Symantec Corporation

Nortonlifelock Inc.

Brendon Woirhaye

Joseph Chen

Alfred C Hartmann

Charlotte Chang

Leo Cohen

Christopher Alexander

Archana S Rajan

Gary Sabala

Wei Lin

William E Sobel

Radoslav Stanev

Elias Levy

Anuj Sahai

The disclosed computer-implemented method for identifying unsolicited communications on a computing device may include a computing device receiving a communication from an unrecognized phone number; obtaining the unrecognized phone number from the communication; obtaining classification data associated with the unrecognized phone number based on categories of other computing devices contacted by the unrecognized phone number; obtaining a category associated with a phone number of the computing device; determining that the communication is an unsolicited communication based on the classification data and the category associated with the phone number of the computing device; and in response to determining that the communication is unsolicited, performing a security action to manage interactions with the communication from the unrecognized phone number. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying unsolicited communications on a computing device

A method and apparatus for securing a computer using an optimal configuration for security software based on user behavior is described. In one embodiment, the method for providing an optimal configuration to secure a computer based on user behavior includes examining computer user activity to produce behavior indicia with respect to computer security from malicious threats and determining an optimal configuration for security software based on the behavior indicia.

Method and apparatus for securing a computer using an optimal configuration for security software based on user behavior

A computer-implemented method for determining whether GPUs are executing potentially malicious processes may include (1) identifying at least one GPU associated with a computing device, (2) analyzing the behavior of the GPU associated with the computing device, (3) determining that the analyzed behavior of the GPU indicates that the GPU is executing at least one potentially malicious process, and then (4) performing at least one security action on the GPU in response to determining that the analyzed behavior indicates that the GPU is executing the potentially malicious process. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for determining whether graphics processing units are executing potentially malicious processes

Security from malicious attack is provided for a user environment running in a virtualized environment by a virtual security appliance (VSA) running outside of the user environment, but on the same computer system as the user environment. For example, a VSA running in a virtual machine can provide security for a user environment running in a second virtual machine. The separation of the VSA from the user environment enhances the robustness of the VSA against malicious attacks seeking to disable/bypass the protections of the VSA, while avoiding the costs and complexities of a physical security appliance.

Virtual security appliance

File reputations are used to identify malicious file sources. Attempts to access files from external sources are monitored. For each monitored attempt to access a file, a reputation of the specific file is determined. Responsive to a determined reputation of a file meeting a threshold, the file is adjudicated to be malicious. Attempts by sources to distribute malicious files are tracked. Responsive to tracked attempts by sources to distribute malicious files, reputations of file sources are determined. Responsive to a determined reputation of a source meeting a threshold, the source is adjudicated to be malicious, and files the source distributes are analyzed to determine whether they comprise malware. Malicious sources are blocked. Malware and malicious sources are analyzed to identify exploits and distribution patterns.

Using file reputations to identify malicious file sources in real time

A computer-implemented method for determining whether to evaluate the trustworthiness of digitally signed files based on signer reputation may include (1) identifying a file, (2) determining that the file has been digitally signed, (3) identifying a signer responsible for digitally signing the file, (4) identifying the signer's reputation, and then (5) determining whether to evaluate the trustworthiness of the file based at least in part on the signer's reputation. In one example, the signer's reputation may be based at least in part on the determined trustworthiness of at least one additional file that was previously signed by the signer. Various other methods, systems, and encoded computer-readable media are also disclosed.

Systems and methods for determining whether to evaluate the trustworthiness of digitally signed files based on signer reputation

A collection of stored data concerning digital content on read-only optical media is maintained. The data collection comprises signatures identifying specific releases of digital content stored on optical media, and results of scanning the specific releases for malware. The coupling of optical media to a computing device is detected. In response, an identifying signature of the digital content on the optical medium is created, and the data collection is searched for the signature. Where the signature is found in the data collection, the stored scanning result for the corresponding digital content is retrieved. Instead of scanning the coupled optical medium, the retrieved scanning result is used to determine its malware infection status. Where the signature is not found in the data collection, the optical medium is scanned for malware.

Performance optimization for scanning of digital content on read-only optical media

Recoverable file information and file content are maintained for a plurality of files. Responsive to detecting a damaged file on a computer system, the recoverable file information is used to identify a specific instantiation of the file to be restored. The computer is searched for a non-damaged, local copy of the file. If a non-damaged, local copy is found, it is used to replace the damaged file. Otherwise, a difference file is created which identifies the sections of the damaged file that differ from a non-damaged specific instantiation thereof. Using the difference file and appropriate maintained file content, the relevant sections of the damaged file are rebuilt, thereby restoring it to its original condition.

File infection removal by differential copy

A hook is set for one or more downloading functions. Subsequently, code is executed within an application process. Responsive to the executed code calling one of the hooked functions to download code, a return address of the called function is examined. If the return address is within a memory area not marked executable, the code is permitted to be downloaded and the downloaded code is submitted to a security server for analysis.

Collecting malware samples via unauthorized download protection

An security module includes a detection module for determining that an electronic message received for scanning includes a protected component. The security module also includes a parsing module for parsing the electronic message to identify potential passwords for the protected component. The security module further includes an analysis module for attempting to access the protected component of the electronic message using the identified potential passwords. A submission module submits potential passwords to a decomposition module for accessing the protected component. If the correct password is found, the decomposition module opens the protected component and/or extracts the contents of the archive. An analyzer module analyzes or scans the contents of the protected component.

Growing community of inventors

Whittier, CA, United States of America

Brendon Woirhaye