Sophos Limited

Microsoft Technology Licensing, LLC

Emc Corporation

Microsoft Corporation

Kenneth D Ray

Andrew James Thomas

Mark David Harris

Russell Humphries

Daniel Salvatore Schiappa

Karl Ackerman

Simon Neil Reed

Joseph H Levy

Harald Schütz

Paul England

Neil Robert Tyndale Watkiss

John Edward Tyrone Shaw

Anthony John Merry

Daniel Stutz

Andreas Berger

Andrew G P Smith

Beata Ladnai

Moritz Daniel Grimm

Doron J Holan

Robert Wendell Cook

John Charles Dunn

Louis J Giliberto

Bryan M Willman

Firdosh Kersy Bhesania

Joshua Daniel Saxe

Jonathan D Schwartz

Jamie Hunter

Glen T Slick

Nathan T Lewis

James Douglas Bean

Stefan Thom

David Rudolph Wooten

James Anthony Schwartz, Jr

Shail R Talati

Marcus Peinado

Scott Field

Michael Todd Kramer

Joseph M Joy

William Michael Zintel

Scott C Cottrille

Thekkthalackal Varugis Kurien

Stanley William Adermann

Lute Edwin Engels

Mark D Bertoglio

Eric J Horvitz

Michael David Marr

Alexander G Gounares

Ling Tony Chen

Chris Demetrios Karkanias

Darko Kirovski

Lawrence N Friedman

Hubert Van Hoof

Benjamin Livshits

Felix Stefan Domke

Vijay Gajjala

Rushmi U Malaviarachchi

Gregory Kostal

Vladimir Yarmolenko

Ervin Peretz

Krassimir Emilov Karamfilov

Gennady Medvinsky

Matthew Charles Setzer

Ari Juels

Paul J Leach

Yedidya Dotan

Timothy Mark Moore

Charles W Kaufman

Jason Garms

James Morris Alkove

Mark F Williams

Octavian Tony Ureche

William R Tipton

Keith Stuart Kaplan

Carl Melvin Ellison

Patrik Schnell

Alina Oprea

David Benson Cross

Marten Van Dijk

Niels Thomas Ferguson

Shuvabrata Ganguly

Forrest Curtis Foltz

Andrew M Herron

Oren Rosenbloom

Erik Lee Holt

Arvind M Murching

Gareth Richards

Andrew John Thornton

Roy Hodgman

Michael G Love

Jesper B Lind

Samuel Curry

Marcus J Andrews

Alex Vaystikh

Pavel Zeman

Philip J Lafornara

John Bruno

Paul Cador Roberts

Lonny Dean McMichael

Idan Avraham

James E Veres

A threat management facility stores a number of entity models that characterize reportable events from one or more entities. A stream of events from compute instances within an enterprise network can then be analyzed using these entity models to detect behavior that is inconsistent or anomalous for one or more of the entities that are currently active within the enterprise network.

Centralized event detection

An endpoint in an enterprise network is instrumented with sensors to detect security-related events occurring on the endpoint. Event data from these sensors is augmented with contextual information about, e.g., a source of each event in order to facilitate improved correlation, analysis, and visualization at a threat management facility for the enterprise network.

Data augmentation for threat investigation in an enterprise network

A compute instance stores a programmable feature extractor associated with a machine learning model maintained by a server-based computing system configured to communicate with the compute instance by way of a network. The machine learning model is based on a feature set that includes a plurality of features. The compute instance executes the programmable feature extractor to generate a feature vector corresponding to a data instance accessed by the compute instance, where the feature vector includes a feature value specific to the data instance for each feature included in the feature set. The compute instance transmits the feature vector corresponding to the data instance to the server-based computing system for use as a training input to the machine learning model.

Programmable feature extractor

In a threat management platform, a number of endpoints log events in an event data recorder. A local agent filters this data and feeds a filtered data stream to a central threat management facility. The central threat management facility can locally or globally tune filtering by local agents based on the current data stream, and can query local event data recorders for additional information where necessary or helpful in threat detection or forensic analysis. The central threat management facility also stores and deploys a number of security tools such as a web-based user interface supported by machine learning models to identify potential threats requiring human intervention and other models to provide human-readable context for evaluating potential threats.

Enterprise network threat detection

An automated system attempts to characterize code as safe or unsafe. For intermediate code samples not placed with sufficient confidence in either category, human-readable analysis is automatically generated to assist a human reviewer in reaching a final disposition. For example, a random forest over human-interpretable features may be created and used to identify suspicious features in a manner that is understandable to, and actionable by, a human reviewer. Similarly, a k-nearest neighbor algorithm may be used to identify similar samples of known safe and unsafe code based on a model for, e.g., a file path, a URL, an executable, and so forth. Similar code may then be displayed (with other information) to a user for evaluation in a user interface. This comparative information can improve the speed and accuracy of human interventions by providing richer context for human review of potential threats.

Computer augmented threat evaluation

Possible Denial of Service (DOS) activity is detected and remediated based on an initial heartbeat failure from a network asset, followed by externally directed network traffic from the network asset. In general, an interruption of the heartbeat can signal the possible presence of malware on the network asset, and the externally directed network traffic, and particularly certain patterns of traffic such as a high volume of traffic toward an address with a known, good reputation, can signal the possible presence of a DoS bot on the network asset that is sourcing the network traffic.

Intrusion detection using a heartbeat

Disclosed herein is a technique for detecting potential phishing attacks by monitoring outbound web traffic from an endpoint, along with inbound electronic mail traffic addressed to a user of the endpoint. With this information, a search can be performed for possible sources in the web traffic of a request for a hyperlink located in the inbound mail traffic, and when no source is located, phishing remediation can be performed, including restrictions on access to the hyperlink at an endpoint operated by the user.

Detecting phishing attacks

Security is improved by adding a security heartbeat for and endpoint as a factor in a multi-factor authentication system. The security heartbeat may be used directly as an authentication factor, e.g., where the heartbeat provides a reliable and verifiable indication of identity, or the security heartbeat may be used as a gating input for some other verification method, e.g., where a text message with a temporary security code can only be transmitted to a user when the user's endpoint is providing a secure heartbeat.

Multi-factor authentication

An application executing on an endpoint accesses remote resources using a gateway. In response to a requested remote access, the application may be marked with a descriptor that specifies a target action and a pattern of occurrences of the target action. When a second observable action on the endpoint includes the pattern of events following the first observable action, a reportable event may be generated indicating a compromised state of the endpoint. The gateway can then regulate usage of the remote resource based on the reportable event.

Firewall techniques for colored objects on endpoints

A firewall uses information about an application that originates a network request to determine whether and how to forward the request over a network. The firewall may more generally rely on the identity of the originating application, the security state of the originating application, the security state of the endpoint, and any other information that might provide an indication of malicious activity, to make routing and forwarding decisions for endpoint-originated network traffic.

Application firewall

A threat management facility detects a device on an enterprise network and determines whether the device is one of a set of managed devices for the enterprise network. When the device is not one of the set of managed devices, the threat management facility may selectively direct the device to a portal that provides support to the user of the device while the device awaits admission to the enterprise network. As the user interacts with the portal, the portal may manage admission of unrecognized devices onto the enterprise network while making efficient use of network administrator resources.

Managing admission of unrecognized devices onto an enterprise network

An endpoint coupled in a communicating relationship with an enterprise network may include a data recorder configured to store an event stream of data indicating events on the endpoint including types of changes to computing objects, a filter configured to locally process the event stream into a filtered event stream including a subset of types of changes to the computing objects, and a local security agent. The local security agent may be configured to transmit the filtered event stream to a threat management facility, respond to a filter adjustment from the threat management facility by adjusting the filter to modify the subset of types of changes included in the filtered event stream, and respond to a query from the threat management facility by retrieving data stored in the data recorder over a time window before the query and excluded from the filtered event stream.

Endpoint with remotely programmable data recorder

A data recorder stores endpoint activity on an ongoing basis as sequences of events that causally relate computer objects such as processes and files. When a security event is detected, an event graph may be generated based on these causal relationships among the computing objects. For a root cause analysis, the event graph may be traversed in a reverse order from the point of an identified security event (e.g., a malware detection event) to preceding computing objects, while applying one or more cause identification rules to identify a root cause of the security event. Once a root cause is identified, the event graph may be traversed forward from the root cause to identify other computing objects that are potentially compromised by the root cause.

Forensic analysis of computing activity

A threat management system provides a collection of queries for investigating security issues within an enterprise. Useful inferences are drawn about the value of different queries, and about the security posture of the enterprise, by monitoring contextual activity such as the popularity and context of query usage, patterns of end user modification to queries, and post-query activity.

Live discovery of enterprise threats based on security query activity

Growing community of inventors

Seattle, WA, United States of America

Kenneth D Ray