Trend Micro Inc.

Fireeye, Inc.

Musarubra US LLC

Jijo Xavier

Robert Venal

Bobby Chien

According to one embodiment, a system for detecting an email campaign includes feature extraction logic, pre-processing logic, campaign analysis logic and a reporting engine. The feature extraction logic obtains features from each of a plurality of malicious email messages received for analysis while the pre-processing logic generates a plurality of email representations that are arranged in an ordered sequence and correspond to the plurality of malicious email message. The campaign analysis logic determines the presence of an email campaign in response to a prescribed number of successive email representations being correlated to each other, where the results of the email campaign detection are provided to a security administrator via the reporting engine.

System and method for detecting repetitive cybersecurity attacks constituting an email campaign

A host machine hosts virtual machines on a first logical layer, and a multi-tenant cloud computing environment on a second logical layer running on top of the first logical layer. An anti-malware provides an anti-malware service to virtual machines on the first logical layer. A tenant of the multi-tenant cloud computing environment may lease a virtual machine, and select the virtual machine for subscription to the anti-malware service. A second identifier of the selected virtual machine on the second logical layer is used to determine a first identifier of the selected virtual machine on the first logical layer. The selected virtual machine is identified to the anti-malware using the first identifier. The anti-malware provides anti-malware service to the selected virtual machine. An anti-malware broker may be employed to facilitate selection of the selected virtual machine, and to allow the anti-malware to identify virtual machines subscribed to the anti-malware service.

Anti-malware service in multi-tenant cloud computing environments

A backup and restore module allows for block level cloud-based back up and restore of a storage volume of a computer. Original content of a block of a disk volume that is being modified by a write operation is stored in a point-in-time snapshot in a cloud storage. The original content may be stored in a hidden volume in the computer prior to being stored in the cloud storage. The original content may be encrypted for storage. To roll back the computer by restoring the disk volume, the snapshot is retrieved from the cloud storage. The original content is copied from the snapshot back to the block to restore the disk volume. The hidden volume may be searched for other original contents yet to be included in the snapshot in the cloud storage, and the original contents may be copied back to corresponding blocks to restore the disk volume.

Growing community of inventors

Milpitas, CA, United States of America

Jijo Xavier