Symantec Corporation

Peking University

Ca, Inc.

Jun Mao

Bruce McCorkendale

Abubakar A Wawda

Xue Tian

Xiaole Zhu

Sheng Gong

Qingchun Meng

Ge Hua Huang

Jingnan Si

Matthew Yeo

Barry Laffoon

Wei Guo Eric Hu

Sourabh Satish

Ru Huang

Yue Pan

Yinglong Huang

Walter Bogorad

Yimao Cai

Andrew B Gardner

Peng Xiong

Jinghao Li

Shenghu Tan

Guilin Hu

Xuefeng Tian

A computer-implemented method for preventing vulnerable files from being opened may include (1) registering a security application as a universal file opener, (2) receiving, at the security application, a request to open a file, (3) identifying at least one other application on the computing device that is capable of opening the file, (4) determining, based on a security analysis, that there is a security risk in opening the file with the other application that is capable of opening the file, and (5) preventing the other application that is capable of opening the file from opening the file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing vulnerable files from being opened

A method for detecting malicious software is described. In one embodiment, the method includes identifying an unknown application on mobile device, identifying a package name of the unknown application, analyzing the package name of the unknown application in relation to package names of one or more categorized applications, and determining a likelihood the unknown application includes malware based at least in part on analyzing the package name of the unknown application.

Detecting malicious software

A computer-implemented method for detecting malware using machine learning may include (1) identifying data to be analyzed for malware, (2) classifying, using a classifier created by a combination of at least one deep learning neural network and at least one supervised data mining method, the data to be analyzed for malware, (3) determining, based on a predefined threshold, that the classification of the data indicates potential malware on the computing device, and (4) performing a security action based on the determination of potential malware on the computing device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting malware using machine learning

The present disclosure relates to systems and methods for detecting malware. In some embodiments, a method may include detecting, via a processor, a user login event at an application; dynamically comparing, via the processor, the user login event with one or more expected behaviors associated with the application; and determining, via the processor, whether the application is potential malware based at least in part on a result of the comparing.

System and methods to detect mobile credential leaks during dynamic analysis

A method for detecting application leaks is described. In one embodiment, the method may include the method may include identifying a first application as a known application, assigning a first identifier to the first application, appending the first identifier to data generated by the first application, identifying a second application as an unknown application, assigning a second identifier to the second application, identifying a data usage by the second application, appending the second identifier to data associated with the data usage by the second application, and determining whether the data usage by the second application is associated with the data generated by the first application based at least in part on the first identifier and the second identifier. In some cases, the data usage includes at least one of generating data, modifying data, and transmitting data.

Detecting application leaks

The present disclosure relates to detecting security risks from application packages signed using a key based on differences detected between application packages. An example method generally includes calculating a difference score for a first application package signed using the key. The difference score may be based on differences detected between content of the first application package and content of one or more second application packages signed using the key. A computing system calculates an average difference score from the individual difference scores. Upon determining that the difference score for a specific application package of the second application packages exceeds the average difference score by a threshold amount, the computing system sets a reputation associated with the specific application package to an unknown reputation and generates an alert indicating that the specific application package is a potential security risk.

Determining application reputation based on deviations in security rating scores

Techniques for identifying malicious downloadable applications are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for identifying malicious downloadable applications comprising receiving a signature of a downloadable application, identifying, using at least one computer processor, a known good application having at least one attribute in common with the downloadable application and having a signature different from the signature of the downloadable application, analyzing the downloadable application to evaluate one or more risk factors based at least in part on the at least one common attribute and the difference in signatures, and determining, based on the evaluated one or more risk factors, one or more responsive actions.

Techniques for identifying malicious downloadable applications

A computer-implemented method for classifying package files as Trojans may include (1) detecting a resemblance between an unclassified package file and a known legitimate package file, (2) determining that the unclassified package file is signed by a different signatory than a signatory that signed the known legitimate package file, (3) determining that a feature of the unclassified package file is suspicious, the feature being absent from the known legitimate package file, and (4) classifying the unclassified package file as a Trojan version of the known legitimate package file based on the unclassified package file being signed by the different signatory and having the suspicious feature. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for classifying package files as trojans

A computer-implemented method for validating application signatures may include maintaining a signature-validation database that associates application publishers with signature keys by, for each application in a set of applications, (1) identifying a key used to sign the application, (2) determining that the application claims to be provided by a publisher, (3) verifying that the claimed publisher provides the application, and (4) maintaining, in response to verifying that the claimed publisher provides the application, an association that indicates that the publisher of the application is authorized to use the key. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for validating application signatures

A computer-implemented method for combining static and dynamic code analysis may include 1) identifying executable code that is to be analyzed to determine whether the executable code is capable of leaking sensitive data, 2) performing a static analysis of the executable code to identify one or more objects which the executable code may use to transfer sensitive data, the static analysis being performed by analyzing the executable code without executing the executable code, 3) using a result of the static analysis to tune a dynamic analysis to track the one or more objects identified during the static analysis, and 4) performing the dynamic analysis by, while the executable code is being executed, tracking the one or more objects identified during the static analysis to determine whether the executable code leaks sensitive data via the one or more objects. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for combining static and dynamic code analysis

A computer-implemented method for identifying private keys that have been compromised may include (1) identifying a private key that enables a signatory to digitally sign applications, (2) collecting information about the private key from at least one public source, (3) determining, based on the information collected from the public source, that the private key has been compromised and is accessible to unauthorized signatories, and (4) performing a security action in response to determining that the private key has been compromised and is accessible to the unauthorized signatories. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying private keys that have been compromised

A computer-implemented method for optimizing scans of pre-installed applications may include (1) identifying, on a client device, a plurality of applications that are subject to scan-based assessments, (2) determining that the plurality of applications were pre-installed on the client device via a system image for the client device, (3) generating a fingerprint that represents the system image, and (4) fulfilling the scan-based assessments for the plurality of applications by transmitting the fingerprint that represents the system image to an assessment server and receiving, in response, an assessment of the system image. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for optimizing scans of pre-installed applications

Systems and methods are disclosed involving a resistive memory with a small electrode, relating to the field of semiconductor resistive memory in ULSI. An illustrative resistive memory may include an Al electrode layer, a SiOlayer, a Si layer, a resistive material layer and a lower electrode layer in sequence, wherein the Al electrode layer and the resistive material layer are electrically connected through one or more conductive channel and the conductive channel is formed by penetrating Al material into the Si layer via defects in the SiOlayer and dissolving Si material into the Al material. Methods may include forming a lower electrode layer, a resistive layer, a Si layer and a SiOlayer over a substrate; fabricating a Al electrode layer over the SiOlayer; and performing an anneal process to the resultant structure. Consistent with innovations herein, a small electrode may be obtained via a conventional process.

Resistive memory with small electrode and method for fabricating the same

A computer-implemented method for monitoring application resource usage on mobile computing systems may include 1) identifying a mobile computing system that is configured to execute one application at a time as a foreground application, 2) identifying a request to determine a resource consumption level of an application on the mobile computing system, 3) identifying, in response to the request, at least one frequency level at which a processor of the mobile computing system operates while the application executes as the foreground application, and 4) determining, based on the identified frequency level, the resource consumption level of the application. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for monitoring application resource usage on mobile computing systems

A method and apparatus for identifying an application source from which an application is installed on a non-rooted computing device. An application source identifier of a security application that does not have root access to an operating system monitors for an application installation. The application source identifier extracts a process identifier (PID) of the application being installed from a log message associated with the application installation and determines a package name from the PID. The PID identifies an application source from which the application is installed. The application source identifier receives, based on the package name, a confidence level for the application source from a security service over a network.

Growing community of inventors

Culver City, CA, United States of America

Jun Mao