. An exemplary method comprises: connecting a vehicle, as a peripheral device, to a mobile device, which acts as a master device, via a security device of the vehicle, wherein the security device provides secure transmission of data and commands between the vehicle and the mobile device; receiving, by the mobile device, via the security device, from one or more measurement devices of the vehicle, measurement data from one or more automotive systems of the vehicle; based on the received measurement data, forming by the mobile device control commands for actuating devices of the vehicle, wherein the control commands enable and/or regulate operation of the actuating devices of the vehicle; and transmitting, by the mobile device, via the security device, the control commands to the actuating devices of the vehicle.

Secure control of automotive systems using mobile devices

Computer security architecture and related computing method

In a computer system, processing of security-related tasks is delegated to various agent computers. According to various embodiments, a distributed computing service obtains task requests to be performed for the benefit of beneficiary computers, and delegates those tasks to one or more remote agent computers for processing. The delegation is based on a suitability determination as to whether each of the remote agent computers is suitable to perform the processing. Suitability can be based on an evaluation of such parameters as computing capacity and current availability of the remote agent computers against the various tasks to be performed and their corresponding computing resource requirements. This evaluation can be performed according to various embodiments by the agent computers, the distributed computing service, or by a combination thereof.

System and method for distributing processing of computer security tasks

Disclosed are systems, methods and computer program product for determining information security level for an enterprise. An example method comprising: collecting information relating to a structure of the enterprise, including a plurality of elements of the enterprise; creating a model to correspond to each element of the enterprise based on at least one function of each element; identifying criteria to evaluate an effectiveness of the at least one function of each element; simulating operation of the elements and determining effectiveness of the at least one function of each simulated element, wherein simulating includes determining different sequences of events and actions in response to the events for one or more simulation iterations based on the effectiveness of the at least one function of each element; and determining an information security level for the enterprise by maximizing the effectiveness of functions of the elements in response to events.

System and method for determining enterprise information security level

Disclosed a portable personal security device and methods for secure communication. In one example, the personal security device may wirelessly connect to a user device and collect information about the user device. The personal security device may then assess security characteristics of the user device based on the collected information. When the user device is determined to be unsecure, the personal security devices may instruct the user to use a secure internet application of the personal security device instead of an unsecure internet application of the user device. In addition, the personal security device may instruct the user to use a secure data input device of the personal security device instead of an unsecure data input device of the user device. The personal security device then receives via the secure data input device a user input data for the secure internet application, and transmit it to the user device.

Portable security device and methods for secure communication

A method for reducing the size of the AV database on a user computer by dynamically generating an AV database according to user parameters is provided. Critical user parameters that affect the content of the AV database required for this user are determined. The AV database for the single user is generated based on the user parameters. When the parameters of the user computer change or when new malware threats are detected, the user AV database is dynamically updated according to the new parameters and the new malware threats. The update procedure becomes more efficient since a need of updating large volumes of data is eliminated. The AV system, working with a small AV database, finds malware objects more efficiently and uses less of computer system resources.

System and method for dynamic generation of anti-virus databases

Disclosed a portable security device and methods for secure user authentication. The security device stores operating system agents that enable communication with user devices that have different operating systems. The security device also stores user authentication data for accessing different Internet resources by the user devices. The security devices connects to the user device using an operating system agent corresponding to the operating system of the user device, and receives from the user device a request to access an Internet resource. The security device select user authentication data associated with the requested Internet resource, and obtains the requested Internet resource using the selected user authentication data.

Growing community of inventors

Moscow, Russia

Andrey P Doukhvalov