Mcafee, Inc.

Intel Corporation

Carl D Woodward

Kunal Mehta

Sherin Mary Mathews

German Lancioni

Jonathan B King

Celeste R Fralick

Dmitri Rubakha

Steven L Grobman

Cedric Cochin

Ryan M Durand

Joel Robert Spurlock

Jennifer Eligius Mankin

Simon R Hunt

Vadim Sukhomlinov

Venkata Ramanan Sambandam

Sriranga Seetharamaiah

Igor G Muttik

Alex Nayshtut

Koichi Yamada

John Douglas Teddy

James Douglas Bean

Craig D Schmugar

Yuriy Bulygin

Ofir Arkin

Palanivelrajan Rajan Shanmugavelayutham

Andrew A Furtak

Oleksandr Bazhaniuk

Christiaan Beek

Yury Bulygin

Lynda M Grindstaff

Andrew V Holtzmann

Sevin F Varoglu

John J Loucaides

Oleksander Bazhaniuk

Ronald Gallella

Dima Mirkin

Gregory Michael Heitzmann

Vaisakh Shaj

Adam James Carrivick

Ned M Smith

Jonathan Lewis Edwards

Jeremy F Bennett

Steve Grobman

James D Beaney, Jr

Palanivel Rajan Shanmugavelayutham

Jimmy Scott Raynor

Amanda House

Utkarsh Verma

Fernando Ruiz

Mario Leandro Bertogna

Vincent Weafer

Alan Krassowski

Adrian M Dunbar

Michael Hughes

Kantheti Vvsmb Kumar

Kantheti V V S M B Kumar

Methods, apparatus, systems, and articles of manufacture are disclosed to improve offloading of malware scans. An example apparatus is to, based on a trigger to perform a scan of a volume of data, estimate a computational burden associated with performing the scan using the CPU, the volume of data representative of at least one of a file or an object. Additionally, the example apparatus is to determine whether the computational burden satisfies a threshold associated with offloading the scan to the GPU. The example apparatus is also to cause at least one of the CPU or the GPU to perform the scan based on whether the computational burden satisfies the threshold.

Methods, apparatus, and articles of manufacture to improve offloading of malware scans

There is disclosed in one example a ransomware mitigation engine, including: a processor; a convolutional neural network configured to provide file type identification (FTI) services including: identifying an access operation of a file as a write to the file or newly creating the file; computing a byte correlation factor for the file; classifying the file as belonging to a file type; determining with a screening confidence that the file type is correct for the file; determining that the screening confidence is below a screening confidence threshold; and circuitry and logic to provide heuristic analysis including: receiving notification that the confidence is below the confidence threshold; performing a statistical analysis of the file to determine a difference between an expected value and a computed value; determining from the difference, with a detection confidence, that the file has been compromised; and identifying the file as having been compromised by a ransomware attack.

Detecting ransomware

Methods, systems, and media for detecting anomalous network activity are provided. In some embodiments, a method for detecting anomalous network activity is provided, the method comprising: receiving information indicating network activity, wherein the information includes IP addresses corresponding to devices participating in the network activity; generating a graph representing the network activity, wherein each node of the graph indicates an IP address of a device; generating a representation of the graph, wherein the representation of the graph reduces a dimensionality of information indicated in the graph; identifying a plurality of clusters of network activity based on the representation of the graph; determining that at least one cluster corresponds to anomalous network activity; and in response to determining that the at least one cluster corresponds to anomalous network activity, causing a network connection of at least one device included in the at least one cluster to be blocked.

Methods, systems, and media for detecting anomalous network activity

Methods, apparatus, systems, and articles of manufacture are disclosed to classify a sample as clean or malicious. An example apparatus includes instruction identifies circuitry to convert a sample into a sequence of instructions, abstract language circuitry to transform the sequence of instructions into an abstract language representation, transition matrix circuitry to create a Markov transition matrix, the Markov transition matrix to represent transitions within the abstract language representation, and classifier circuitry to classify an unknown sample as clean or malicious, the classification in response to whether the Markov transition matrix is closer to a clean group of Markov transition matrices or a malicious group of Markov transition matrices.

Methods and apparatus to classify samples as clean or malicious using low level Markov transition matrices

Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.

Mitigation of ransomware

A method for halting malware includes: monitoring plural file system events with a system driver to detect an occurrence of a file system event having a predetermined file type and log event type; triggering a listening engine for file system event stream data of a file associated with the detection of the file system event, the file system event stream data indicating data manipulation associated with the file due to execution of a process; obtaining one or more feature values for each of plural different feature combinations of plural features of the file based on the file system event stream data; inputting one or more feature values into a data analytics model to predict a target label value based on the one or more feature values of the plural different feature combinations and agnostic to the process; and performing a predetermined operation based on the target label value.

Model development and application to identify and halt malware

Methods, apparatus, systems and articles of manufacture are disclosed to detect deepfake content. An example apparatus to determine whether input media is authentic includes a classifier to generate a first probability based on a first output of a local binary model manager, a second probability based on a second output of a filter model manager, and a third probability based on a third output of an image quality assessor, a score analyzer to obtain the first, second, and third probabilities from the classifier, and in response to obtaining a first result and a second result, generate a score indicative of whether the input media is authentic based on the first result, the second result, the first probability, the second probability, and the third probability.

Methods and apparatus to detect deepfake content

There is disclosed in one example a computer-implemented anti-ransomware method, including: selecting a file for inspection; assigning the file to a type class according to a file type identifier; receiving an expected byte correlation for the type class; computing, according to a byte distribution of the file, a byte correlation for the file; comparing, via statistical analysis, the byte correlation to the expected byte correlation; and determining that the file has been compromised, including determining that the file has a byte correlation that deviates from the expected byte correlation by more than a threshold, taking a ransomware remediation action for the file.

Particular embodiments described herein provide for an electronic device that can be configured to identify a file, determine a polyglotness score for the file, where the polyglotness score is an indicator of whether or not the file is a polyglot file, and analyze the file for the presence of malware if the polyglotness score satisfies threshold.

Detection of malicious polyglot files

A first storage device or first storage disk including first executable instructions that, when executed, cause a processor to at least: in response to determining a variable associated with a memory page that (1) has been loaded into local memory from a second storage device and (2) has been accessed from the local memory, has a first state, identify the memory page as a modified memory page, the memory page including second executable instructions. The first instructions also cause the processor to, in response to determining the second executable instructions of the modified memory page have been changed since a previous analysis of the modified memory page, perform anti-malware analysis of at least a portion of the modified memory page.

Detecting execution of modified executable code

A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.

Hardware heuristic-driven binary translation-based execution analysis for return-oriented programming malware detection

Methods, systems, and media for protecting computer networks using adaptive workloads are provided. In some embodiments, the method comprises: transmitting, to a first server, an indication of a status of resources available to a user device; receiving a workload distribution that indicates an amount of work to be performed by the user device, wherein the amount of work is determined based on the status of resources; determining that a site is to be accessed by the user device; generating an analysis that includes one or more values indicating the safety of the site; transmitting the analysis to a second server at which a remaining amount of work is to be performed; based on the remaining amount of work, determining that the site is to be blocked from being accessed by the user device; and blocking the site from being accessed by the user device.

Methods, systems, and media for protecting computer networks using adaptive security workloads

There is disclosed in one example a computing apparatus, including: a processor; and logic encoded into one or more computer-readable mediums, the logic to instruct the processor to: capture first data from an intermediate data source across a first temporal interval; perform partial signal processing on the first data to classify the first temporal interval as either suspicious or not suspicious, wherein the first temporal interval is classified as suspicious if it is determined to potentially represent at least a portion of a cryptomining operation; classify second through N temporal intervals as either suspicious or not suspicious; based on the first through N temporal intervals, classify the apparatus as either operating a cryptomining function or not; and upon classifying the apparatus as operating a cryptomining function and determining that the cryptomining function is not authorized, take remedial action on the apparatus.

Cryptojacking detection

A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide 'content-less' malware detection, i.e., detecting a process as being an 'anomaly' not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) 'trusted' application behaviors, i.e., the trusted applications' 'phenotypes' and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e., &#x201c;application phenotypes&#x201d;)&#x2014;and later compare the processes executed on a user device to the stored behavioral models to determine whether the actual measured behavior reflects a &#x201c;good&#x201d; application, or if it differs from the stored behavioral models to a sufficient degree and with a sufficient degree of confidence, thus indicating a potentially malicious application or behavior.

Application phenotyping

Growing community of inventors

Santa Clara, CA, United States of America

Carl D Woodward