Microsoft Technology Licensing, LLC

Microsoft Corporation

Anil Francis Thomas

Adrian Mihail Marinescu

Mihai Costea

David Allen Goebel

Scott Field

Michael Todd Kramer

Ajith Kumar

Stefan Thom

Pradeep Bahl

Mark Fishel Novak

Efim Hudis

Marc E Seinfeld

Robert Karl Spiger

David John Linsley

Yigal Mordechai Edery

Rajesh K Dadhia

Catalin Daniel Sandu

Jonathan Mark Keller

Hui Dai

Galen Clyde Hunt

John Carlton Platt

Cenk Ergan

Michael Richard Fortin

Jack Wilson Stokes, Iii

Jack W Stokes

Jeremiah Spradlin

Steven P Maillet

Michael Jarrett

Anthony S Chavez

Philip Ernst Taron

Vishal Kapoor

Gheorghe Marius Gheorghescu

Nirmal Rajesh Soy

George Cristian Chicioreanu

Ronen Borshack

Marius Gheorghe Gheorghescu

Barbara Harder

Kyle A Larsen

Joseph Leo Faulhaber

Kanwaljit Marok

Joseph J Johnson

Eli Zeitlin

Timothy Jon Fraser

Hauroon M A Jamal

Brijesh S Krishnaswami

Ashish Sikka

Kwanjalit S Marok

Vadim N Bluvstein

Adrian Bivol

Arnon Axelrod

Yigal Edery

Nikos Karampatziakis

Omer Ben Bassat

Erez Einav

Eugene John Neystadt

Michael Sean Jarrett

Joseph Jared Johnson

A configuration scanning system is described herein that scans a system configuration database for malware-related information with less impact on other operations that access the system configuration database. The system employs techniques to reduce the impact on other operations that access the configuration database, including parsing a file-based stored version of the configuration database, accessing the configuration database using opportunistic locking, and caching configuration information obtained by scanning the configuration database. In this way, the system is able to respond to requests antimalware programs using cached information without impacting other programs using the configuration database. Thus, the configuration scanning system protects a computer system against malware while reducing the burden on the configuration database and on other programs that access the configuration database.

Offline extraction of configuration data

A memory management system is described herein that receives information from applications describing how memory is being used and that allows an application host to exert more control over application requests for using memory. The system provides an application memory management application-programming interface (API) that allows the application to specify more information about memory allocations that is helpful for managing memory later. The system also provides an ability to statically and/or dynamically analyze legacy applications to give applications that are not modified to work with the system some ability to participate in more effective memory management. The system provides application host changes to leverage the information provided by applications and to manage memory more effectively using the information and hooks into the application's use of memory. Thus, the system provides a new model for managing memory that improves application host behavior and allows applications to use computing resources more efficiently.

Memory management model and interface for unmodified applications

The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.

Discovering malicious input files and performing automatic and distributed remediation

Storing and retrieving files based on hashes for the files. One method for storing files includes: identifying a file; identifying a hash calculated based on the file; renaming the file based on the hash based on the file; and storing the file in a particular location based on the hash calculated based on the file. Another method for retrieving files includes: identifying a hash for a given file; using the hash, traversing a hierarchical file structure to find a location where the given file should be stored; determining that the file is at the location; and as a result, retrieving the file.

Large scale file storage in cloud computing

Techniques for aggregating a knowledge base of a plurality of security services or other event collection systems to protect a computer from malware are provided. In embodiments, a computer is protected from malware by using anti-malware services or other event collection systems to observe suspicious events that are potentially indicative of malware. A determination is made as to whether a combination of the suspicious events is indicative of malware. If the combination of suspicious events is indicative of malware, a restrictive security policy designed to prevent the spread of malware is implemented.

Aggregating the knowledge base of computer systems to proactively protect a computer from malware

Techniques are described herein that are capable of selectively scanning objects for infection by malware (i.e., to determine whether one or more of the objects are infected by malware). For instance, metadata that is associated with the objects may be reviewed to determine whether update(s) have been made with regard to the objects since a determination was made that the objects were not infected by malware. An update may involve increasing a number of the objects, modifying one of the objects, etc. Objects that have been updated (e.g., added and/or modified) since the determination may be scanned. Objects that have not been updated since the determination need not necessarily be scanned. For instance, an allowance may be made to perform operations with respect to the objects that have not been updated since the determination without first scanning the objects for infection by malware.

Selectively scanning objects for infection by malware

The subject disclosure is directed towards a technology by which antimalware detection logic is maintained and operated at a backend service, with which a customer frontend machine communicates (queries) for purposes of malware detection. In this way, some antimalware techniques are maintained at the backend service rather than revealed to antimalware authors. The backend antimalware detection logic may be based upon feature selection, and may be updated rapidly, in a manner that is faster than malware authors can track. Noise may be added to the results to make it difficult for malware authors to deduce the logic behind the results. The backend may return results indicating malware or not malware, or return inconclusive results. The backend service may also detect probing-related queries that are part of an attempt to deduce the unrevealed antimalware detection logic, with noisy results returned in response and/or other actions taken to foil the attempt.

Applying antimalware logic without revealing the antimalware logic to adversaries

Booting a computing device includes executing one or more firmware components followed by a boot loader component. A protection component for the computing device, such as an anti-malware program, is identified and executed as an initial component after executing the boot loader component. One or more boot components are also executed, these one or more boot components including only boot components that have been approved by the protection component. A list of boot components that have been previously approved by the protection component can also be maintained in a tamper-proof manner.

Device booting with an initial protection component

A reliable automated malware classification approach with substantially low false positive rates is provided. Graph-based local and/or global file relationships are used to improve malware classification along with a feature selection algorithm. File relationships such as containing, creating, copying, downloading, modifying, etc. are used to assign malware probabilities and simultaneously reduce the false positive and false negative rates on executable files.

Graph-based malware classification based on file relationships

In one embodiment, a malware protection system may protect a computing system from a malware event. A data storage devicemay store a watchdog filter driverintegrated with an operating system kernel. A processormay intercept a process access to an application processwith the watchdog filter driverto detect a malware event. The processormay use the watchdog filter driverto determine an originating process for the malware event.

Protecting user mode processes from improper tampering or termination

In accordance with the present invention, a system, method, and computer-readable medium for aggregating the knowledge base of a plurality of security services or other event collection systems to protect a computer from malware is provided. One aspect of the present invention is a method that proactively protects a computer from malware by using anti-malware services or other event collection systems to observe suspicious events that are potentially indicative of malware; determining if the suspicious events satisfy a predetermined threshold; and if the suspicious events satisfy the predetermined threshold, implementing a restrictive security policy designed to prevent the spread of malware.

In accordance with this invention, a system, method, and computer-readable medium that selectively scans files stored on a computing device for malware is provided. One aspect of the present invention includes identifying files that need to be scanned for malware when a software update that includes a malware signature is received. More specifically, attributes of the new malware are identified by searching metadata associated with the malware. Then, the method searches a scan cache and determines whether each file with an entry in the scan cache is the type that may be infected by the malware. If a file is the type that may be infected by the malware, the file is scanned for malware when a scanning event such as an I/O request occurs. Conversely, if the file is not the type that may be infected by the malware, the file may be accessed without a scan being performed.

System and method of caching decisions on when to scan for malware

Growing community of inventors

Redmond, WA, United States of America

Anil Francis Thomas