Sentinel Labs Israel Ltd.

Check Point Software Technologies Ltd.

Eitan Shterenbaum

Shlomi Salem

Gal Braun

Assaf Nativ

Amit Zohar

Roy Ronen

Pavel Ferencz

Tal Maimon

Dan Karpati

Erez Israel

Lior Goldman

Tai Maimon

Methods and devices are provided for differentiating between benign DNS data and malicious DNS data included in DNS traffic using an autoencoder. The autoencoder receives input DNS data and is trained to successfully encode the input DNS data when the input DNS data is benign DNS data and to fail to encode the input DNS data when the input DNS data is malicious DNS data. The autoencoder is trained using a modified loss function having a large weight when successfully encoding malicious DNS data.

DNS tunneling detection and prevention

Disclosed herein are systems and methods for enabling the automatic detection of executable code from a stream of bytes. In some embodiments, the stream of bytes can be sourced from the hidden areas of files that traditional malware detection solutions ignore. In some embodiments, a machine learning model is trained to detect whether a particular stream of bytes is executable code. Other embodiments described herein disclose systems and methods for automatic feature extraction using a neural network. Given a new file, the systems and methods may preprocess the code to be inputted into a trained neural network. The neural network may be used as a 'feature generator' for a malware detection model. Other embodiments herein are directed to systems and methods for identifying, flagging, and/or detecting threat actors which attempt to obtain access to library functions independently.

Systems and methods for executable code detection, automatic feature extraction and position independent code detection

Growing community of inventors

Kiryat-Ono, Israel

Eitan Shterenbaum