Trend Micro Inc.

Commerciant, LP

Standard Microsystems Corporation

Jonathan Edward Andersson

Josiah Dede Hagen

Brandon Niemczyk

Shoufu Luo

Leslie Zsohar

Craig Botkin

Manish Desai

Richard Andrew Lawshae

Peter Andriukaitis

Wei Lu

James Michael Rolette, Jr

Jorge Enrique Muyshondt

Mohammad Husain

Vincenzo Ciancaglini

David Girard

Mathew Robert Powell

Jannis Weigend

Ahmed M Ibrahim

Elvis Collado

Mikhail Gorbulev

Muqeet Ali

Stephen David Povolny

Todd Joseph Kalauhala Manning

Haoping Liu

Husain Mohammad

Proper functioning of an antivirus software running on an endpoint system is detected using a test data that is provided to the endpoint system. The test data is also provided to a backend system, which provides the endpoint system with an antivirus definition that includes information for detecting the test data. The antivirus software running on the endpoint system scans for the test data and reports detection of the test data to the backend system. The antivirus software is deemed to have failed the proper functioning test when the antivirus software fails to report detection of the test data. Proper functioning of the antivirus software is also detected by performing a challenge procedure, which involves sending a challenge message to the endpoint system. The endpoint system is expected to respond to the challenge message with a response that includes expected information.

Detecting an operational state of antivirus software

Systems and methods are presented for mitigating cyber threats. Cybersecurity-related data are stored in a semantic cybersecurity database. A user interface converts a user input to a command utterance. A command node that corresponds to the command utterance is identified in the cybersecurity database. The command node is resolved to one or more action nodes that are connected to the command node, and each action node is resolved to one or more parameter nodes that are connected to the action node. The command node has a command that implements actions indicated in the action nodes. Each action can have one or more required parameters indicated in the parameter nodes. The values of the required parameters are obtained from the command utterance, prompted from the user, or obtained from the cybersecurity database. Actions with their parameter values are executed to mitigate a cyber threat in accordance with the user input.

Automated mitigation of cyber threats using a semantic cybersecurity database

An intrusion prevention system includes a machine learning model for inspecting network traffic. The intrusion prevention system receives and scans the network traffic for data that match an anchor pattern. A data stream that follows the data that match the anchor pattern is extracted from the network traffic. Model features of the machine learning model are identified in the data stream. The intrusion prevention system classifies the network traffic based at least on model coefficients of the machine learning model that are identified in the data stream. The intrusion prevention system apples a network policy on the network traffic (e.g., block the network traffic) when the network traffic is classified as malicious.

Intrusion prevention system with machine learning model for real-time inspection of network traffic

Examples relate to identifying signatures for data sets. In one example, a computing device may: for each of a plurality of first data sets, obtain a data set signature; generate a first data structure for storing each data set signature that is distinct from each other data set signature; for each of a plurality of second data sets, obtain at least one data subset; generate a second data structure for storing each data subset; remove, from the first data structure, each data set signature that matches a data subset included in the second data structure; and for each data set signature removed from the first data structure, identify each first data set from which the data set signature was obtained; and for each identified first data set, obtain a new data set signature.

Identifying signatures for data sets

In one embodiment, a network security device monitors network communications between a computer and another computer. A periodicity of transmissions made by one computer to the other computer is determined, with the periodicity being used to identify candidate time point pairs having intervals that match the periodicity. A graph is constructed with time points of the candidate time point pairs as nodes and with intervals of time point pairs as edges. A longest path that continuously links one time point to another time point on the graph is compared to a threshold length to verify that the transmissions are periodic, and are thus potentially indicative of malicious network communications.

Detection of periodic transmissions for identifying malicious computers

In one embodiment, local begin and end tags are detected by a network security device to determine a local context of a network traffic flow, and a local feature vector is obtained for that local context. At least one triggering machine learning model is applied by the network security device to the local feature vector, and the result determines whether or not deeper analysis is warranted. In most cases, very substantial resources are not required because deeper analysis is not indicated. If deeper analysis is indicated, one or more deeper machine learning model may then be applied to global and local feature vectors, and regular expressions may be applied to packet data, which may include the triggering data packet and one or more subsequent data packets. Other embodiments, aspects and features are also disclosed.

Methods and apparatus for intrusion prevention using global and local feature extraction contexts

Examples relate to identifying malicious activity using data complexity anomalies. In one example, a computing device may: receive a byte stream that includes a plurality of bytes; determine, for a least one subset of the byte stream, a measure of complexity of the subset; determine that the measure of complexity meets a predetermined threshold measure of complexity for a context associated with the byte stream; and in response to determining that the measure of complexity meets the threshold, provide an indication that the byte stream complexity is anomalous.

Identifying malicious activity using data complexity anomalies

Examples relate to identifying randomly generated character strings. In one example, a computing device may: receive a character string that includes two or more characters; identify a number of character transitions included in the character string, each character transition being a change in character type within an n-gram of the character string, where n is a positive integer; and determine, based on the number of character transitions, whether the character string was randomly generated.

Identifying randomly generated character strings

Examples relate to identifying a signature for a data set. In one example, a computing device may: receive a data set that includes a plurality of data units; iteratively determine a measure of complexity for windows of data units included in the data set, each window including a distinct portion of the plurality of data units; identify, based on the iterative determinations, a most complex window of data units for the data set; and identify the most complex window as a data unit signature for the data set.

Identifying a signature for a data set

Example embodiments disclosed herein relate to a network security system. The network security system intercepts inline DNS requests. It is determined whether a domain name associated with one of the inline DNS requests corresponds with one or more domain names. A security action is performed based on the determination.

Network security system to intercept inline domain name system requests

A USB-to-SDIO bridge (UTSB) to efficiently transmit SD/SDIO commands in USB packets. The UTSB may allow the majority of the device drivers for a given SD/SDIO device to remain intact, requiring changes only in the lowest hardware adaptation layer to put a USB wrapper around native SD commands. These commands may be sent over USB-to-SD card reader devices that may include various embodiments of a UTSB, where they may be unwrapped and transmitted to the SD port as if the port were native to the host controller. Additionally, the SD/SDIO commands may be packaged into groups of commands, or transactions, to optimize performance. The host driver may instruct the UTSB bridge device to repeatedly read data from the SDIO device until a communications FIFO on the device is empty (corresponding to a termination condition), and return the collected data to the host.

USB to SD bridge

Disclosed are systems and methods which provide for scanning of information, such as characters or symbols, without requiring a controlled scan velocity. Preferred embodiments utilize an optical sensor in detecting attributes of information scanned and implement compensation techniques to remediate the effects of distortion and present information which may be identified to a high level of confidence. A known topology may be relied upon to present known markers in the scanned information, such as known blank or filled regions, patterns, or other observable traits and utilized with respect to a distorted scanned image to compensate for the effects of the distortion. Additionally or alternatively, vector based pattern recognition may be utilized in remediating distortion of a scanned image.

Growing community of inventors

Austin, TX, United States of America

Jonathan Edward Andersson