Mcafee, Inc.

Crowdstrike, Inc.

Joel Robert Spurlock

Jonathan Lewis Edwards

Igor G Muttik

Cedric Cochin

Aditya Kapoor

Ramnath Venugopalan

Gregory William Dalcher

James Douglas Bean

John Douglas Teddy

Carl D Woodward

Craig D Schmugar

Zheng Zhang

Daniel Joseph Wolff

Ofir Arkin

Fraser Peter Howard

Khai Nhu Pham

Andrew A Furtak

Christiaan Beek

Yury Bulygin

Steve O Hearnden

Adam James Carrivick

John J Loucaides

Oleksander Bazhaniuk

Ronald Gallella

Gregory Michael Heitzmann

Ned M Smith

Vincent J Zimmer

Rajesh Poornachandran

Ahmed Said Sallam

Andrew Woodruff

Daniel L Burke

Brett Meyer

Prashanth Palasamudram Ramagopal

Joseph C Lowe

Vitaly Zaytsev

Nikhil Meshram

Dhananjay Kumar

Leonardo Frittelli

Saurabh Gautam

Techniques and systems for a security service system configured with a sensor component including a machine learning (ML) malware classifier to perform behavioral detection on host devices. The security service system may deploy a sensor component to monitor behavioral events on a host device. The sensor component may generate events data corresponding to monitored operations targeted by malware. The system may map individual events from events data onto a behavioral activity pattern and generate process trees. The system may extract behavioral artifacts to build a feature vector used for malware classification and generate a machine learning (ML) malware classifier. The sensor component may use the ML malware classifier to perform asynchronous behavioral detection on a host device and process system events for malware detection.

Machine learning malware classifications using behavioral artifacts

Systems, methods, and media for identifying and responding to malicious files having similar features are provided. More particularly, in some embodiments, systems for identifying and responding to malicious files having similar features are provided, the systems comprising: a memory; and a hardware processor coupled to the memory and configured to: receive feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information; create clusters based on the feature information; determine if a file corresponding to one of the clusters is malicious; and report to a plurality of endpoints that other files corresponding to the one of the clusters is malicious.

Systems, methods, and media for identifying and responding to malicious files having similar features

Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.

Mitigation of ransomware

Particular embodiments described herein provide for an electronic device that can be configured to identify a process running on the electronic device, assign a reputation to the process if the process has a known reputation, determine if the process includes executable code, determine a reputation for the executable code, and combine the reputation for the executable code with the reputation assigned to the process to create a new reputation for the process.

Determining a reputation for a process

There is disclosed in one example an advertisement reputation server, including: a hardware platform including a processor and a memory; a network interface; and an advertisement reputation engine including instructions encoded in memory to instruct the processor to: receive via the network interface a plurality of advertisement instances displayed on client devices; extract from the advertisement instances an advertiser identifier; analyze one or more advertisements associated with the advertiser identifier to assign an advertiser reputation; and publish via the network interface advertisement reputation information derived from the reputation for the advertisement identifier.

Malicious advertisement protection

Particular embodiments described herein provide for an electronic device that can be configured to analyze data related to a digital certificate and assign a reputation to the digital certificate, where the reputation includes an indication if the data is proper. The analysis of the data can include determining if code signing for the digital certificate matches binary code for the digital certificate, if the digital certificate has been grafted to the data by modifying a portable executable file header, or the digital certificate is the same as another trusted digital certificate associated with different data.

Malware detection using a digital certificate

There is disclosed in one example a computing apparatus, including: a processor and a memory; and instructions encoded within the memory to instruct the processor to provide a security agent to: identify a malicious process; construct a genealogical process tree of the malicious process, the genealogical process tree including both vertical direct inheritance and horizontal indirect inheritance relationships; and terminate the malicious process and at least some related processes in the genealogical process tree.

Multi-lateral process trees for malware remediation

A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide 'content-less' malware detection, i.e., detecting a process as being an 'anomaly' not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) 'trusted' application behaviors, i.e., the trusted applications' 'phenotypes' and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e., &#x201c;application phenotypes&#x201d;)&#x2014;and later compare the processes executed on a user device to the stored behavioral models to determine whether the actual measured behavior reflects a &#x201c;good&#x201d; application, or if it differs from the stored behavioral models to a sufficient degree and with a sufficient degree of confidence, thus indicating a potentially malicious application or behavior.

Application phenotyping

Disclosed herein are cloud-based machine learning systems and methods for monitoring networked devices to identify and classify characteristics, to infer typical or atypical behavior and assign reputation profiles across various networked devices, and to make remediation recommendations. In some embodiments, a cloud-based machine learning system may learn the typical operation and interfacing of a plurality of reputable devices that are known to be free from malicious software and other threats. In some embodiments, a cloud-based machine learning system may learn the typical operation and interfacing of a device, and may identify atypical operations or interfaces associated with that device by comparing the operations and interfaces to those of a plurality of networked devices or to those of a defined standard reference device.

Static and dynamic device profile reputation using cloud-based machine learning

Particular embodiments described herein provide for an electronic device that can be configured to identifying a digital certificate associated with data and assigning a reputation to the digital certificate, where the digital certificate is classified as trusted if the digital certificate is included in an entry in a whitelist and the digital certificate is classified as untrusted if the digital certificate is included in an entry in a blacklist.

Determining the reputation of a digital certificate

Particular embodiments described herein provide for an electronic device that can be configured to receive a request from a process to access data is a system, determine if the data is in a virtualized protected area of memory in the system, and allow access to the data if the data is in the virtualized protected area of memory and the process is a trusted process. The electronic device can also be configured to determine if new data should be protected, store the new data in the virtualized protected area of memory in the system if the new data should be protected, and store the new data in an unprotected area of memory in the system if the new data should not be protected.

Virtualized trusted storage

Growing community of inventors

Portland, OR, United States of America

Joel Robert Spurlock