Microsoft Technology Licensing, LLC

Jigar J Mody

Tony Lee

Ning Sun

Chengyun Chu

Hong Jia

Jason Geffner

Frank Swiderski

Patrick Winkler

Alexey A Polyakov

Neil A Cowie

Adrian Mihail Marinescu

Marc E Seinfeld

Chengi Jimmy Kuo

Sandy Wong

George Oliver Johnston

Ying Lin

Mikhail Mikhailov

Scott Grosenick

Srinivas Bobba

Automated malware signature generation is disclosed. Automated malware signature generation includes monitoring incoming unknown files for the presence of malware and analyzing the incoming unknown files based on both a plurality of classifiers of file behavior and a plurality of classifiers of file content. An incoming file is classified as having a particular malware classification based on the analyzing of incoming unknown files and a malware signature is generated for the incoming unknown file based on the particular malware classification. Access is provided to the malware signature.

Automated malware signature generation

A system and method for defining code by its functionality is disclosed. The technology initially accesses a portion of code. Once the portion of code is accessed at least one functional operation embedded in the code is determined. When the functional operation in the code is determined, the portion of code is then defined by the functional operation. In so doing, the portion of code can be defined by functional operation without requiring the consideration of any semantics related to the portion of code.

Defining code by its functionality

A malware analysis system is described that provides information about malware execution history on a client computer and allows automated back-end analysis for faster creation of identification signatures and removal instructions. The malware analysis system collects threat information on client computers and sends the threat information to a back-end analysis component for automated analysis. The back-end analysis component analyzes the threat information by comparing the threat information to information about known threats. The system builds a signature for identifying the threat family and a mitigation script for neutralizing the threat. The system sends the signature and mitigation data to client computers, which use the information to mitigate the threat. Thus, the malware analysis system detects and mitigates threats more quickly than previous systems by reducing the burden on technicians to manually create environments for reproducing the threats and manually analyze the threat behavior.

Collecting and analyzing malware data

Embodiments of the invention provide a method, system, and media for determining search results based on a query. One embodiment of the method includes receiving an initial query, inspecting an initial set of query-related information that is associated with the query, which is the fruit of analyzing aggregated user-interaction data, which includes information related to how users have previously interacted with former search results that were presented in response to the query. This information includes prior metadata associated with the former search results. Embodiments further include presenting an initial set of search results based on the initial set of query-related information, gathering current user-interaction data, and updating the initial set of query-related information based on the current user-interaction data. In this way, an embodiment of the invention helps, among other things, map a semantic meaning of a query to results that bring about a satisfying user experience.

Basing search results on metadata of prior results

Aspects of the subject matter described herein relate to identifying good files and malware based on whitelists and blacklists. In aspects, a node starts a scan of files on a data store. In conjunction with starting the scan, the node creates a data structure that indicates the directories on the data store. The node sends the data structure to a whitelist server and a blacklist server and an indication of a last successful time of communication. The whitelist and blacklist servers respond to the node with information about any new files that have been added to the directories since the last successful communication. The node may subsequently use the information to identify known good files and malware.

Whitelist and blacklist identification data

The present invention is directed to a method and system for automatically classifying an application into an application group which is previously classified in a knowledge base. More specifically, a runtime behavior of an application is captured as a series of events which are monitored and recorded during the execution of the application. The series of events are analyzed to find a proper application group which shares common runtime behavior patterns with the application. The knowledge base of application groups is previously constructed based on a large number of sample applications. The construction of the knowledge base is done in such a manner that each sample application can be classified into application groups based on a set of classification rules in the knowledge base. The set of classification rules are applied to a new application in order to classify the new application into one of the application groups.

Classification of malware using clustering that orders events in accordance with the time of occurance

Growing community of inventors

Bellevue, WA, United States of America

Jigar J Mody