Barkly Protects, Inc.

Samsung Electronics Co., Ltd.

Alert Logic, Inc.

Kirk R Swidowski

Ryan J Berg

Stephen C Carlucci

John J Danahy

Ahmed M Azab

Christopher Baron

A security system and method secures and responds to security threats in a computer having a CPU, a Kernel/OS, and software applications. A data collector intercepts a selection of first tier calls between the CPU and Kernel/OS and/or second tier calls between the Kernel/Operating System and the applications, and stores information pertaining thereof. An Analytic Engine maps the stored first and second tier call information to a rulebase containing patterns of security threats, to generate a threat analysis, and then responds to the threat analysis. The Analytic Engine enlarges or contracts the selection of first and second tier calls to increase or decrease specificity of the threat analysis. A Management Module generates user interfaces accessible remotely by a user device, to update the rulebase and configure the collector, the Kernel module, and the Analytic Engine.

Continuous malicious software identification through responsive machine learning

An apparatus and method for reducing boot time of an electronic device are provided. The electronic device includes electronic device is provided. The electronic device includes a processor including at least one system register; and an Operating System (OS) including an OS component having at least one reserved area, each reserved area including a static memory structure. The OS component is configured to, during a booting process, copy addresses of the at least one static memory structure into at least one of the plurality of system registers, and initialize the static memory structures located at the copied addresses.

Apparatus and method for compile time construction of memory structures

A security system and method efficiently monitors and secures a computer to defend against malicious intrusions, and includes an in-band software monitor disposed within a kernel in communication with an operating system (OS) of the computer. The monitor intercepts system calls made from an MSR (Model Specific Register), to execute monitoring operations, and subsequently returns execution to the OS. An out-of-band hypervisor communicably coupled to the OS, has read shadow means for trapping read requests to the MSR, and write mask means for trapping write requests to the MSR. The hypervisor includes means for responding to the trapped read and write requests so that presence of the monitor is obscured.

Method and apparatus for hypervisor based monitoring of system interactions

A security system and method secures and responds to security threats in a computer having a CPU, a Kernel/OS, and software applications. A low-level data collector intercepts a selection of first tier calls between the CPU and Kernel/OS, and stores associated first tier call IDs. A Kernel module intercepts a selection of second tier calls between applications and the Kernel/OS, and stores associated second tier call IDs. An Analytic Engine maps the stored first and second tier call IDs to a rulebase containing patterns of security threats, to generate a threat analysis, and then responds to the threat analysis. The Analytic Engine enlarges or contracts the selection of first and second tier calls to increase or decrease specificity of the threat analysis. A Management Module generates user interfaces accessible remotely by a user device, to update the rulebase and configure the low-level collector, the Kernel module, and the Analytic Engine.

A Protected Walk-based Shadow Paging (PWSP) method includes storing a multiple level first stage (S1) page tables structure in second stage (S2) page tables. The method includes: when an S1 page table in an S2 page table entry is marked with a writable attribute: (i) permitting an operating system (OS) to write to the S1 page table, (ii) blocking a memory management unit (MMU) from reading the S1 page table for translation, and (iii) in response, verifying the S1 page table for translation and changing the marking of the S1 page table in the S2 page table entry to a read-only attribute, enabling the MMU to subsequently read the S1 page table. The method further includes: when the S1 page table in the S2 page table entry is marked with the read-only attribute: (i) permitting the OS to read the S1 page table for translating from a virtual address to an intermediate physical address, (ii) blocking the OS from writing to the S1 page table, and (iii) in response to blocking the OS, updating the S1 page table and changing the marking of the S1 page table in the S2 page table entry to the device memory attribute, enabling the OS to write to the S1 page table. Blocking the MMU from reading the S1 page table for translation may include generating a device memory permissions fault, and blocking the OS from writing to the S1 page table may include generating a read-only prefetch permissions fault.

Method and apparatus for performing protected walk-based shadow paging using multiple stages of page tables

Malicious software identification integrating behavioral analytics and hardware events

A security system and method efficiently monitors and secures a computer to defend against malicious intrusions, and includes an in-band software monitor disposed within a kernel in communication with an operating system (OS) of the computer. The monitor intercepts system calls made from an MSR (Model Specific Register), to execute monitoring operations, and subsequently returns execution to the OS. An out-of-band hypervisor communicably coupled to the OS, has read shadow means for trapping read requests to the MSR, and write mask means for trapping write requests to the MSR. The hypervisor includes means for responding to the trapped read and write requests so that presence of the monitor is obscured. Sysret monitoring means intercepts calls to a sysret instruction, executes sysret monitoring operations, and subsequently returns execution to an application running on the computer.

Growing community of inventors

Manteca, CA, United States of America

Kirk R Swidowski