Mcafee, Inc.

Intel Corporation

German Lancioni

Carl D Woodward

Cedric Cochin

Jonathan B King

Celeste R Fralick

Eric Donald Wuehler

Rahul Deshpande

Kunal Mehta

Tamir Damian Munafo

Sherin Mary Mathews

Priyadarshini Rao Rajan

Emiliano Gabriel Molina

Fernando Ruiz Altamirano

Arpit Pradhan

Patricio A Maller

Simon R Hunt

Amit Kumar

Jonathan Lewis Edwards

Steven L Grobman

Craig D Schmugar

Matthew D Wood

Oliver G Devane

Sorcha Bairbre Healy

Pablo Andres Michelis

Ameya M Sanzgiri

Ritesh Kumar

Niall Fitzgerald

Prashanth Palasamudram Ramagopal

Bhargav Shah

Mario L Bertogna

Jose P Piccolotto

Brian Gaither

Fernando Ruiz

Mario Leandro Bertogna

José Pablo Piccolotto

Bidan Sinha

Arun Chundiriyil Pullat

Craig Schumgar

Joseph Padron

James Duldulao

Methods, apparatus, systems, and articles of manufacture are disclosed to classify a sample as clean or malicious. An example apparatus includes instruction identifies circuitry to convert a sample into a sequence of instructions, abstract language circuitry to transform the sequence of instructions into an abstract language representation, transition matrix circuitry to create a Markov transition matrix, the Markov transition matrix to represent transitions within the abstract language representation, and classifier circuitry to classify an unknown sample as clean or malicious, the classification in response to whether the Markov transition matrix is closer to a clean group of Markov transition matrices or a malicious group of Markov transition matrices.

Methods and apparatus to classify samples as clean or malicious using low level Markov transition matrices

There is disclosed a method of mitigating phishing, including extracting text from a website under analysis; using a spell check algorithm to compare extracted words or phrases to a language dictionary of words or phrases selected from web pages known to be phishing targets, and using a spell counter to count misspell hits from the spell check algorithm; comparing the extracted words or phrases to a case-sensitive usage reference, and using a usage counter to count mismatched usage hits from the case-sensitive usage reference; combining the spell counter and the usage counter into a combined counter; and using the combined counter to identify the website under analysis as a suspected phishing website and taking a phishing mitigation action.

Phishing detection via grammatical artifacts

Security risk evaluation across user devices is disclosed herein. An example method includes identifying a user and one or more devices associated with the user, collecting information identifying applications used by the user on the one or more devices, determining respective security sub-scores for each item of the one or more devices, computing an overall security score for the user based, at least in part, on an aggregation of the security sub-scores, and creating a user profile based on the overall security score, the user profile to enable the at least one of the one or more devices to exchange data with an external device when the overall security score meets a security score threshold, the user profile to prevent the at least one of the one or more devices from exchanging data with the external device when the overall security score does not meet the security score threshold.

Security risk evaluation across user devices

Methods and apparatus are disclosed to detect malware using micro-forests with customer trust seeds. A false positive correction apparatus includes processor circuitry to perform at least one of the first operations, the second operations or the third operations to instantiate classifier circuitry to access a malicious sample, the malicious sample having a first feature vector, sample comparison circuitry to compare the malicious sample to a known sample, the known sample collected from customer data, the known sample having a second feature vector, calculator circuitry to calculate a distance value between the first feature vector and the second feature vector, threshold comparator circuitry to compare the distance value to a threshold, and change the classification of the malicious sample to clean in response to the distance value satisfying the threshold.

Methods and apparatus to detect malware using micro-forests with customer trust seeds

Methods, apparatus, systems, and articles of manufacture are disclosed that augment classification for low prevalence samples. An example non-transitory computer readable medium comprises instructions that, when executed, causes a machine to at least classify a data sample using a first classifier, classify the data sample using a second classifier different from the first classifier, the second classifier using a plurality of sensitive hashing (LSH) forests to analyze a sorted plurality of neighbor samples, determine whether a first classification result of the first classifier meets or exceeds a confidence threshold, in response to the first classification result of the first classifier meeting or exceeding the confidence threshold, output the first classification result, and in response to the first classification result of the first classifier not meeting or exceeding the confidence threshold, output a second classification result of the second classifier.

Methods and apparatus to augment classification coverage for low prevalence samples through neighborhood labels proximity vectors

Methods, apparatus, systems, and articles of manufacture are disclosed to determine mutex entropy for malware classification. An example apparatus includes interface circuitry to access a mutex associated with a software application, the mutex to include a mutex identifier string, normalizer circuitry to normalize the mutex identifier string, character probability circuitry to determine character probabilities of characters within the normalized mutex identifier string, the character probabilities based on a historical mutex character distribution, entropy calculator circuitry to calculate an entropy value for the mutex based on the character probabilities, classifier circuitry to classify the mutex as clean or malicious based on the entropy value, and protector circuitry to mitigate malicious attacks based on the classification.

Methods and apparatus to determine mutex entropy for malware classification

A computing apparatus, including: a hardware platform including a processor circuit and a memory; and instructions encoded within the memory to instruct the processor circuit to: extract human readable text from a plurality of known websites, the known websites having known classifiers; apply a MinHash algorithm to respective human readable text of the known websites; generate a plurality of different locality sensitive hashing (LSH) indexes for the respective websites; extract human readable text from a test website; apply the MinHash algorithm to the human readable text of the test website to provide a MinHash of the test website; query the plurality of different LSH indexes with the MinHash of the test website; and according to a result of the query, assign a category the test website, wherein the category matches a known category of at least one of the plurality of known website found to have a containment with the test website above a threshold.

Website classification via containment queries

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; and instructions encoded within the memory to instruct the processor to: receive a client event report, the client event report including an operating system event trace for an attempt to exploit a patched vulnerability, and first feature data for a malware object that made the attempt; receive second feature data for an unknown object; compare the first feature data to the second feature data; and if the second feature data match the first feature data above a threshold, convict the unknown object as malware.

Malware detection from operating system event tracing

A method including receiving a feature vector of an unknown sample, computing a MinHash of the unknown sample based on Jaccard-compatible features, querying a Locality Sensitive Hashing forest of known samples with the MinHash of the unknown sample to identify a first subset of known samples that are similar to the unknown sample, receiving for each individual known sample in the first subset, a feature vector including non-Jaccard distance-compatible features, computing a first sub-distance and a second sub-distance between the unknown sample and the known samples in the first subset, calculating a total distance for each known sample in the first subset by combining the first and the second sub-distances, identifying, based on the calculated total distances, a second subset of known samples that are most similar to the unknown sample, and classifying the unknown sample based on the second subset.

Large scale malware sample identification

Methods, apparatus, systems and articles of manufacture are disclosed for classification of unknown samples using agglomerative clustering. An apparatus includes an extractor to extract a feature from a sample source code, the feature including at least one of a register, a variable, or a library based on a threshold of occurrence in a corpus of samples, the corpus of samples including malware samples, a dendrogram generator to generate a dendrogram based on features extracted from the sample source code, the dendrogram representing a collection of samples clustered based on similarity among the samples, the samples including sample clusters belonging to known malware families, and an anchor point identifier to traverse the dendrogram to identify similarity of an unknown sample to the sample clusters based on a confidence score, and identify anchor point samples from the sample clusters identified as similar to the unknown sample, the anchor point samples to provide metadata for use in extrapolating information to classify the unknown sample.

Methods and apparatus for unknown sample classification using agglomerative clustering

There is disclosed in one example a gateway apparatus to operate on an intranet, including: a hardware platform; and an access proxy engine to operate on the hardware platform and configured to: intercept an incoming packet; determine that the incoming packet is an access request directed to an access interface of a resource of the intranet; present an access checkpoint interface; receive an authentication input response; validate the authentication input response; and provide a redirection to the access interface of the device.

Gateway with access checkpoint

Methods, apparatus, systems and articles of manufacture are disclosed to facilitate malware detection using compressed data. An example apparatus includes an input processor to obtain a model, the model identifying a first sequence associated with a first trace of data known to be repetitive, a sequence identifier to identify a second sequence associated with a second trace of data, a comparator to compare the first sequence with the second sequence, and an output processor to when the first sequence matches the second sequence, transmit an encoded representation of the second sequence to the central processing facility using a first channel of communication, and when the first sequence fails to match the second sequence, transmit the second sequence to the central processing facility using a second channel of communication, the second sequence to be analyzed by the central processing facility to identify whether the second sequence is indicative of malware.

Methods and apparatus to facilitate malware detection using compressed data

Mechanisms for mitigating damage resulting from a website being an intermediary in a cyberattack, comprising: detecting a domain name server query made to the website; making a request to the website; receiving a header in response to the request; inspecting the header to identify a software stack component of the website; cross-referencing the software stack component to a common vulnerabilities and exposures (CVE) database to identify a CVE that applies to the software stack component; applying a rule to determine the impact of the CVE on whether the website is a possible intermediary in a cyberattack; determining that the website is a possible intermediary in a cyberattack; and taking action on the website to mitigate damage resulting from the website being an intermediary in a cyberattack.

Methods, systems, and media for mitigating damage resulting from a website being an intermediary in a cyberattack

There is disclosed in one example a malware analysis server, including: a hardware platform including a processor and a memory; a machine learning model; a store of known objects previously classified by the machine learning model; and instructions encoded within the memory to instruct the processor to: receive a test sample; apply the machine learning model to the test sample to provide the test sample with classified features; compute pairwise distances between the test sample and a set of known objects from the store of known objects; select a group of near neighbor samples from the set of known objects; select a group of far neighbor samples from the set of known objects; and generate an explanation for the test sample according to the near neighbor samples and far neighbor samples.

Explainability of an unsupervised learning algorithm outcome

An example authentication device disclosed herein is to access a message received via a wireless interface from an adapter, the message to indicate that a host device has connected to the adapter, the host device different from the authentication device. The disclosed example authentication device is also to determine whether to allow the host device to access a storage device. The disclosed example authentication device is further to transmit authentication data to the adapter via the wireless interface, the authentication data to specify whether the host device is allowed to access the storage device.

Growing community of inventors

San Jose, CA, United States of America

German Lancioni