Bank of America Corporation

Christopher P Schafer

Sounil Yu

Elizabeth R Liuzzo

Michael Thomas Malarkey

Eric R Camarata

Systems and methods for enterprise cybersecurity triaging of emails suspected of malicious content. Triaging may include analyzing threat level of email submitted for cybersecurity review. The systems and methods may deconstruct an email into components scorable for threat type and/or threat level. The systems and methods may include multiple dynamically selectable threat scoring modules. Email threat level may be based on component scores. Evaluated emails and scored components may be stored. Cybersecurity threat analysis may include comparison of the email and/or the scorable components against previously stored evaluated emails and previously stored scored components. Triaging may include identifying enterprise response teams experienced in the threat type and/or threat level of the email and/or of its components. Triaging may include preventing infiltration of an enterprise by malicious emails. The systems and methods may include feedback to enterprise associates regarding detecting and handling potentially malicious emails.

Automated processing of suspicious emails submitted for review

Methods of analyzing malware and other suspicious files are presented, where some embodiments include analyzing the behavior of a first malware sample on both a virtual machine and a physical computing device, the physical device having been booted from a secondary boot source, and determining whether the behavior of the malware sample was different on the virtual machine and the physical computing device. In certain embodiments, a notification indicating that the behavior was different may be generated. In other embodiments, a malware analysis computing device that is configured to receive a base hard drive image may be network booted, and the behavior of the malware sample on the malware analysis computing device may be analyzed. In certain embodiments, a malware-infected hard drive image may then be copied off the malware analysis computing device.

Malware analysis methods and systems

Methods of analyzing malware and other suspicious files are presented, where some embodiments include analyzing the behavior of a first malware sample on both a virtual machine and a physical computing device, the physical device having been booted from a secondary boot source, and determining whether the behavior of the malware sample was different on the virtual machine and the physical computing device. In certain embodiments, a notification indicating that the behavior was different may be generated. In other embodiments, a malware analysis computing device that is configured to receive a base hard drive image may be networked booted, and the behavior of the malware sample on the malware analysis computing device may be analyzed. In certain embodiments, a malware-infected hard drive image may then be copied off the malware analysis computing device for further forensic analysis.

Growing community of inventors

Simi Valley, CA, United States of America

Christopher P Schafer