Mcafee, Inc.

Musarubra US LLC

Cedric Cochin

Igor G Muttik

Joel Robert Spurlock

Craig D Schmugar

Ned M Smith

John Douglas Teddy

Carl D Woodward

Aditya Kapoor

Christiaan Beek

Yury Bulygin

Jonathan Lewis Edwards

Robert L Vaughn

German Lancioni

James Douglas Bean

Rachit Mathur

Vincent J Zimmer

David M Durham

Glen J Anderson

Rajesh Poornachandran

Simon R Hunt

Jonathan B King

Ofir Arkin

Ramnath Venugopalan

Mark E Scott-Nash

Andrew A Furtak

Adam James Carrivick

John J Loucaides

Oleksander Bazhaniuk

Ronald Gallella

Gregory Michael Heitzmann

Robert Leong

Ravi L Sahita

Tobias Max Kohlenberg

Kunal Mehta

Nitin Jyoti

Vinoo Thomas

Sriranga Seetharamaiah

Timothy J Gresham

Harvir Singh

Sorcha Bairbre Healy

David Neill Beveridge

Gerard Donal Murphy

Priyadarshini Rao Rajan

Tracy E Camp

David McCormack

Arpit Pradhan

Bidan Sinha

Arun Chundiriyil Pullat

Craig Schumgar

Particular embodiments described herein provide for modular device assemblies and methods for enabling maintenance and servicing, particularly by an unmanned aerial vehicle. A device assembly comprises a plurality of modules, each module having control circuitry, a communications port and contact points to couple the modules. When the modules are coupled, the communications ports are connected to create a bus for communications between the modules. The modular device structure where modules are removable and replaceable allows for an unmanned aerial vehicle to perform maintenance on the device.

Apparatus and methods for unmanned aerial vehicle servicing of modular device assembly

Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.

Mitigation of ransomware

Methods, apparatus, systems, and articles of manufacture to provide and monitor efficacy of artificial intelligence models are disclosed. An example apparatus includes a model trainer to train an artificial intelligence (AI) model to classify malware using first training data; an interface to deploy the AI model to a processing device; a model implementor to locally apply second training data to the AI model to generate output classifications, the second training data generated after generation of the first training data; and a report generator to generate a report including an efficacy of the AI model based on the output classifications.

Methods and apparatus to provide and monitor efficacy of artificial intelligence models

Pairing of an external device using a random user action is disclosed herein. An example method includes restricting the external device from accessing a resource. A user input receivable from the external device is identified based on a type of the external device, the user input not included in a list of previously generated user actions. In response to receipt of the user input from the external device within a threshold time period, the external device is authorized to access the resource.

Pairing of external device with random user action

There is disclosed in one example a computing apparatus, including: a processor and a memory; a uniform resource locator (URL) reputation store; a network interface; and instructions encoded within the memory to instruct the processor to: receive via the network interface a request for a reputation for a URL; query the URL reputation store and determine that the URL does not have a known reliable reputation; add the URL to a URL analysis queue; perform a rough analysis of the URL, and determine from the rough analysis that the URL potentially is for a phishing website; and move the URL ahead in the analysis queue.

Expedition of web phishing detection for suspicious sites

Methods, apparatus, systems and articles of manufacture are disclosed to identify and report cloud-based security vulnerabilities. An apparatus comprising: a security vulnerability detector to, in response to a resource monitor monitoring a threshold amount of activity in a resource of a cloud computing environment, determine one or more security vulnerabilities associated with the resource and the cloud computing environment; a vulnerability processor to correlate the one or more security vulnerabilities with one or more kill chains to exploit at least one security vulnerability in the cloud computing environment; and a report generator to generate a report including a story graph indicating a subset of at least one of: (a) the one or more security vulnerabilities associated with the one or more kill chains, (b) one or more remediation actions to obviate the one or more security vulnerabilities, or (c) threat intelligence feeds associated with the one or more security vulnerabilities.

Methods and apparatus to identify and report cloud-based security vulnerabilities

Disclosed herein are distributed ledger systems and methods for efficiently creating and updating a query optimized distributed ledger. In particular, the present disclosure introduces methods and apparatuses for efficiently updating indexes when new blocks are added to the distributed ledger by using snapshots of data and appending new snapshot tables and indexes to previous snapshot tables and indexes.

Query optimized distributed ledger system

There is disclosed in one example a computing apparatus, including: a processor and a memory; a network interface to communicatively couple to a backup client; a storage to receive backup data from the client, including a plurality of versions and an associated reputation for each version, the associated reputation to indicate a probability that the version is valid; and instructions encoded within the memory to instruct the processor to: receive from the backup client a request to store a new version of the backup data; determine that the client has exceeded a backup threshold; identify a backup version having a lowest reputation for validity; and expunge the backup version having the lowest reputation for validity.

Intelligent backup and versioning

There is disclosed in one example a computing apparatus, including: a hardware platform; and a storage medium having stored thereon executable instructions to provide an inference engine configured to: receive a new suspicious fragment object from a protected device; add the new suspicious fragment object to a rolling map configured to provide a temporal snapshot of suspicious fragment objects over a time span; determine a connection between the new suspicious fragment object and an existing suspicious fragment object within the rolling map; apply the connection to a connection map; and operate a map classifier to determine that the connection map represents a probable computer security threat.

Detection and mitigation of fileless security threats

Particular embodiments described herein provide for a system that can be configured to communicate chat session data during a chat session to a first display of a first electronic device, communicate the chat session data during the chat session to a second display of a second electronic device, receive sensitive data during the chat session from the first electronic device, and protect the sensitive data from being displayed on the second display during the chat session without breaking continuity of the chat session.

Protection of sensitive chat data

A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide 'content-less' malware detection, i.e., detecting a process as being an 'anomaly' not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) 'trusted' application behaviors, i.e., the trusted applications' 'phenotypes' and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e., &#x201c;application phenotypes&#x201d;)&#x2014;and later compare the processes executed on a user device to the stored behavioral models to determine whether the actual measured behavior reflects a &#x201c;good&#x201d; application, or if it differs from the stored behavioral models to a sufficient degree and with a sufficient degree of confidence, thus indicating a potentially malicious application or behavior.

Application phenotyping

Particular embodiments described herein provide for an electronic device that can be configured to identifying a digital certificate associated with data and assigning a reputation to the digital certificate, where the digital certificate is classified as trusted if the digital certificate is included in an entry in a whitelist and the digital certificate is classified as untrusted if the digital certificate is included in an entry in a blacklist.

Determining the reputation of a digital certificate

A technique for detecting malware looks at startup hooks that may be created by malware to assist in ensuring that the malware is started upon a reboot of a programmable device. After enumerating startup hooks in the system, startup hooks associated with untrusted executables are deleted. If the startup hook is restored, that is an indication that the untrusted executable may be malware. An indication may then be passed to an anti-malware software to analyze the executable further.

Persistence probing to detect malware

Growing community of inventors

Portland, OR, United States of America

Cedric Cochin