Fireeye, Inc.

Mandiant Corporation

Chunsheng Fang

Wei Quan

Robert Venal

Vikram Hegde

Benjamin Chang

Daniel Bohannon

Richard Lai

The presently disclosed subject matter includes a system for monitoring a set of command lines or calls to executable scripts configured to be executed by an operating system. Each command line from the set of command lines is associated with an executable script configured to be executed by an operating system. The apparatus classifies, via a machine learning model, a command line from the set of command lines into an obfuscation category and prevents the operating system from executing the command line and generates a notification signal when the obfuscation category indicates that the command line is part of a cybersecurity attack. The apparatus allows the operating system to execute the command line or call to the executable script when the obfuscation category indicates that the command line is not part of a cybersecurity attack.

Methods and apparatus for detecting and preventing obfuscated cyberattacks using machine learning techniques

A method for generating rule recommendation utilized in a creation of malware detection rules is described. Meta-information associated with a plurality of events collected during a malware detection analysis of an object by a cybersecurity system is received and a first plurality of features is selected from the received meta-information. Machine learning (ML) models are applied to each of the first plurality of features to generate a score that represents a level of maliciousness for the feature and thereby a degree of usefulness of the feature in classifying the object as malicious or benign. Thereafter, a second plurality of features is selected as the salient features, which are used in creation of the malware detection rules in controlling subsequent operations of the cybersecurity system. The second plurality of features being lesser in number that the first plurality of features.

System and method for automatically generating malware detection rule recommendations

A method for detecting a cyberattack on a network device is described. The method features receiving script text and performing a normalization operation on the script text to produce a normalized script text. The normalized script text includes a plurality of analytic tokens each being an instance of a sequence of characters grouped together as a useful semantic unit for natural language processing (NLP). Thereafter, a NLP model is applied to the normalized script text to classify a script associated with the script text as malicious or benign. Responsive to the script being classified as malicious, generating an alert message provided to an administrator to identify the malicious script.

System and method for detecting malicious scripts through natural language processing modeling

Growing community of inventors

Mountain View, CA, United States of America

Chunsheng Fang