Ca, Inc.

Symantec Corporation

Douglas Schlatter

Adam Glick

Akshata Krishnamoorthy Rao

Feng Li

Petrus Johannes Viljoen

Carey S Nachenberg

Andrew B Gardner

Nobuto Hotta

Dinesh Bhirud

A method for behavioral analysis of scripting utility usage in an enterprise is described. In one embodiment, the method describes receiving, by a processor, data associated with execution of a scripting utility operating on a plurality of computing devices; executing a clustering algorithm on the received data; identifying at least one cluster based at least in part on executing the clustering algorithm; identifying an existence of an anomalous event associated with the scripting utility based at least in part on executing the clustering algorithm; and transmitting an indication of the anomalous event to an administrator.

Behavioral analysis of scripting utility usage in an enterprise

A method for detecting name resolution spoofing is described. In one embodiment, the method includes identifying a request to resolve a host name, identifying a hostname specified in a response to the request, identifying an actual hostname associated with the response, analyzing the hostname specified in relation to the actual hostname, and performing a security action based at least in part on the analysis.

Detecting name resolution spoofing

A computer-implemented method for automatically blocking Web Proxy Auto-Discovery Protocol (WPAD) attacks may include (i) automatically detecting, by a computing device, a WPAD request for a configuration file, (ii) identifying, by the computing device, a server attempting to fulfill the WPAD request for the configuration file, (iii) determining, by the computing device, that the server is not included in a whitelist of WPAD servers for the configuration file, and (iv) automatically performing, by the computing device and based on the determination that the server is not included in the whitelist, a security action to secure the WPAD request for the configuration file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for automatically blocking web proxy auto-discovery protocol (WPAD) attacks

The present disclosure provides methods for an endpoint ranking system that can take endpoint importance, symptom importance, and symptom timing into account when determining endpoint hygiene scores for endpoints in a network. A list of endpoints that is ranked or sorted according to hygiene score can by dynamically generated and can change over time due to the manner in which symptom timing is taken into account. The list can also evolve as parameters for endpoint importance and system importance are modified. An endpoint-importance weight can be assigned to each endpoint to bias hygiene scores according to endpoint importance. Symptom-importance weights and decay rates can also be assigned to symptom types to further bias hygiene scores.

Dynamically ranking and presentation of endpoints based on age of symptoms and importance of the endpoint in the environment

The disclosed computer-implemented method for improving the classification accuracy of trustworthiness classifiers may include (1) identifying a set of training data that is available for training trustworthiness classifiers used to classify computing resources as clean or malicious, (2) selecting, based at least in part on a characteristic of a specific organization, a subset of training data from the set of training data that is available for training trustworthiness classifiers, (3) training a trustworthiness classifier for the specific organization using the subset of training data selected based at least in part on the characteristic of the specific organization, and then (4) applying the trustworthiness classifier to at least one computing resource encountered by the specific organization to classify the computing resource as clean or malicious. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Playa Vista, CA, United States of America

Douglas Schlatter