Zscaler, Inc.

Deepen Desai

Narinder Paul

Shashank Gupta

Howie Xu

Rex Shang

Changsha Ma

Parnit Sainion

Amit Sinha

Loren Weith

Dianhuan Lin

Douglas A Koch

Rubin Azad

Tarun Dewan

Akshay Shah

Reshad Patuck

Sahir Hidayatullah

Bhavesh Kothari

Rakshitha Hedge

Nirmal Singh

Naveen Selvan

Uday Pratap Singh

Bharath Meesala

Bharath Kumar

Chakkaravarthy Periyasamy Balaiah

Varun Singh

Dhruval Gandhi

Zhenxiang Wang

Sachin Matte

Jithin Prajeev Nair

Shanghao Chen

Tejveer Singh

Shriyash Shete

Systems and methods are provided for evaluating the effectiveness of network security tools for mitigating network security risks. According to one implementation, a method includes the step of analyzing a network to measure security parameters associated with the use of one or more network security tools that are configured for mitigating risk with respect to network compromise, data loss, lateral movement, and asset exposure. Based on the measured security parameters, the method further includes the step of quantifying the one or more network security tools to determine an effectiveness score defining an ability of the one or more network security tools, in combination, to counteract the network compromise, data loss, lateral movement, and asset exposure.

Risk mitigation effectiveness score of network security services

Cloud-based deception systems and methods include monitoring activity of a user on a user device; analyzing the activity to determine a role of a plurality of roles, for the user at a customer; and creating one or more fake assets on the user device based on the determined role, wherein the one or more fake assets include any of files, passwords, breadcrumbs, lures, cookies, and sessions that are contextually relevant to the user's role, and wherein the one or more fake assets are configured to interact with one or more decoys hosted in a decoy cloud environment for the customer.

Cloud-based deception technology with auto-decoy and breadcrumb creation based on user's role and without on-premises appliances

Systems and methods of sandboxing a file include responsive to receiving a file associated with a user, obtaining policy for the user; analyzing the file with a machine learning model; and based on a combination of the policy for the user and a verdict of the machine learning model, one of quarantining the file for analysis in a sandbox and allowing the file to the user. The present disclosure presents a smart quarantine with a goal of minimizing the number of files quarantined, the number of malicious files passed through to an end user, and a number of files scanned by a sandbox.

Utilizing machine learning for smart quarantining of potentially malicious files

Systems and methods include obtaining a Uniform Resource Locator (URL) for a site on the Internet; analyzing the URL with a Machine Learning (ML) model to determine whether or not the site is suspicious for phishing; responsive to the URL being suspicious for phishing, loading the site to determine whether or not an associated brand of the site is legitimate or not; and, responsive to the site being not legitimate for the brand, categorizing the URL for phishing and performing a first action based thereon. The systems and methods can further include, responsive to the URL being not suspicious for phishing or the site being legitimate for the brand, categorizing the URL as legitimate and performing a second action based thereon.

Phishing detection of uncategorized URLs using heuristics and scanning

Systems and methods include, responsive to starting a plurality of listener modules, receiving a Uniform Resource Locator (URL) for a site on the Internet into a database; loading the URL; receiving artifacts based on the loading; using the plurality of listener modules to run rules based on the received artifacts; scoring the URL based on the rules and the received artifacts; and determining whether the URL is one of benign, suspicious, or malicious based on the scoring. The steps can include any of blocking the URL, allowing the URL, further analyzing the URL, adding the URL to a whitelist or blacklist, and providing a notification, based on whether the URL is benign, suspicious, or malicious.

URL risk analysis using heuristics and scanning

Systems and methods are provided for calculating a security risk score. In one implementation, a method includes the step of analyzing a network to assess a license status of the network, where the license status is related to one or more security licenses procured for providing security protection to the network. The method also includes the step of analyzing the network to assess a configuration status of the network, where the configuration status is related to configurations settings of one or more security policies currently operating with respect to the network. Based on the assessed license status and configuration status, the method further includes the step of calculating a security risk score indicating a current level of risk that the network faces against threats, intrusions, cyber-attacks, breaches, and/or data loss.

Dynamic calculation of security risk score of network security services based on assessed license status and configuration status

Systems and methods include performing inline monitoring of production traffic between users, the Internet, and cloud services via a cloud-based system; utilizing a trained machine learning model to inspect static properties of files in the production traffic; and classifying the traffic as one of malicious or benign based on the trained machine learning model.

Utilizing machine learning to detect malicious executable files efficiently and effectively

Cloud-based deception systems and methods with zero trust include hosting a decoy cloud environment for a customer that contains a plurality of decoys and that is hosted and separated from a real environment of the customer; receiving traffic from a user associated with the customer; detecting the traffic is related to accessing a fake asset on a user device associated with the user; rerouting the traffic to the decoy cloud environment; and monitoring activity associated with the fake asset in the decoy cloud environment.

Cloud-based deception technology utilizing zero trust to identify threat intelligence, telemetry, and emerging adversary tactics and techniques

Computer-implemented systems and methods include receiving unknown content in a cloud-based sandbox; performing an analysis of the unknown content in the cloud-based sandbox, to obtain a score to determine whether or not the unknown content is malware; obtaining events based on the analysis; running one or more rules on the events; and adjusting the score based on a result of the one or more. The systems and methods can include classifying the unknown content as malware or clean based on the adjusted score. The analysis can include a static analysis and a dynamic analysis, with the events generated based thereon.

Dynamic rules engine in a cloud-based sandbox

Systems and methods include determining a plurality of features associated with executable files, wherein the plurality of features are each based on static properties in predefined structure of the executable files; obtaining training data that includes samples of benign executable files and malicious executable files; extracting the plurality of features from the training data; and utilizing the extracted plurality of features to train a machine learning model to detect malicious executable files.

Utilizing Machine Learning to detect malicious executable files efficiently and effectively

Systems and methods include receiving a list of web sites; anonymously browsing to each web site in the list; receiving a response based on the browsing; and analyzing the response to classify each web site as malicious or not based on a plurality of techniques including JavaScript (JS) obfuscation detection based on de-obfuscation. The systems and methods can further include providing a blacklist of web sites classified as malicious. The systems and methods can further include determining the list of web sites periodically based on a plurality of factors. The JS obfuscation detection can be performed by de-obfuscating JS content and utilizing heuristics to determine if the de-obfuscated JS content is malicious, and the heuristics can include a presence of any of a new JS function and a domain in the de-obfuscated JS content.

Web crawler systems and methods to efficiently detect malicious sites

Systems and methods include obtaining a file associated with a user for processing; utilizing a combination of policy for the user and machine learning to determine whether to i) quarantine the file and scan the file in a sandbox, ii) allow the file to the user and scan the file in the sandbox, and iii) allow the file to the user without the scan; responsive to the quarantine of the file and the sandbox determining the file is malicious, blocking the file; and, responsive to the quarantine of the file and the sandbox determining the file is benign, allowing the file.

Systems and methods include obtaining data from a log system storing historical transactions monitored by a security system; creating one or more mock transactions based on the data; and analyzing the one or more mock transactions with a signature pattern matching engine having updates provided therein subsequent to a time of the historical transactions. The one or more mock transactions can have a header based on the data from corresponding historical transactions. The systems and methods can include performing a content scan in the one or more mock transactions based on the signature pattern matching engine having the updates, or determining malicious activity in the one or more mock transactions based on the signature pattern matching engine having the updates to determine missed matches in the corresponding historical transactions.

Advanced threat detection through historical log analysis

Systems and methods for testing Signature Pattern Matching (SPM) for a new signature associated with a cloud-based security system with a plurality of nodes and a testing node include operating the testing node with a same management software and SPM library as the plurality of nodes; obtaining a new signature derived to detect malicious content; compiling the new signature in the SPM library for the testing node; implementing one or more test cases related to the malicious content to analyze behavior of the testing node with the SPM library containing the new signature; and, responsive to success in the one or more test cases, providing the SPM library to the plurality of nodes for detection of the malicious content.

Signature pattern matching testing framework

Systems and method implemented through a distributed security system for determining and addressing risk of users, groups of users, locations, and/or companies include obtaining log data from the distributed security system; analyzing the log data to obtain a risk score for an entity associated with the distributed security system, wherein the entity comprises one of a user, a group of users, a location, and a company, and wherein the risk score is a weighted combination of pre-infection behavior, post-infection behavior, and suspicious behavior; performing one or more remedial actions for the entity; and subsequently obtaining updated log data and analyzing the updated log data to obtain an updated risk score to determine efficacy of the one or more remedial actions.

Growing community of inventors

San Ramon, CA, United States of America

Deepen Desai