Symantec Corporation

Nortonlifelock Inc.

Gen Digital Inc.

Lei Gu

Ilya Sokolov

Keith Newstadt

Kevin Bangyen Jiang

Matt Boucher

Michael Shavell

Bruce McCorkendale

Jason Holler

Mark Kevin Kennedy

Daniel Kats

Haik A Mesropian

Sharad Subhash Mhaske

Kirill Levichev

Dinesh Ramaswamy Ganesh

Andrew Davis Emerson

Tim Van Der Horst

Anand Elumalai

Chengi Kuo

Nathan Rivers

Elton Inada

Riti Saxena

Abhilash Raipally

The disclosed computer-implemented method for protecting users may (i) include collecting a set of field reports indicating respective geofencing violations, (ii) grading a safety measurement, based on an analysis of the respective geofencing violations, for each candidate route in a set of multiple candidate routes generated for travel between a starting point and a destination point, and (iii) recommending, from among the set of multiple candidate routes, a recommended route based at least in part on the recommended route being graded as safer than another candidate route. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting users

Methods and systems for efficient scaling of a domain name system (DNS) service architecture. In some embodiments a plurality of messaging servers may be separated into a number of pools. A plurality of client devices may be connected to a messaging server within a pool. When a notification is received for a target client device, a backend server may identify the pool that includes the messaging server that is connected to the target client device. The backend server may send the notification to the group of messaging servers within the identified pool while avoiding sending the notification to messaging servers within different pools.

Efficient scaling of a domain name system service architecture

A computer-implemented method for selectively monitoring devices may include (i) identifying a set of characteristics of a device-usage session of a device, (ii) calculating, based on the set of characteristics, a privacy score for the device-usage session, (iii) selecting, for the device, a device monitoring profile that is correlated with the privacy score and that defines an intensity level of monitoring actions to be performed on the device, and (iv) monitoring activity performed on the device during the device-usage session in accordance with the device monitoring profile that is correlated with the privacy score for the device-usage session. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for selectively monitoring devices

Employing beacon messages to restart an application on a mobile device. In some embodiments, a method may include subscribing, at the secondary mobile device, to a beacon publisher of the primary mobile device. The method may also include determining, based on historical location data, that the primary mobile device is likely within range of the secondary mobile device for beacon communication therebetween. The method may further include activating, at the primary mobile device, the beacon publisher. The method may also include publishing, at the primary mobile device, a beacon message configured to cause a secondary mobile application on the secondary mobile device to restart. The method may further include receiving, at the secondary mobile device, the beacon message. The method may also include, in response to receiving the beacon message, restarting, at the secondary mobile device, the secondary mobile application of the secondary mobile device.

Employing beacon messages to restart an application on a mobile device

The disclosed computer-implemented methods for automatically recovering from malware attacks may include (1) saving, in response to determining that a reputation of a process is unknown, a backup copy of a file on a remote storage device prior to allowing the process to modify the file; (2) determining, after the process has modified the file, that the process is potentially malicious; and (3) restoring, in response to determining that the process is potentially malicious, the backup copy of the file from the remote storage device. The provided methods may automatically recover computers from ransomware attacks and other malware attacks which encrypt file systems. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for automatically recovering from malware attacks

The disclosed computer-implemented method for crowd-storing encryption keys may include (i) sending, from a client computing device and to a server, a recovery request, (ii) creating a first public-private key pair, (iii) receiving a plurality of encrypted shares of an encryption key from the server in response to the recovery request, where the encrypted shares are encrypted with a first public key of the first public-private key pair, and (iv) performing a security action including (A) decrypting the plurality of encrypted shares of the encryption key with a first private key of the first public-private key pair and (B) recovering the encryption key from the decrypted plurality of shares of the encryption key. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for crowd-storing encrypiion keys

A computer-implemented method for retrieving driver safety scores by passenger devices may include (i) determining that an operator of a mobile device is a passenger in a vehicle, (ii) gathering, via one or more sensors of the mobile device, identifying information about at least one of the vehicle and a current driver of the vehicle, (iii) identifying, based on the identifying information gathered by the one or more sensors of the mobile device, the current driver of the vehicle, (iv) retrieving a driver safety score for the current driver of the vehicle from a collection of driver safety scores, and (v) performing, by the mobile device, a security action in response to retrieving the driver safety score. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for retrieving driver safety scores by passenger devices

The disclosed computer-implemented method for classifying electronic files may include (i) identifying an electronic file that is being evaluated for importance by a file-categorization system, (ii) collecting, via at least one user-state monitoring device, information about a physical state of at least one user while the user is interacting with the electronic file, (iii) determining, based on the information about the physical state of the user while the user was interacting with the electronic file, whether the user considers the electronic file to be important, and (iv) classifying, by the file-categorization system and based at least in part on determining whether the user considers the electronic file to be important, the electronic file as an important file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for classifying electronic files

The disclosed computer-implemented method for virtual boundary enforcement using network filters may include (i) applying a network filter to network traffic associated with a target computing device, (ii) analyzing data generated by the network filter, (iii) identifying, based on an analysis of the data, a potential violation of a virtual boundary associated with the target computing device, and (iv) in response to identifying the potential violation, performing a security action to enforce the virtual boundary associated with the target computing device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for virtual boundary enforcement using network filters

The disclosed computer-implemented method for dynamically adjusting a backup policy may include dynamically adjusting a backup policy may include accessing a media file, evaluating an objective criterion of a difficulty to reproduce the media file to generate a difficulty rating, comparing the difficulty rating of the media file to an existing difficulty rating for at least one previous media file, and adjusting a backup policy for the media file based on the comparison of the difficulty rating. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for dynamically adjusting a backup policy

The disclosed computer-implemented method for managing location-based access control lists may include (i) identifying a collection of devices that are located within a physical space, (ii) determining, based on user activity data received from the collection of devices, that an authorized user is attempting to modify, on a location-based access control list for a wireless network, the access rights of a target computing device near a location indicated by the authorized user in the physical space, (iii) detecting, based on the user activity data, the target computing device near the location indicated by the authorized user, and (iv) in response to detecting the target computing device indicated by the authorized user, modifying, on the location-based access control list, the access rights of the target computing device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing location-based access control lists

The disclosed computer-implemented method for protecting a cloud storage against suspected malware may include (1) receiving a backup of one or more encrypted files over a network, (2) determining that the one or more encrypted files match one or more criteria associated with suspected malware, and (3) performing a security action that protects a computing device against the suspected malware. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting a cloud storage against suspected malware

Backup metrics are received from multiple endpoints. Backup baselines are established, based on backup metrics received over a period of time. Each established backup baseline specifies an empirically determined baseline level of backup activity according to specific criteria. Changes in backup behavior are detected, as measured against established backup baselines, based on analyzing received backup metrics. Such changes can be detected by applying a non-supervised machine learning technique to backup metrics. Detected backup behavior changes that meet a corresponding threshold are further analyzed to determine whether to alter corresponding backup activity in response. Backup activity on endpoints can be modified, in response to the analysis. This can take the form of omitting specific files or folders from corresponding backups, or changing default backup configuration(s). For example, a new or modified default backup configuration can be transmitted to one or more endpoints.

Automatically adjusting backup set rules based on anomalous backup activity

A system and method of dynamic backup policy generation based upon a user's behavior is provided. The method may include detecting a user's usage pattern of files within a computing system based upon the user's backup or restore activities. In some embodiments, the backup system may identify the files that have been modified and calculate the percentage of modification away from a predetermined baseline or another previously stored version. The system may generate a list of the identified files along with these percentages to form the user's usage pattern. The method may further include generating a user's profile including files having high access rates in accordance with this usage pattern and adjusting a backup policy based upon the user's profile such that these files are backed-up more frequently. The backup policy may also be adjusted based upon a detected level of risk associated with the user.

System and method of dynamic backup policy generation

The disclosed computer-implemented method for preventing sensitive information exposure based on a surrounding audience may include (1) detecting, from one or more communication devices, surrounding audience data associated with an audience presentation on a presentation device, the audience presentation including sensitive information and non-sensitive information, (2) determining an audience profile based on the surrounding audience data, the audience profile identifying one or more unintended audience members in the surrounding audience, (3) assigning an information exposure policy to the audience presentation based on the audience profile, and (4) performing a security action to enforce the information exposure policy on the presentation device such that the sensitive information is prevented from being exposed to the surrounding audience during the audience presentation. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Bedford, MA, United States of America

Lei Gu