Mcafee, Inc.

Chintan H Shah

Vinay Mahadik

Bharath Madhusudan

Ravindra Balupari

Ravindra H Balupari

Mechanisms, which can include systems, method, and media, for protecting network devices from malicious rich text format (RTF) files are provided, the mechanisms comprising: intercepting an RTF file destined for a network device; parsing the RTF file to identify a plurality of objects in the RTF file; checking a first object of the plurality of objects for a first heuristic; based upon an outcome of the checking of the first object for the first heuristic, increasing a cumulative weight by a first weight value; comparing the cumulative weight against at least one threshold to classify the RTF file; and based on the classification of the RTF file, taking a protective action on the RTF file.

System, methods, and media for protecting network devices from malicious rich text format (RTF) files

Methods, apparatus, systems and articles of manufacture are disclosed to detect an attack in an input file. An example apparatus includes a detection controller to identify a section of a number of bytes of data in a buffer including a first or second byte of data indicative of a value within a preconfigured range, the preconfigured range corresponding to a range of values indicative of memory addresses, update a merged list with a chunk of data that includes the section having the first or second byte of data indicative of the value within the preconfigured range, and a reoccurrence detector to concatenate the chunk of data in the merged list into a string to identify a number of occurrences the string matches remaining data in the buffer, and in response to a detection of the number of occurrences exceeding an occurrence threshold, determine that the data includes a malicious data stream.

Methods and apparatus for network detection of malicious data streams inside binary files

A method is provided in one example embodiment that includes detecting repetitive connections from a source node to a destination node, calculating a score for the source node based on the connections, and taking a policy action if the score exceeds a threshold score. In more particular embodiments, the repetitive connections use a hypertext transfer protocol and may include connections to a small number of unique domains, connections to small number of unique resources associated with the destination node, and/or a large number of connections to a resource in a domain. Moreover, heuristics may be used to score the source node and identify behavior indicative of a threat, such as a bot or other malware.

Growing community of inventors

Gujarat, India

Chintan H Shah