Microsoft Technology Licensing, LLC

Microsfot Corporation

Cormac E Herley

Dinei A Florencio

Paul England

John Carlton Platt

Stuart Schechter

Erin L Renshaw

Jack W Stokes

Chris J Burges

Jayadev Pillai

Gang Wang

David Kemal Felstead

Fang Tu

Charles W Kaufman

Scott Field

Daniel Chaim Robbins

Paul A Viola

Adrian Mihail Marinescu

Yordan Ivanov Rouskov

Kumar Hemachandra Chellapilla

Alice Jane Bernheim Brush

Christopher J C Burges

Thekkthalackal Varugis Kurien

Michael D Mitzenmacher

Arindam Chatterjee

Trausti Thor Kristjansson

Jeffrey S Williams

Max Chickering

Cheng Cao

Jonathan C Platt

Aaron Michael Hulett

Stanislav Nurilov

Brian W Keogh

Methods for detecting and mitigating abusive network activity based on versioned browser usage are performed by systems and devices. Usage values for network activity of legacy web browser versions are determined, where the usage values represent benign network activity associated with active instances of the legacy versions over prior time periods. The number of active instances of legacy browser versions is assumed to generally be monotonically decreasing over time, and thus a bound of benign network activity for each of the legacy versions can be estimated by associating an approximate percentage of benign traffic with a minimum past usage value. Current network activity is monitored to determine current usage values for the legacy versions, and network actions are performed based on current usage values deviating from past usage values according to the bound.

Detecting and mitigating abusive network activity based on versioned browser usage

A bot traffic detection system detects scripted network traffic. The bot traffic detection system may use a one-sided unsupervised machine learning technique to estimate distributions for human, non-scripted traffic (clean distributions). The clean distributions may be dynamically updated based on the latest traffic patterns. To estimate the clean distributions the bot traffic detection system may identify, for a certain subset of network traffic, feature values of the certain subset of network traffic that do not include bot traffic (clean buckets). Using clean traffic may provide more robust and stable behavior that can be tracked over time. Using the clean distributions, the bot traffic detection system may generate a rules table that indicates a likelihood that network traffic with a given combination of feature values is scripted network traffic. The bot traffic detection system may apply the rules table in real time to identify scripted network traffic.

Method and apparatus to detect scripted network traffic

Web traffic at different geographic traffic distribution buckets are compared against each other to try and machine-learn the underlying traffic parameters of legitimate (human-initiated) traffic. Distributions of the traffic parameters for the web traffic at multiple servers are compared to see whether they match. If so, matching or substantially matching traffic parameters signal that such web traffic is, in fact, legitimate. A clean profile is built with the matching traffic parameters and used to determine how much bot traffic is resident in web traffic at different servers.

Distinguishing bot traffic from human traffic

Technologies pertaining to analyzing content extracted from web pages by a static crawler to determine whether respective web pages are members of a malware distribution network (MDN) are described. A set of features is learned based upon output of a dynamic crawler over known landing pages of a particular MDN, wherein the set of features are indicative of membership in the MDN. Using such set of features, additional members of the MDN (not subjected to crawling by a dynamic crawler) are identified.

Identifying web pages in malware distribution networks

Systems and methods that establish a secured compartment that manages sensitive user transactions/information on a user's machine. The secured compartment qualifies user interaction with the machine, and separates such qualified interaction from other user activity on the machine. A user is switched to such secured compartment upon occurrence of a predetermined event, such as in form of: an explicit request (e.g., a secure attention sequence); an implicit request (e.g., inference of user activities); and presence of a peripheral device that is bound to the secured compartment (e.g., a USB)&#x2014;wherein such actions typically cannot be generated by an application running outside the secured compartment.

Secured compartment for transactions

Techniques to provide evidence-based dynamic scoring to limit guesses in knowledge based authentication are disclosed herein. In some aspects, an authenticator may receive an input from a user in response to a presentation of a personal question that enables user access to a restricted resource. The authenticator may determine that the input is not equivalent to a stored value, and thus is an incorrect input. The authenticator may then determine whether the input is similar to a previous input received from the user. A score may be assigned to the input. When the input is determined to be similar to the previous input, the score may be reduced. Another request for an input may be transmitted by the authenticator when a sum of the score and any previous scores of the session is less than a threshold.

Evidence-based dynamic scoring to limit guesses in knowledge-based authentication

A system and method that facilitates and effectuates detection of malware secreted and/or hidden in plain sight on a machine. The system and method in order to achieve its aims generates a list of all loaded modules, identifies from the list a set of modules common to more than a threshold number of processes, and eliminates from the list those modules included in an authentication list. The resultant list is prioritized based, in one instance, on the number of occurrences a particular module makes in the resultant list, and thereafter the list is distributed analyst workstations.

Spyware detection mechanism

A popularity determination module (PDM) is described which reduces the effectiveness of statistical guessing attacks. The PDM operates by receiving a password (or other secret information item) from a user. The PDM uses a model to determine whether the password is popular among a group of users. If so, the PDM may ask the user to select another password. In one implementation, the model corresponds to a probabilistic model, such a count-min sketch model. The probabilistic model provides an upper-bound assessment of a number of times that a password has been encountered. Further, the probabilistic model provides false positives (in which passwords are falsely assessed as popular) at a rate that exceeds a prescribed minimum rate. The false positives are leveraged to reduce the effectiveness of statistical guessing attacks by malicious entities.

Use of popularity information to reduce risk posed by guessing attacks

A current prefix character string representing a prefix of a proposed password may be obtained from a user input device. A prediction of a most likely next character of the proposed password may be determined, based on applying a set of heuristics to the current prefix character string. A response indicating an impact on a security strength of the proposed password may be determined, based on a selection of the predicted most likely next character.

Predicting next characters in password generation

Implementations can be used to initiate a query for information regarding a dialog prompt or other pop-up type of prompt or image. Further, implementations may use hash values in proxy for images to enable aggregating of images for creating a knowledge base regarding certain images determined to be of interest.

Querying dialog prompts using hash values

Confidential information is provided to a proxy computer in communication between an unsecured computer and a computer having information desired by a user. The proxy computer receives the confidential information in either an encrypted form or having arbitrary information combined therewith. The proxy computer ascertains the confidential information and forwards it to the computer having the information desired by the user.

Entering confidential information on an untrusted machine

A phishing detection client component and method is provided. The component can be employed as part of a system to detect and, optionally, prevent phishing attacks. The phishing detection client component can provide password reuse event report(s), for example, to a phishing detection server component. The client component can further include a credential component that can track use of credentials by a user and determine whether a specific security credential is being used or presented. Due to the malicious nature of phishing in general, the client component can be susceptible to attacks by phishers. For example, phishers can generate false logins in an attempt to flood the client component with information resulting in induced false positives and/or induced false negatives. The client component can perform one or more checks to determine whether false login(s) have been attempted.

Client side attack resistant phishing detection

The claimed subject matter provides systems and/or methods that facilitate utilizing a shared secret to obscure a password within a sequence of characters. The sequence of characters can include the password as well as noise. The shared secret can leverage utilizing a set of known images that a user can uniquely distinguish from random images. By employing the imaged based shared secret, the user can login to a server from an untrusted machine suspected to be infected with spyware such as a keylogger that tracks user input.

Image based shared secret proxy for secure password entry

Systems and methods facilitate secure one-time-password access to an account in a remote server from an untrusted client. The system consists of an intermediary component whose salient components are a proxy component, a webserver component, and an encryption/decryption component, and it preserves the characteristics of both the server and client. In a man-in-the-middle fashion, the proxy substitutes a one-time password entered at a login interface with a true password, and forwards it to the remote login server. True passwords are encrypted using a seed associated with user identifiers, and a list of one-time passwords is generated/updated and stored on media or transmitted to an electronic device. Substitution takes place by decrypting the one-time password with the seed used for encryption, ensuring the proxy avoids storing the true password.

Growing community of inventors

Bellevue, WA, United States of America

Cormac E Herley