Symantec Corporation

Ca, Inc.

Nortonlifelock Inc.

David Kane

Haik A Mesropian

Chengi Jimmy Kuo

Wilson Meng

Petrus Johannes Viljoen

Sonia Subramanian

Mark Kevin Kennedy

Joseph Chen

Adam Glick

Spencer Dale Smith

Peter Ferrie

Patrick Gardner

Mark Spiegel

Robert Conrad

David Buches

Jordan Saxonberg

Daniel Asheghian

Nivedhitha Raman

Shaun Aimoto

Qubo Song

Costin Ionescu

Yung-Shuo Lin

Robert Spath

A method for improving security of peripheral devices is described. The method includes displaying, by a processor of a computing device, a code, receiving, by the processor, a user input after displaying the code, comparing, by the processor, the user input to the displayed code, and establishing, by the processor, secure communication between a peripheral device and a software application at the computing device based at least in part on a result of the comparing the user input to the displayed code.

Secure computer peripheral devices

The disclosed computer-implemented method for managing endpoint security states using passive data integrity attestations may include (i) receiving passively collected network data from an endpoint device of a computing environment, (ii) determining a security state of the endpoint device using the passively collected network data from the endpoint device, (iii) determining that the security state of the endpoint device is below a threshold, and (iv) in response to determining that the security state of the endpoint device is below a threshold, performing a security action to protect the computing environment against malicious actions. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing endpoint security states using passive data integrity attestations

The disclosed computer-implemented method for managing security programs may include (i) identifying a security program configured to analyze files on a client device to detect malicious files, (ii) determining a result the security program would report for an analysis of a file on the client device, (iii) intercepting an attempt by the security program to analyze the file, and (iv) determining, based on the result the security program would report for the analysis of the file, whether to permit the security program to analyze the file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing security programs

A method for improving security of peripheral devices is described. In one embodiment, the method includes sending, by a processor of a peripheral device, at least one packet of data to an operating system of a computing device, identifying, by the processor, execution of a software application on the computing device, performing, by the processor, a handshake protocol between the secure input device and the software application based at least in part on the execution of the software application, and establishing, by the processor, a secure session over a secure channel between the secure input device and the software application based at least in part on the handshake protocol. In some cases, the at least one packet of data identifies the peripheral device to the operating system as two or more peripheral devices such as a default input device and a secure input device.

The disclosed computer-implemented method for restarting computing devices into security-application-configured safe modes may include (1) configuring a security application to recognize a predetermined signal received via a predetermined hardware device that indicates that a user wants to restart the computing device into a security-application-configured safe mode that prevents suspicious applications from loading, (2) detecting the predetermined signal via an instance of the predetermined hardware device that is connected to the computing device, (3) setting, in response to detecting the predetermined signal, a registry key on the computing device that will instruct the computing device to boot into the security-application-configured safe mode during a restart sequence, and (4) restarting the computing device in the security-application-configured safe mode in response to detecting the registry key during the restart sequence. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for restarting computing devices into security-application-configured safe modes

Techniques are presented for detecting malware in an executable. The method includes receiving an executable to evaluate for malware, emulating an execution of the executable up to a first count of instructions, determining a number of cache misses that occur while emulating the executable up to the first count of instructions, comparing the number of cache misses to a threshold, and upon determining the number of cache misses exceeds the threshold, identifying the executable as potentially containing malware.

Detect encrypted program based on CPU statistics

A computer-implemented method for securely managing file-attribute information for files in a file system may comprise: 1) identifying at least one file, 2) identifying file-attribute information that identifies at least one file attribute for the file, 3) identifying volatile metadata associated with the file that contains file-attribute information, 4) determining that the file has been modified, and 5) automatically deleting the volatile metadata. Corresponding systems and computer-readable media are also disclosed.

Methods and systems for securely managing file-attribute information for files in a file system

Injected threads are tracked to detect malware that injects malicious code into the address space of a legitimate process. Relationships between threads of processes executing on a client and files stored by the client are mapped to identify files that create threads in executing processes. The address space of a process is analyzed to identify legitimate memory regions in the address space. A suspicious thread referencing a suspicious memory region of the address space outside of the legitimate memory regions is identified. The suspicious memory region is scanned to identify malware. The mapped relationships are used to identify the file that created the thread that referenced the address space in which the malware was identified. The malware in the file is remediated.

Tracking injected threads to remediate malware

A malware detection agent operating on a computing device detects one or more indicators of a potential data loss threat. Sensitive data is identified based on at least one of a logical location or a physical location of the sensitive data. One or more data loss prevention policies are enabled to protect the sensitive data until the potential data loss threat is resolved.

Data loss prevention in the event of malware detection

A computer-implemented method for using file paths to identify potentially malicious computer files may include: 1) identifying a file, 2) identifying a file path associated with the file, 3) determining, by applying a heuristic to the file, that at least a portion of the file path is likely to have been randomly generated, 4) determining, based at least in part on the determination that at least portion of the file path has likely been randomly generated, that the file is potentially malicious, and 5) performing a security operation on the file. Corresponding systems and computer-readable instructions embodied on computer-readable media are also disclosed.

Systems and methods for using file paths to identify potentially malicious computer files

A computer-implemented method for repairing system files may include 1) identifying a request to repair a corrupted system file in an operating system, 2) receiving file metadata describing the corrupted system file and system metadata describing the operating system, 3) identifying an uncorrupted version of the corrupted system file by i) identifying a series of matching tests for matching the corrupted system file with the uncorrupted version, the series of matching tests including at least one file metadata item from the file metadata and at least one system metadata item from the system metadata, and ii) applying the series of matching tests in a predetermined order to a database of uncorrupted system files until a matching test matches the corrupted system file with the uncorrupted version of the system file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for repairing system files

A computer-implemented method for automatically adding an Internet domain to a blacklist based on monitored activities of an application is described. An application running on a client computing device is analyzed to determine whether the application is a malware application. The execution of the application is terminated when the application connects to an Internet domain. The Internet domain is added to a blacklist. A notification is transmitted that indicates the Internet domain is blacklisted.

Systems and methods for automatically blacklisting an internet domain based on the activities of an application

A malicious driver replacement application is installed on a host computer system and registered as a boot execute application. On notification of a malicious driver detection, the malicious driver replacement application reboots the host computer system and locks the volume of a storage disk containing the malicious driver. The malicious driver is replaced directly on the storage disk with a dummy driver having innocuous code. The malicious driver replacement application reboots the host computer system, and on reboot of the host computer system, the dummy driver is loaded rather than the malicious driver thus preventing the malicious driver from interfering with the standard operating system routines and allowing the malicious driver to be remediated.

Replace malicious driver at boot time

A malicious software detection module (MSDM) detects worms and other malicious software. The MSDM executes on a computer system connected to a network. The MSDM monitors a storage device of the computer system for the arrival of software from a suspicious portal. The MSDM designates such software as suspicious. The MSDM tracks the set of files that are associated with the suspicious software. If the files in the set individually or collectively engage in suspicious behavior, the MSDM declares the suspicious software malicious and prevents file replication and/or other malicious behavior.

Growing community of inventors

Los Angeles, CA, United States of America

David Kane