Symantec Corporation

Nortonlifelock Inc.

International Business Machines Corporation

Ca, Inc.

Christopher Gates

Kevin Alejandro Roundy

Michael Andrew Hart

Sandeep B Bhatkar

Anand Kashyap

Leylya Yumer

Aleatha Parker-Wood

Yin Liu

Youngja Park

Suresh N Chari

Daniel Kats

Yufei Han

Petrus Johannes Viljoen

Daniel Marino

Acar Tamersoy

Wilfried Teiken

Stephen Carl Gates

Brian T Witten

Matteo Dell'Amico

Nikolaos Vasiloglou

Bo Li

Yining Wang

Ian M Molloy

David Luz Silva

Saurabh Shintre

Yuqiong Sun

Mahmood Sharif

Dong Chung

Leylya Bilge

Shang-Tse Chen

Kyle Soska

The disclosed computer-implemented method for authenticating digital media content may include (i) receiving digital media content that has been captured by a capturing device and digitally signed through a cryptoprocessor embedded within the capturing device to provide an assurance of authenticity regarding how the capturing device captured the digital media content, and (ii) encoding an identifier of the received digital media content and a digital signature to an encrypted distributed ledger, the digital signature including at least one of a digital signature of the digital media content by the capturing device or a digital signature of the digital media content by an entity encoding the received digital media content such that the encoding becomes available for subsequent verification through the encrypted distributed ledger. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for authenticating digital media content

The disclosed computer-implemented method for detecting potentially malicious content in decentralized machine-learning model updates may include (i) receiving messages communicated within a group of client devices for performing an update of a shared machine-learning model, (ii) determining a bias of a target message in the messages communicated from a target client device in the group with respect to a remaining number of the messages in the messages communicated from the other client devices in the group, (iii) assigning a confidence score to each of the other client devices based on the bias determined for the target message, the confidence score representing a likelihood of potentially malicious content in the target message, and (iv) performing, based on the confidence score, a security action that prevents the potentially malicious content from compromising the update of the shared machine-learning model. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting potentially malicious content in decentralized machine-learning model updates

The disclosed computer-implemented method for verifying decentralized federated data using influence evaluation may include (i) calculate an influence score for each of a group of data instances, (ii) rank the data instances based on the influence scores, (iii) determine an anomaly score for each of the ranked data instances, (iv) select the ranked data instances with the highest anomaly scores as containing potentially malicious data, and (v) perform a security action that protects against the potentially malicious data. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for verifying decentralized federated data using influence evaluation

The present disclosure relates to using correlations between support interaction data and telemetry data to discover emerging incidents for remediation. One example method generally includes receiving a corpus of support interaction data and a corpus of telemetry data. Topics indicative of underlying problems experienced by users of an application are extracted from the corpus of support interaction data. A topic having a rate of appearance in the support interaction data above a threshold value is identified. A set of telemetry data relevant to the topic is extracted from the corpus of telemetry data, and a subset of the relevant set of telemetry data having a frequency in the relevant set of telemetry data above a second threshold value is identified. The topic and the subset of telemetry data are correlated to an incident to be remediated, and one or more actions are taken to remedy the incident.

Discovery of computer system incidents to be remediated based on correlation between support interaction data and computer system telemetry data

The disclosed method for assuring authenticity of electronic sensor data may include (i) capturing, using a sensor within a device, electronic sensor data, and (ii) digitally signing, using a cryptoprocessor embedded within the device, the electronic sensor data to create a digital signature that verifies that the signed electronic sensor data has not been modified since the electronic sensor data was captured by the sensor. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for assuring authenticity of electronic sensor data

Automatically estimating a sensitivity level of an information technology (IT) asset in one aspect may obtain information about an asset. Characteristics of the asset assigned based on the information may be compared with stored characteristics of known sensitive assets. A sensitivity level of the asset may be determined based on the comparing.

Estimating asset sensitivity using information associated with users

A computer system stores incident records in a database. When a user wants to resolve a particular current incident, the computer system will access the current incident record from an incident queue. The computer system also identifies historical incident records that share one or more attributes with the current incident record. The computer system creates a plurality of clusters from the current incident record and the selected historical incident records. The clusters are then arranged into a hierarchical tree. This hierarchical tree is presented in a graphical user interface. A user can select a node to access additional information for that node. The computer system generates a first suggested response to a particular current incident based on the incident records included in the selected node. The computer system presents the first suggested response to the particular current incident in a graphical user interface.

Efficient incident response through tree-based visualizations of hierarchical clustering

The disclosed computer-implemented method for evaluating unfamiliar executables may include (i) identifying, on the computing device, (a) a code object that is generated from source code written in a programming language, that is specified in an intermediate language different from the programming language, and that can be compiled into an executable file by a just-in-time compiler on the computing device and (b) an executable file that lacks an assigned reputation in a reputation system that distinguishes benign and malicious files, (ii) determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device, (iii) retrieving, from the reputation system, a reputation for the code object, and (iv) performing a security action on the executable file that is based on the reputation of the code object. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for evaluating unfamiliar executables

Securing a network device by automatically identifying files belonging to an application. In one embodiment, a method may include collecting file attributes for multiple files from multiple network devices, examining a hash of file contents of each of the multiple files to identify multiple unique files in the multiple files, summarizing the file attributes for each of the multiple unique files to generate a sketch of file attributes for each of the multiple unique files, clustering the multiple unique files into multiple applications, making a security action decision for one application of the multiple applications, and performing a security action on a network device based on the security action decision.

Securing a network device by automatically identifying files belonging to an application

Encrypting and decrypting sensitive files on a network device. In one embodiment, a method may include determining that a file stored on a network device is a sensitive file, encrypting the sensitive file, sending, to an authentication server, an encryption key, initializing, at the network device, a Software Guard Extension (SGX) enclave, loading, into the SGX enclave, a retrieval application, receiving, at the retrieval application, an attestation from the authentication server that the retrieval application is authentic, receiving, at the retrieval application, the encryption key from the authentication server, receiving, at the retrieval application, a user request to decrypt the encrypted sensitive file, authenticating, at the retrieval application, the user request, decrypting, at the network device, the particular encrypted sensitive file, and providing the sensitive file to the user.

Encrypting and decrypting sensitive files on a network device

The disclosed computer-implemented method for making security-related predictions may include (i) gathering information that comprises both signatures of events that occurred on computing systems during consecutive time slots and incident labels about incidents on the computing systems during the consecutive time slots, (ii) using the gathered information to train a machine learning model, (iii) predicting, by the machine learning model, at least one of an incident label about an incident and a signature of an event on a computing system during a time slot, wherein the computing system does not comprise at least one of an application capable of generating the signature and information about events occurring during the time slot due to the time slot having not yet occurred, and (iv) performing an action in response to the prediction. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for making security-related predictions

The disclosed computer-implemented method for dynamically validating remote requests within enterprise networks may include (1) receiving, on a target system within an enterprise network, a request to access a portion of the target system from a remote system within the enterprise network, (2) performing a validation operation to determine whether the remote system is trustworthy to access the portion of the target system by (A) querying an enterprise security system to authorize the request from the remote system and (B) receiving, from the enterprise security system in response to the query, a notification indicating whether the remote system is trustworthy to access the portion of the target system, and then (3) determining whether to grant the request based at least in part on the notification received from the enterprise security system as part of the validation operation. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for dynamically validating remote requests within enterprise networks

A method for providing security recommendations is described. In one embodiment, the method may include identifying a set of monitored customers. In some cases, each monitored customer may include one or more computing devices. The method may include identifying a first computing device of a monitored customer for evaluation, selecting a potential security product to install on the first computing device, and quantifying the ability of the monitored customer to detect or prevent malware incidents based at least in part on the selected potential security product.

Security recommendations based on incidents of malware

The disclosed computer-implemented method for automated whitelisting of files may include (1) obtaining telemetry information that identifies files located on a set of computing systems, (2) establishing a whitelist of files for the set of computing systems by, for each file identified by the telemetry information, (A) calculating an amount by which a cost for using the whitelist will increase if the file is included in the whitelist, (B) calculating an amount by which whitelist coverage of files in the set of computing devices will increase if the file is included in the whitelist, (C) determining whether to include the file in the whitelist by balancing the increase in the cost against the increase in whitelist coverage, and (3) using the whitelist to protect the set of computing systems from undesirable files. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Culver City, CA, United States of America

Christopher Gates