Symantec Corporation

Ca, Inc.

Ubermedia, Inc.

Snap Technologies, Inc.

Joseph Chen

Jeffrey Wilhelm

Brendon Woirhaye

Christopher J Peterson

Jamie Jooyoung Park

Robert Conrad

Qing Li

Rui Jing

Kamron Farrokh

Peter Ferrie

Chris Houston

Qu Bo Song

Torrey Umland

Michael Radford

QuBo Song

Jason P Fields

Zhongning Chen

Allen Hair

Michael N Agostino

Yovav Meydad

Jason Levine

David E Benson

Christopher Starace

Eric J Kim

Shaun Aimoto

Adam Glick

Spencer Dale Smith

Min Hao Chen

Haik A Mesropian

Quentin Liu

David Kane

Ron Frederick

Yuan Liu

Zhicheng Zeng

Jordan Saxonberg

Jinghao Li

Ying Li

Oksoon Jeong

Zhe Liu

Qubo Song

Jing Rui

Jiang Dong

Arvind Rao

Costin Ionescu

Mark Molnar

Rei Kristian Resurreccion

Dave Stahl

Tigran Grigoryan

The disclosed computer-implemented method for utilizing metadata for protecting against the sharing of images in a computing network may include (i) identifying an image file stored in a public folder on a computing device, (ii) storing a copy of the image file within a secure data storage application, (iii) encoding metadata for revealing an image in the image file, (iv) performing a security action that protects against sharing the image file from the public folder by masking the image in the image file with the encoded metadata, and (v) rendering the image in the image file as an unmasked version of the image from the image file or the copy of the image file in the secure data storage application by decoding the metadata utilized to mask the image. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for utilizing metadata for protecting against the sharing of images in a computing network

The disclosed computer-implemented method for managing endpoint security states using passive data integrity attestations may include (i) receiving passively collected network data from an endpoint device of a computing environment, (ii) determining a security state of the endpoint device using the passively collected network data from the endpoint device, (iii) determining that the security state of the endpoint device is below a threshold, and (iv) in response to determining that the security state of the endpoint device is below a threshold, performing a security action to protect the computing environment against malicious actions. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing endpoint security states using passive data integrity attestations

The disclosed computer-implemented method for preventing sharing of sensitive content in image data on a closed computing platform may include (i) detecting initiation of a network connection for sending network traffic data to a data storage service on the closed computing platform, (ii) monitoring the sending of the network traffic data to identify a target traffic indicator associated with image data, (iii) interrupting the sending of the network traffic data upon identifying the target traffic indicator, (iv) analyzing the image data to identify sensitive content, and (v) performing a security action that protects against the sensitive content being shared to the data storage service on the closed computing platform. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing sharing of sensitive content in image data on a closed computing platform

A computer-implemented method for enforcing dynamic network security policies may include (i) monitoring, by a network traffic protection system, network packets transmitted on a network segment, (ii) detecting, by the network traffic protection system, a suspicious transmission of at least one network packet associated with an endpoint computing device connected to the network segment, (iii) modifying, based on the suspicious transmission of the network packet, at least one network security policy for the network segment, and (iv) enforcing, by the network traffic protection system, the modified network security policy for all endpoint computing devices connected to the network segment. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for enforcing dynamic network security policies

Application identification and control in a network device. In one embodiment, a method may include establishing, at a network device, a Virtual Private Network (VPN) tunnel through which all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) traffic sent from or received at the network device is routed. The method may also include monitoring, at the network device, all TCP and UDP traffic sent from or received at the network device through the VPN tunnel. The method may further include extracting, at the network device, payload data from the monitored TCP and UDP traffic. The method may also include analyzing the extracted payload data to identify applications executing on the network device that sent or received the monitored TCP and UDP traffic. The method may further include taking, at the network device, a security action on the network device based on the identified applications.

Application identification and control in a network device

A computer-implemented method for detecting potentially malicious hardware-related anomalies may include (1) profiling a computing environment of at least one hardware component on a computing device, (2) detecting, by comparing the hardware component's profile with an expected profile for the hardware component, at least one anomaly in the hardware component's computing environment, (3) identifying additional suspicious activity on the computing device, and (4) determining, by correlating the additional suspicious activity on the computing device with the anomaly in the hardware component's computing environment, that the anomaly in the hardware component's computing environment is potentially malicious. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting potentially malicious hardware-related anomalies

The disclosed computer-implemented method for chaining virtual private networks may include (i) establishing a virtual private network client that routes network traffic to a virtual private network, (ii) establishing an additional virtual private network client that routes the network traffic to an additional virtual private network, (iii) configuring the virtual private network client for split routing such that the virtual private network client routes different ranges of incoming network traffic to respective different network addresses, (iv) configuring the additional virtual private network client to route all incoming network traffic according to a default route, and (v) chaining the virtual private network client and the additional virtual private network client such that they process incoming network traffic in series. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for chaining virtual private networks

The disclosed computer-implemented method for network traffic routing to reduce service congestion at a server may include (1) receiving, by the computing device and from the cloud server, a traffic routing policy, (2) identifying, for a transaction and using at least one hook inserted into an operating system of the computing device, metadata describing a traffic type, (3) comparing the metadata with the traffic routing policy to determine the transaction is bypass traffic, and (4) sending the bypass traffic from the computing device to a destination other than the cloud server. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for network traffic routing to reduce service congestion at a server

The disclosed computer-implemented method for protecting personally identifiable information during electronic data exchanges may include (i) receiving, from a computing device, an authentication token for a proposed electronic data exchange, (ii) preventing the user's personally identifiable information from entering the proposed electronic data exchange by identifying the user using the anonymized identifier rather than using the user's personally identifiable information, (iii) authenticating the user identified in the data exchange information, and (iv) in response to authenticating the user, authorizing completion of the proposed electronic data exchange. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting personally identifiable information during electronic data exchanges

The present disclosure relates to systems and methods for blocking an infection vector. In some embodiments, a method may include detecting, at a first device, a synchronization event with a second device, the first device and the second device operating with a proprietary mobile operating system. In some examples, the method may include recognizing, by the first device, that the first device is attempting to send a data package to the second device, and identifying the data package as malware. The method may further include blocking the data package from being received at the second device based at least in part on the identifying.

Proactive protection of mobile operating system malware via blocking of infection vector

The disclosed computer-implemented method for detecting malicious processes that encrypt files may include (i) identifying a backup file created by a backup process on the computing device, (ii) detecting an attempt to alter the backup file by a process that is not the backup process, (iii) determining, based at least in part on the attempt to alter the backup file being made by the process that is not the backup process, that the process is a malicious process designed to encrypt files on the computing device so that a legitimate owner of the files cannot access the files, and (iv) performing a security action in response to determining that the process is malicious. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting malicious processes that encrypt files

The disclosed computer-implemented method for detecting unknown vulnerabilities in computing processes may include (1) monitoring a computing environment that facilitates execution of a computing process by logging telemetry data related to the computing process while the computing process is running within the computing environment, (2) determining that the computing process crashed while running within the computing environment, (3) searching the telemetry data for evidence of any vulnerabilities that potentially led the computing process to crash while running within the computing environment, (4) identifying, while searching the telemetry data, evidence of at least one vulnerability of the computing process that is not yet known to exist within the computing process and then in response to identifying the evidence of the computing process's vulnerability, (5) performing at least one security action to hinder any potentially malicious exploitation of the computing process's vulnerability. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting unknown vulnerabilities in computing processes

The disclosed computer-implemented method for classifying permissions on mobile devices may include (1) detecting that an application executing on a mobile device is issuing a request for one or more requested permissions to access one or more components of the mobile device, (2) determining an intended use of the application, (3) performing, through a security system distinct from the application and the operating system, an analysis of the request issued by the application at least in part by determining whether the intended use of the application corresponds to an expected use of the requested permission, and (4) providing, via a graphical user interface, a result of the analysis to an end user of the mobile device that indicates a security implication caused by granting the one or more requested permissions to the application. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for classifying permissions on mobile devices

The disclosed computer-implemented method for detecting gadgets on computing devices may include (i) identifying, on a computing device, a process containing multiple modules, (ii) identifying, within the process, each module that does not implement a security protocol that randomizes, each time the module executes, a memory location of at least one portion of data accessed by the module, (iii) copying each module that does not implement the security protocol to a section of memory dedicated to security analyses, (iv) determining, based on detecting at least one gadget-specific characteristic within at least one copied module, that the process contains a gadget that is capable of being maliciously exploited, and then (v) performing a security action on the computing device to prevent the gadget from being maliciously exploited. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting gadgets on computing devices

A computer-implemented method for identifying suspicious text-messaging applications on mobile devices may include (1) identifying at least one outgoing text message on a mobile device, (2) analyzing at least one attribute of the outgoing text message identified on the mobile device, (3) determining that the outgoing text message is illegitimate based at least in part on analyzing the attribute of the outgoing text message, (4) identifying, in response to the determination, a suspicious text-messaging application that created the illegitimate outgoing text message on the mobile device, and then (5) performing, in response to the determination, at least one security action on the suspicious text-messaging application to prevent the suspicious text-messaging application from creating additional illegitimate text messages on the mobile device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying suspicious text-messaging applications on mobile devices

Growing community of inventors

Los Angeles, CA, United States of America

Joseph Chen