Microsoft Technology Licensing, LLC

Jack W Stokes

John Carlton Platt

Arungunram Chandrasekaran Surendran

Cormac E Herley

Kumar Hemachandra Chellapilla

Chao He

Qin Li

Gang Wang

David Kemal Felstead

David Earl Heckerman

Adrian Mihail Marinescu

Anil Francis Thomas

Michael Shilman

Vladimir Holostov

Alice Zheng

Christian Seifert

Reid Andersen

Roy Varshavsky

Kira Radinsky

Edward Wilkins Hardy

Sasi Parthasarathy

Edward William Schaefer

Robert Eric Fitzgerald

Long Lu

Bodicherla Aditya Prakash

Christina Colcernian

Navaneethan Santhanam

Nikos Karampatziakis

Greg Buehrer

Joseph L Kravis

Technologies pertaining to analyzing content extracted from web pages by a static crawler to determine whether respective web pages are members of a malware distribution network (MDN) are described. A set of features is learned based upon output of a dynamic crawler over known landing pages of a particular MDN, wherein the set of features are indicative of membership in the MDN. Using such set of features, additional members of the MDN (not subjected to crawling by a dynamic crawler) are identified.

Identifying web pages in malware distribution networks

A machine-implemented method for detecting scareware includes the steps of accessing one or more landing pages to be evaluated, extracting one or more features from the landing pages, and providing a classifier to compare the features extracted from the landing pages with features of known scareware and non-scareware pages. The classifier determines a likelihood that the landing page is scareware. If determined to be scareware, the landing page is removed from search results generated by a search engine. The features can be URLs, text, image interest points, image descriptors, a number of pop-ups generated, IP addresses, hostnames, domain names, text derived from images, images, metadata, identifiers of executables, and combinations thereof.

Scareware detection

Architecture that selects a classification engine based on the expertise of the engine to process a given entity (e.g., a file). Selection of an engine is based on a probability that the engine will detect an unknown entity classification using properties of the entity. One or more of the highest ranked engines are activated in order to achieve the desired performance. A statistical, performance-light module is employed to skip or select several performance-demanding processes. Methods and algorithms are utilized for learning based on matching the best classification engine(s) to detect the entity class based on the entity properties. A user selection option is provided for specifying a maximum number of ranked, classification engines to consider for each state of the machine. A user can also select the minimum probability of detection for a specific entity (e.g., unknown file). The best classifications are re-evaluated over time as the classification engines are updated.

Realtime multiple engine selection and combining

An analysis system is described for identifying potentially malicious activity within a computer network. It performs this task by interacting with a user to successively remove known instances of non-malicious activity, to eventually reveal potentially malicious activity. The analysis system interacts with the user by inviting the user to apply labels to identified examples of network behavior; upon response by the user, the analysis system supplies new examples of network behavior to the user. In one implementation, the analysis system generates such examples using a combination of feature-based analysis and graph-based analysis. The graph-based analysis relies on analysis of graph structure associated with access events, such as by identifying entropy scores for respective portions of the graph structure.

Analysis of computer network activity by successively removing accepted types of access events

A reliable automated malware classification approach with substantially low false positive rates is provided. Graph-based local and/or global file relationships are used to improve malware classification along with a feature selection algorithm. File relationships such as containing, creating, copying, downloading, modifying, etc. are used to assign malware probabilities and simultaneously reduce the false positive and false negative rates on executable files.

Graph-based malware classification based on file relationships

A regression-based residual echo suppression (RES) system and process for suppressing the portion of the microphone signal corresponding to a playback of a speaker audio signal that was not suppressed by an acoustic echo canceller (AEC). In general, a prescribed regression technique is used between a prescribed spectral attribute of multiple past and present, fixed-length, periods (e.g., frames) of the speaker signal and the same spectral attribute of a current period (e.g., frame) of the echo residual in the output of the AEC. This automatically takes into consideration the correlation between the time periods of the speaker signal. The parameters of the regression can be easily tracked using adaptive methods. Multiple applications of RES can be used to produce better results and this system and process can be applied to stereo-RES as well.

System and process for regression-based residual acoustic echo suppression

A method for classifying search query traffic can involve receiving a plurality of labeled sample search query traffic and generating a feature set partitioned into human physical limit features and query stream behavioral features. A model can be generated using the plurality of labeled sample search query traffic and the feature set. Search query traffic can be received and the model can be utilized to classify the received search query traffic as generated by a human or automatically generated.

Classifying search query traffic

An approach for identifying suspect network sites in a network environment entails using one or more malware analysis modules to identify distribution sites that host malicious content and/or benign content. The approach then uses a linking analysis module to identify landing sites that are linked to the distribution sites. These linked sites are identified as suspect sites for further analysis. This analysis can be characterized as 'bottom up' because it is initiated by the detection of potentially problematic distribution sites. The approach can also perform linking analysis to identify a suspect network site based on a number of alternating paths between that network site and a set of distribution sites that are known to host malicious content. The approach can also train a classifier module to predict whether an unknown landing site is a malicious landing site or a benign landing site.

Bottom-up analysis of network sites

A malicious behavior detection/prevention system, such as an intrusion detection system, is provided that uses active learning to classify entries into multiple classes. A single entry can correspond to either the occurrence of one or more events or the non-occurrence of one or more events. During a training phase, entries are automatically classified into one of multiple classes. After classifying the entry, a generated model for the determined class is utilized to determine how well an entry corresponds to the model. Ambiguous classifications along with entries that do not fit the model well for the determined class are selected for labeling by a human analyst. The selected entries are presented to a human analyst for labeling. These labels are used to further train the classifier and the models. During an evaluation phase, entries are automatically classified using the trained classifier and a policy associated with determined class is applied.

Method of classifying and active learning that ranks entries based on multiple scores, presents entries to human analysts, and detects and/or prevents malicious behavior

Center clipping is applied with acoustic echo suppression in a two-way voice communication system to reduce a microphone signal to the background noise floor when speech is not present. For integration with a microphone array, the center clipping processing determines whether speech is present based on estimates of the overall leak through and instantaneous microphone power across the microphone array channels. The overall estimates can be calculated as a dot product of the microphone array coefficients computed by a sound source localization process and separate estimates for the respective microphone channel.

Integration of a microphone array with acoustic echo cancellation and center clipping

Acoustic echo cancellation, residual echo suppression and sound-source localization/microphone array processes are combined in a two-way voice communication system that uses a microphone array to capture local speech. The processes can be configured according to various alternative architectures and enhancements made to the processes to avoid the adverse effects of non-linear operations in the residual echo suppression on the sound-source localization/microphone array process.

Integration of a microphone array with acoustic echo cancellation and residual echo suppression

A method and system of multi-channel echo cancellation using round robin regularization. The multi-channel round robin regularization echo cancellation method includes applying a plurality of adaptive filters, each having an inverse correlation matrix, to the multi-channel playback signal. Each of the plurality of adaptive filters is selected in a round robin sequence, so that every round each of the filters is selected. The inverse correlation matrix associated with each selected adaptive filter then is regularized as needed. The regularized adaptive filter then is used to remove the echo of the multi-channel playback signal from a captured signal. Regularization is implemented in a round robin manner to ensure that each subband is selected so that the adaptive filter for that subband can be examined. Other features of the multi-channel echo cancellation system and method include dynamic switching between monaural and multi-channel echo cancellation and mixed processing for lower and upper subbands.

Growing community of inventors

North Bend, WA, United States of America

Jack W Stokes