F-secure Corporation

Jarno Niemela

Veli-Jussi Kesti

Juha Ylipekkala

Paolo Palumbo

Matteo Cafasso

Andrew Patel

Jorn Sierwald

Ville Lindfors

Timo Harmonen

Dmitry Komashinskiy

Jammu Kekkonen

Jari Savander

Jani Jappinen

Juho Heikkinen

Zimry Ong

Erka Koivunen

Matias Suarez

A method comprising: monitoring events collected from a plurality of network nodes; detecting a first suspicious event among the monitored events by a detection mechanism; monitoring the behaviour of the first suspicious event and any related events; in case the monitored first suspicious event and/or a related event is detected to perform an activity triggering an IOC (indicator of compromise, generating a new IOC; monitoring new events when the activity ends; comparing the behaviour of the new events with the behaviour of the generated IOC; in case a matching behaviour is found, merging the new event with the first suspicious event and/or related events related to the generated IOC; and generating a security related decision on the basis of the IOC.

Method for threat control in a computer network security system

There are provided measures for enabling dynamic remote malware scanning. Such measures could exemplarily include identification of an electronic file to be scanned for malware, generation of at least one scanning object of the identified electronic file on the basis of a dynamic configuration by a remote entity, said at least one scanning object being generated by using malware-susceptible data of the identified electronic file and neglecting malware-insusceptible data of the identified electronic file, transfer of the at least one scanning object of the identified electronic file for remote malware scanning to the remote entity, and execution of a malware scan of the at least one scanning object of the electronic file at the remote entity by a malware scanning engine or application.

Dynamic remote malware scanning

A method of detecting unauthorized use of a webcam or a microphone on a computer system, the method including, at the computer, identifying a process that is using the webcam or the microphone, determining whether information is visibly displayed by the computer system to indicate to a user the use of the webcam or the microphone by the process; and using a result of the step of determining to identify said process as malware or potential malware.

Detection of webcam abuse

A method of detecting malware on a client computer, the method including generating a hash of an entity at the client computer, whereby the entity is suspected to be malware, sending the hash to a network server, considering the reputation of the hash at the network server by comparing the hash to a database of hashes of known reputation, returning the results of said considering to the client computer, and, if the reputation is not known at the server, sending instructions to the client computer for obtaining further information about the entity at the client computer, wherein said further information is obtained by executing code at the client computer sent by the server to the client computer after said considering the reputation if said code is not stored at the client computer before said generating a hash.

Malware detection method

A method of authenticating or controlling a software application on an end user device. The method includes, at the end user device, downloading software application data from a remote server, the data including application code, a cryptographically derived signature obtained using said application code, and an identity of an application developer. The identity is then used as a look-up key to obtain or authenticate a public key of the application data, and to obtain one or more associated installation and/or operation conditions. The cryptographically derived signature is authenticated using said application code and said public key, and, in the event that authentication is successful, authentication of the application code is performed and/or installation and/or operation of the application controlled using said conditions.

Preventing misuse of code signing certificates

Methods, apparatus, systems are provided for use in detecting unauthorized changes to websites of web operators. Authorized content policy sets for each of a multiplicity of websites from web operators are collected and stored. In addition, content information obtained in respect web content downloaded from said websites by a multiplicity of client devices, client proxy devices, and/or client gateway devices is used to identify websites that do not conform to respective policy sets. Alerts are sent to the web operator of any non-conforming website. Optionally, alerts may be sent to client devices, client gateway devices, and/or client proxy devices for use in scanning or blocking the web content from non-conforming websites.

Detecting unauthorised changes to website content

A method of obtaining password data for entry to an application running on a device. The method may include running a password manager application on a device. The password manager application may identify one or more applications installed on the device. The password manager application may display the identified applications on a display of the device. The password manager application may receive a user selection of a displayed application. The password manager application may determine whether an entry exists for the selected application in a memory associated with the password manager application. If no entry exists, the password manager application may generate an entry comprising password data for the selected application. If an entry exists, the password manager application may retrieve password data relating to the selected application.

Obtaining password data

A method and apparatus for performing an anti-virus scan of a file system. Intermediate scanning results are obtained for a file in the file system, prior to a scan of the file being completed. The intermediate scanning results are then stored in a database. The intermediate scanning results can be used to speed up subsequent scans, and to provide other useful information to an on-line anti-virus server. In a subsequent scan of the file system, a determination is made whether intermediate scanning results relating to the file are available in the database. If they are available for a particular type of intermediate scan, then a scan need not be performed for the file. If they are not, then the scan can be performed.

Method and apparatus for anti-virus scanning of file system

Embodiments of the invention relate to improving security of computer resources. According to an aspect, providing access to a reference database storing information on known behavior of trusted computer processes and on resources the trusted computer processes need from a configuration database, the configuration database stores configuration information of a computer network; detecting, by a first computer process from a second computer process, a request for specified resource of the configuration database; determining, based on the request and the reference database, whether the second computer process is known to need the requested resource; upon determining that the computer process is not known to need the requested resource, causing a response to the request indicating to the second computer process that the response includes the requested resource but wherein the response comprises a resource indicator that directs the second computer process to access an environment monitored by an anti-malware computer process.

Security of computer resources

Determining malware status of a file is disclosed. An apparatus obtains information about an unknown target file, obtains system context of the unknown target file, and determines the unknown target file as clean if the system context matches with one or more predetermined conditions indicative of cleanliness. The predetermined conditions of cleanliness include at least the target file being located in a directory which contains other clean files.

Determining malware status of file

A method and apparatus for authenticating a first node's identity in a communication network. An authentication node receives from a second node an authentication request. The authentication request includes a first certificate that has previously been presented to the second node by a node purporting to be the first node. The authentication node retrieves a second certificate belonging to the first node from the first node, and compares the first certificate with the second certificate. If the certificates match, then the first node's identity can be authenticated but if the certificates do not match, then the first node's identity cannot be authenticated. The results of the comparison are then sent to the second node.

Authenticating a node in a communication network

Malicious object detection is disclosed. An apparatus includes one or more processors, and one or more memories including computer program code. The one or more memories and the computer program code are configured to, with the one or more processors, cause the apparatus at least to perform: obtain image data; obtain association data relating to the image data; identify the image data as corresponding to an identified image among known reference images; and set reputation data of the association data as suspicious, if the association data does not match acceptable associations for the identified image.

Malicious object detection

A method and apparatus for authenticating a first node's identity in a communication network. An authentication node receives from a second node an authentication request. The authentication request includes a first certificate that has previously been presented to the second node by a node purporting to be the first node. The authentication node retrieves a second certificate belonging to the first node from the first node, and compares the first certificate with the second certificate. If the certificates match, then the first node's identity can be authenticated but if the certificates do not match, then the first node's identity cannot be authenticated. The results of the comparison are then sent to the second node for use by the second node to authenticate the first node.

Method(s) and apparatus are described for use in preventing unauthorized redirection and/or routing of packets transmitted in a communication network. Packets generated by one or more devices in the communications network are intercepted by an apparatus. The intercepted packets are inspected and it is detected whether at least one of the intercepted packets is associated with redirection based on an unauthorized destination. For each intercepted packet, packet and protocol inspection may be used to determine the originally intended destination of the packet and to determine any other destination(s) associated with redirection of the packet. For each intercepted packet, if the any other destination(s) are not associated with one or more authorized destinations corresponding to the originally intended destination, then the intercepted packet is associated with redirection to an unauthorized destination. Those detected intercepted packets associated with redirection based on the unauthorized destination are blocked or corrected.

Unauthorised/malicious redirection

Methods are detailed for online fraud prevention. In one approach state information of a first and a second device is monitored, both of which are associated with one user. During a multi-factor authentication procedure which utilizes at least one of the first and the second devices for authorizing a transaction by an Internet domain, a security server participates in a supplemental security procedure which is conditional on the monitored state information. In another approach the second device receives a message that is ostensibly related to multi-factor authorization by an Internet domain, and in response sends a query about state information of the first device. Based on the response to the query that indicates the state information, the second device performs a supplemental security procedure.

Growing community of inventors

Kirkkonummi, Finland

Jarno Niemela