Crowdstrike, Inc.

Mcafee, Inc.

Kirby James Koster

David Frederick Diehl

Daniel W Brown

Daniel T Martin

Sven Krasser

Patrick Crenshaw

David Elkind

Matthew D Briercliffe

Paul Diercks

Robert P Glamm

Aaron Javon Marks

Aaron Javan Marks

Grant Babb

A security agent implemented on a monitored computing device is described herein. The security agent has access to parametric behavioral pattern definitions that, in combination with canonical patterns of behavior, configure the security agent to match observed behavior with known computing behavior that is benign or malignant. This arrangement of the definitions and the pattern of behavior allow the security agent's behavior to be updated by a remote security service without updating a configuration of the security agent. The remote security service can create, modify, and disseminate these definitions and patterns of behavior, giving the security agent real-time ability to respond to new behaviors exhibited by the monitored computing device.

Malicious/benign computational behavior detection using parametric behavioral pattern definition

Malicious/benign computational behavior detection using canonic patterns of behavior

Example techniques herein determine that a trial data stream is associated with malware ('dirty') using a local computational model (CM). The data stream can be represented by a feature vector. A control unit can receive a first, dirty feature vector (e.g., a false miss) and determine the local CM based on the first feature vector. The control unit can receive a trial feature vector representing the trial data stream. The control unit can determine that the trial data stream is dirty if a broad CM or the local CM determines that the trial feature vector is dirty. In some examples, the local CM can define a dirty region in a feature space. The control unit can determine the local CM based on the first feature vector and other clean or dirty feature vectors, e.g., a clean feature vector nearest to the first feature vector.

Malware detection using local computational models

In one example, a visualization data engine may be responsible for rendering the visualization data obtained from the backend data server and providing the user interface (UI) necessary to allow an administrator to analyze the data. An example UI may include the ability to filter, organize, reorganize, and choose the raw data to be transformed. The UI may also provide interactions that expand and compress sections of the dataset, drill into the underlying dataset that is represented to the user, and move the data from one visualization to another.

Visualization and analysis of complex security information

Growing community of inventors

Lino Lakes, MN, United States of America

Kirby James Koster