Mcafee, Inc.

Sophos Limited

Other

Sb Ventures, Inc.

James Douglas Bean

John Douglas Teddy

Gregory William Dalcher

Jeff Hetzler

Kenneth D Ray

Andrew James Thomas

Joel Robert Spurlock

Karl Ackerman

Daniel Stutz

Cedric Cochin

Carl D Woodward

Ofir Arkin

Ramnath Venugopalan

Daniel Arie Haber

Fred C Christians

Jonathan B King

Aditya Kapoor

Denis Paul Harkin

Andrew Woodruff

Vivi Truong

Jonathan D Oliner

David Miklos

Torry B Campbell

Chol Pak

Disclosed herein is a technique for detecting potential phishing attacks by monitoring outbound web traffic from an endpoint, along with inbound electronic mail traffic addressed to a user of the endpoint. With this information, a search can be performed for possible sources in the web traffic of a request for a hyperlink located in the inbound mail traffic, and when no source is located, phishing remediation can be performed, including restrictions on access to the hyperlink at an endpoint operated by the user.

Detecting phishing attacks

A firewall uses information about an application that originates a network request to determine whether and how to forward the request over a network. The firewall may more generally rely on the identity of the originating application, the security state of the originating application, the security state of the endpoint, and any other information that might provide an indication of malicious activity, to make routing and forwarding decisions for endpoint-originated network traffic.

Application firewall

Phishing attacks attempt to solicit valuable information such as personal information, account credentials, and the like from human users by disguising a malicious request for information as a legitimate inquiry, typically in the form of an electronic mail or similar communication. By tracking a combination of outbound web traffic from an endpoint and inbound electronic mail traffic to the endpoint, improved detection of phishing attacks or similar efforts to wrongly obtain sensitive information can be achieved.

Tracking usage of corporate credentials

A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide 'content-less' malware detection, i.e., detecting a process as being an 'anomaly' not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) 'trusted' application behaviors, i.e., the trusted applications' 'phenotypes' and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e., &#x201c;application phenotypes&#x201d;)&#x2014;and later compare the processes executed on a user device to the stored behavioral models to determine whether the actual measured behavior reflects a &#x201c;good&#x201d; application, or if it differs from the stored behavioral models to a sufficient degree and with a sufficient degree of confidence, thus indicating a potentially malicious application or behavior.

Application phenotyping

Particular embodiments described herein provide for an electronic device that can be configured to identifying a digital certificate associated with data and assigning a reputation to the digital certificate, where the digital certificate is classified as trusted if the digital certificate is included in an entry in a whitelist and the digital certificate is classified as untrusted if the digital certificate is included in an entry in a blacklist.

Determining the reputation of a digital certificate

An opportunity to assist with remediation of a file at a remote particular host device is identified. One or more remediation techniques are identified that can be applied to assist with remediation of the file at the particular host device. In one aspect, one or more remediation scripts are identified from a plurality of remediation scripts for remediation of the file and provided to the particular host device for execution on the particular host device. In another aspect, a remediation tool is identified and launched on a computing device remote from the particular host device with operations of the remediation tool applied to resources of the particular host device. In another aspect, at least a portion of the remediation techniques are remotely initiated to be performed locally at the particular host device.

Remote malware remediation

Particular embodiments described herein provide for an electronic device that can be configured to monitor activities of objects in a system, compare the monitored activities to metadata for the system, and identify low prevalence outliers to detect potentially malicious activity. The monitored activities can include an analysis of metadata of the objects in the system to identify polymorphic threats, an object reuse analysis of the system to detect an object reusing metadata from another object, and a filename analysis of the system.

Anomaly detection to identify malware

There is disclosed in an example a computing apparatus configured to operate as an enterprise threat intelligence server, and including: a network interface configured to communicatively couple to a network; and one or more logic elements providing a reputation engine, operable for: receiving a first uniform resource locator (URL) identifier; determining that a first URL identified by the first URL identifier has an unknown enterprise reputation; and establishing a baseline reputation for the URL. There is further disclosed a method of providing the reputation engine, and one or more computer-readable mediums having stored thereon executable instructions for providing the reputation engine.

Enterprise reputations for uniform resource locators

A host-based antimalware client can interface with a server-based antimalware support server. A file is identified at a host device. It is determined whether local reputation data for the file is available at the host device for the file. A query is sent to an antimalware support system relating to the file. Particular reputation data is received from the antimalware support system corresponding to the query. It is determined whether to allow the file to be loaded on the host device based at least in part on the particular reputation data.

Server-assisted anti-malware client

This disclosure describes systems, methods, and computer-readable media related to an incident response tool using data exchange layer. In some embodiments, a data collector may be generated by an incident response server. The incident response server may transmit a data collector to multiple broker servers, where each broker server may transmit the data collector to multiple user devices associated with the broker server. The incident response server may receive data from the data collectors executing on the user devices and may analyze the received data.

Growing community of inventors

Portland, OR, United States of America

James Douglas Bean