Microsoft Technology Licensing, LLC

Elad Iwanir

Gal Tamir

Eli Koreh

Chen Lahav

Mario A Rodriguez

Avi Ben-Menahem

Yuri Gabaev

Shahar Weiss

Amir Eluk

Methods for intelligent automatic merging of source control queue items are performed by systems and apparatuses. Project changes are submitted in build requests to a gated check-in build queue requiring successful builds to commit changes to a code repository according to source control. Multiple pending build requests in the build queue are intelligently and automatically merged into a single, pending merged request based on risk factor values associated with the build requests. For merged requests successfully built, files in the build requests are committed and the build requests are removed from the queue. Merged requests unsuccessfully built are divided into equal subsets based on updated risk factor values using information from the unsuccessful build. Successful builds of subsets allow for committing of files and removal from the build queue, while unsuccessful builds are further divided and processed until single build requests are processed to identify root cause errors.

Intelligent automatic merging of source control queue items

A system for detecting by a cloud service a ransomware attack on a client device is provided. The system monitors changes to files of the client device that are stored by the cloud service. The system assesses whether a change to a file appears to be malicious in that the change may be caused by ransomware. When the change to the file appears to be malicious, the system performs a countermeasure to prevent synchronization of files of the client device with other client devices and with the cloud service to prevent the propagating of files from the client device, which is undergoing a ransomware attack.

Remediation for ransomware attacks on cloud drive folders

A system for protecting a database against a ransomware attack includes a database backup handler configured to selectively output database backup data associated with a database to a storage device. A ransomware detector is configured to monitor changes to the database and to detect data changes to the database resulting from a ransomware attack. A ransomware remediator communicates with the ransomware detector and the database backup handler and is configured to restore data in the database to a point prior to the ransomware attack based upon the backup data in the storage device.

Ransomware resilient databases

Methods, systems, apparatuses, and computer program products are provided for increasing an efficiency of queries in program code. A plurality of queries is detected in program code. A laziness is extended by which the queries are evaluated in the program code. The queries are decomposed into a plurality of query components. A ruleset that includes a plurality of rules is applied to the query components to generate a functionally equivalent query set to the plurality of queries that evaluates more efficiently relative to the plurality of queries.

Query optimizer for CPU utilization and code refactoring

Described technologies automatically detect computing system security attacks. Departure of occurrence distributions, which are based on leading digit(s) of digital item occurrence data, from model distributions that correspond to particular data sources, indicates a presence likelihood for particular attack types. Some model distributions exhibit Benford's Phenomenon. Described mechanisms detect security attack types such as ransomware, bitcoin mining, and others, using particular corresponding data sources such as file extensions, processor statistics, etc. Mechanisms detect security attacks without a captured baseline of healthy normal behavior, and without relying on malware code signatures. When an item occurrence distribution departs from a model distribution by at least a predefined degree, the technology electronically raises a security attack alert. Then countermeasures may be asserted for a possible type X security attack on the computing system. Countermeasures may include more computationally intensive tests for determining the precise extent or precise nature of an attack, for instance.

Computer security attack detection using distribution departure

An anti-ransomware system protects data in cloud storage of a cloud services provider against a ransomware attack. A backup handler is configured to at least one of: selectively retrieve backup data generated by the cloud services provider from the cloud storage; and selectively generate backup data based on the data in the cloud storage and output the backup data to a storage device. A ransomware detector is configured to detect data changes to the data resulting from a ransomware attack. A ransomware remediator communicates with the ransomware detector and the backup handler and is configured to restore the data to a state prior to the ransomware attack based upon the backup data.

Ransomware resilient cloud services

The misuse of public key, private key, and public/private key certificates poses significant security challenges to computer networks that are addressed by certificate monitoring. Certificate monitoring allows network administrators to detect and remedy poor security practices related to public key certificates and to detect and combat the malicious use of public key certificates in a centralized environment. Best practices and detection methods and systems are developed over time via machine learning to improve network security, and any detected misuse may be brought to a network administrator's attention or automatically remedied.

Detecting malicious usage of certificates

Methods, systems, apparatuses, and computer program products are provided for transforming asynchronous code into more efficient, logically equivalent asynchronous code; Program code is converted into a first syntax tree. A dependency graph is generated from the first syntax tree with each node of the dependency graph corresponding to a code statement and having an assigned weight. Weighted topological sorting of the dependency graph is performed to generate a sorted dependency graph. A second syntax tree is generated from the sorted dependency graph. In another implementation, the program code is transformed into await-relaxed and/or loop-relaxed program code prior to being transformed into the first syntax tree.

Growing community of inventors

Metar, Israel

Elad Iwanir