Netskope, Inc.

Mcafee, Inc.

Ghanashyam Satpathy

Benjamin Chang

Ari Azarafrooz

Zhenxin Zhan

Xinjun Zhang

Nitin Chhabra

Prashanth Palasamudram Ramagopal

Chakradhar Kotamraju

Rajat Saxena

Hung-Ming Chen

The technology disclosed relates to cybersecurity attacks and cloud-based security, and specifically to the detection of malicious code that is obfuscated within document files. Such malicious code can be delivered in the form of malicious macros and/or malicious OLE objects stored within document files. The technology disclosed detects obfuscated and malicious code using a trained machine learning model to predict which documents include malicious code, despite such malicious not having a known signature. The technology disclosed can thus predict which documents include malicious code lacking a known signature. Safe documents are allowed into the network. Suspicious documents are subjected to additional processing, including quarantining or sandboxing methods. Malicious documents are rejected from the network. In a further aspect, the disclosed technology combines machine learning with other network security methods, to further increase the capability of a network security system to detect malicious macros and malicious OLE files.

Detection of malicious code that is obfuscated within a document file

A cloud-based network security system (NSS) is described. The NSS uses a sandbox to safely detonate and extract information about a document and uses machine learning algorithms to analyze the information to predict whether the document contains malicious software. Specifically, during the detonation, static and dynamic information about the document is captured in the sandbox as well as character strings from images in the document. The dynamic information (and sometimes the static information) is input to an AI or machine learning model trained to provide an output indicating a prediction of whether the document contains malware. The character strings are compared with a batch of phishing keywords to generate a heuristic score. A validation engine combines the output from the AI or machine learning model and the heuristic score to classify the document as malicious or clean. Security policies can then be applied based on the classification.

Machine learning powered cloud sandbox for malware detection

There is disclosed in one example a computing apparatus, including: a hardware platform including at least a processor and a memory; and a security agent including instructions encoded in the memory to instruct the processor to: monitor a user's operation of the computing apparatus over time, including determining whether a selected behavior is a security risk; provide a risk analysis of the user's operation based at least in part on the monitoring; select a scan sensitivity based at least in part on the risk analysis; and scan, with the selected sensitivity, one or more objects on the computing apparatus to determine if the one or more objects are a threat.

Behavioral user security policy

The technology disclosed relates to cybersecurity attacks and cloud-based security. A method and apparatus is provided for detecting documents with embedded threats in the form of malicious Object Linking & Embedding (OLE) objects. The technology disclosed detects obfuscated malicious code using a trained machine learning model to predict documents having malicious code without a known signature. The technology disclosed can thus predict which documents include signatureless malicious code. Feature engineering is used to define a set of features for detecting malicious macros and malicious OLE objects, based on features selected from a list of known characteristics and attributes possessed by files that have historically indicated malicious content. The selected features are used to train a supervised machine learning model, which is used to classify documents as safe, suspicious, or malicious.

Signatureless detection of malicious MS Office documents containing embedded OLE objects

The technology disclosed relates to cybersecurity attacks and cloud-based security. The technology disclosed is a method and apparatus for detecting documents with embedded threats in the form of malicious macros and malicious OLE objects. The technology disclosed detects obfuscated malicious code using a trained machine learning model to predict documents having malicious code without a known signature. The technology disclosed can thus predict which documents include signatureless malicious code. Feature engineering is used to define a set of features for detecting malicious macros and malicious OLE objects, based on features selected from a list of known characteristics and attributes possessed by files that have historically indicated malicious content. The selected features are used to train a supervised machine learning model. In another aspect, an office classifier receives incoming documents over a network, parses those documents, and applies the machine learning algorithm to classify the documents as to threat level, as safe, suspicious, or malicious. Safe documents are allowed into the network. Suspicious documents are subjected to additional processing, including quarantining or sandboxing methods. Malicious documents are rejected from the network. In a further aspect, the disclosed technology combines machine learning with other network security methods, to further increase the capability of a network security system to detect malicious macros and malicious OLE files.

Signatureless detection of malicious MS office documents containing advanced threats in macros

Methods, apparatus, systems, and articles of manufacture to remediate ransomware are disclosed. An example malware scanner includes a sinkhole generator to generate a sinkhole directory. The example malware scanner includes a storage device adapted to store a computer file and the sinkhole directory, wherein the sinkhole directory recursively expands when the computer file performs a file listing of the sinkhole directory to occupy the computer file by extending a period of time taken to perform the file listing of the sinkhole directory. The example malware scanner includes an analyzer to monitor execution of the computer file while the computer file is performing the file listing of the sinkhole directory to attempt to identify an indicator of compromise associated with the computer file, the analyzer to classify the computer file as ransomware when the analyzer identifies the indicator of compromise. The example malware scanner includes a cleaner to remediate the ransomware.

Growing community of inventors

Bengaluru, India

Ghanashyam Satpathy