Acronis International Gmbh

Agency for Science, Technology and Research

Dinil Mon Divakaran

Stanislav Protasov

Serg Bell

Philipp Gysel

Candid Wuest

Candid Wüest

Vrizlynn Ling Ling Thing

Vrizlynn Thing

Long Cheng

Le Su

Kenneth Nwafor

Wee Yong Lim

Systems and methods implement artificial intelligence to automatically generate malware detection rules. In a first phase, an AI model is trained on large amounts of data, so the AI model can learn to distinguish between benign applications and different malware families. In a second phase, the AI model is queried with new malware samples, and systems and methods propose new malware detection rules for those samples.

AI assisted generation of rules for malware detection with transformer attention mechanism

Disclosed herein are systems and methods for selecting files for malware analysis. In one aspect, a method may include identifying, in a cloud network, a backup of a client machine; extracting, from the backup, at least one file of a given file type; determining whether to include the at least one file in a sandbox of the cloud network by performing a static analysis of the at least one file; selecting the at least one file for inclusion in the sandbox based on the static analysis; monitoring, for a period of time, a behavior of the at least one file in the sandbox by performing a dynamic analysis of the at least one file; and in response to determining that the at least one file is malicious based on the dynamic analysis, performing a remediation action on the at least one file.

Systems and methods for selecting client backup files for maliciousness analysis

Disclosed herein are systems and method for detecting vulnerabilities in devices within a network. In one exemplary aspect, a method includes: intercepting a plurality of packets in a network with a plurality of devices; identifying a subset of packets corresponding to a first device of the network; extracting and embedding a plurality of features representing device behavior from the subset of packets into an input vector; executing a machine learning algorithm that receives the input vector and outputs a device type of the first device, wherein the machine learning algorithm is trained using a training dataset including network traffic information labelled with device types and a list of attributes of each respective device type; performing, for the first device, a security scan specific to the device type; and in response to detecting a vulnerability based on the security scan, generating a vulnerability assessment report for the first device.

Systems and methods for detecting vulnerabilities in internet-of-things (IOT) devices

A traceback solution is provided. For a network of autonomous systems, the traceback solution traces the autonomous system path taken by traffic flows. Every link in the traceback path is created, verified, and audited by autonomous systems. Multiple autonomous systems may take part in the process, making the system robust against fake information. The database used to store the validated traceback paths is a decentralized and distributed storage. Multiple copies of the database may be maintained by the network of autonomous systems. The database may be accessible by any participating autonomous system; and is not accessible from outside the network of autonomous systems. The traceback solution achieves both validation and non-repudiation property among the ASes. The traceback solution mitigates some important attack scenarios that might be targeted specifically at the traceback solution.

Tracing traffic in the internet

A method for IP traceback is provided comprising receiving a traceback request including the identity of a traceback-deployed autonomous system closest to the destination node in a network routing path, recursively querying a traceback server associated with the traceback-deployed autonomous system to receive the identity of a preceding traceback-deployed autonomous system in the network routing path, and determining the network routing path based on the received identities of traceback-deployed autonomous systems. Additionally, authentication for traceback request is achieved using token delivery, wherein token is fragmented and marking of a packet is performed when a field on the packet matches at least one token fragment.

Growing community of inventors

Singapore, Singapore

Dinil Mon Divakaran