Microsoft Technology Licensing, LLC

Mariusz Hieronim Jakubowski

Ramarathnam R Venkatesan

M Kivanc Mihcak

Marcus Peinado

Yuqun Chen

John L Manferdelli

Matthew C Cary

Saurabh Sinha

Jugal Parikh

Michael David Marr

Vinay Krishnaswamy

Ruoming Pang

Paul England

Henrique Sarmento Malvar

Darko Kirovski

Yacov Yacobi

Matthias Jacob

Arnold Neil Blinn

Thomas C Jones

Rajasekhar Abburi

Douglas John Hines

Jeffrey R C Bell

Mohamed Rouatbi

Nitin Kumar Goel

Julian Federico Gonzalez

Seyed Mehdi Fatemi Booshehri

Cristian Craioveanu

Hai Ying (Vincent) Yu

Bertrand Anckaert

Allan Gordon Lontoc Sepillo

Ramaranthnam Venkatesan

Svetlana Gaivoronski

Eleanor Catherine Quint

Jeffrey M Homme

Thathachar S Jayram

Geoffrey Lyall McDonald

Bradley Noah Faskowitz

Zicheng Liu

Gideon Andreas Yuval

Dragos Sambotin

Mehmet Kivanc Mihcak

Mohamed Sadek

Chit Wei Saw

Jeremy S Russell

Scott A Kupec

Weidong Ciu

Adam Loe Doupe

Athanasios Avgerinos

Bertrand Raphaël Anckaert

Sadegh Momeni Milajerdi

Ramarathnam Venkatesar

Geoffrey Lyall Mcdonald

Embodiments seek to prevent detection of a sandbox environment by a potential malware application. To this end, execution of the application is monitored, and provide information about the execution to a reinforcement learning machine learning model. The model generates a suggested modification to make to the executing application. The model is provided with information indicating whether the application executed successfully or not, and this information is used to train the model for additional modifications. By modifying the potential malware execution during its execution, detection of a sandbox environment is prevented, and analysis of the potential malware applications features are better understood.

Undetectable sandbox for malware

Generally discussed herein are devices, systems, and methods for improving phishing webpage content detection. A method can include identifying first webpage content comprises phishing content, determining, using a reinforcement learning (RL) agent, at least one action, generating, based on the determined at least one action and the identified first webpage content, altered first webpage content, identifying that the altered first webpage content is benign, generating, based on the determined at least one action and second webpage content, altered second webpage content, and training, based on the altered second webpage content and a corresponding label of phishing, a phishing detector.

Webpage phishing detection using deep reinforcement learning

Events within a computer system are grouped in order to identify security threats and, in some cases, perform an action to mitigate the threat. In some aspects, a computing system event that meets a criterion, are identified. A first layer of computing resources is determined which includes computing resources referenced during the computing system event. A second layer of computing resources is then determined, the second layer including one or more of a parent process or file loaded by the first layer processes, a process writing to a file included in the first layer of computing resources, or a previous version of a file included in the first layer of computing resources. Similarities between computing resource pairs in the first and second layers are determined, and a group of high similarity pairs related to each other is identified. In some embodiments, a mitigating action is identified based on the group.

Layered analysis for network security risk detection

A process to detect intrusions with an intrusion detection system is disclosed. The intrusion detection system identifies instance types, and each instance type includes an instance. A know compromised instance is identified from the plurality of instances. A link between the plurality instance types is traversed from the compromised instance to discover an additional compromised instance.

Intrusion detection

A process to investigate intrusions with an investigation system is disclosed. The process receives forensic facts from a set of forensic events on a system or network. A suspicious fact is identified from the forensic facts. A related fact from the forensic facts is identified based on the suspicious fact.

Intrusion investigation

The subject disclosure is directed towards securing network data traffic through a trusted partition of the computing environment. A proxy service may communicate transaction data from a client to security-critical code within the trusted partition, which compares the transaction data to a security policy from a commercial electronic entity. If the transaction data includes malicious content, a security component framework of the trusted partition may reject the transaction data and terminate communications with the client. If the transaction data does not include malicious content, the security component framework may communicate a secured version of the transaction data and retrieve response data from the commercial electronic entity, which may be further communicated back to the client.

Securing a computing environment against malicious entities

Aspects of the subject disclosure are directed towards detecting instances within a web application where code and data are not separated, e.g., inline code in the application. One or more implementations automatically transform the web application into a transformed version where code and data are clearly separated, e.g., inline code is moved into external files. The transformation protects against a large class of cross-site scripting attacks.

Automatic code and data separation of web application

A computer-implementable method includes providing an instruction set architecture that comprises features to generate diverse copies of a program, using the instruction set architecture to generate diverse copies of a program and providing a virtual machine for execution of one of the diverse copies of the program. Various exemplary methods, devices, systems, etc., use virtualization for diversifying code and/or virtual machines to thereby enhance software security.

Virtualization for diversified tamper resistance

The subject disclosure is directed towards partitioning a code base of a program into a trusted portion and an untrusted portion. After identifying sensitive data within the code base using annotation information, one or more program elements that correspond to the sensitive data are automatically transformed into secure program elements that can be retained in the untrusted portion of the code base. Cryptographic techniques are used to minimize a potential size of the trusted portion of the code base. Source files for the trusted portion and the untrusted portion are generated.

Code base partitioning system

Information is displayed on a device by writing data to a buffer in memory, the content of the buffer describing a screen display of the device at a particular point in time. A watermarked version of the buffer content is generated by watermarking the content of the buffer with data, such as data identifying a user of the device and/or a copy of a program (e.g., an operating system) running on the device. The watermarked version of the buffer content is then made available, such as in response to a screen capture request. The data embedded in the watermarked version of the content is undetectable (or nearly undetectable) to the human eye, but can nonetheless be extracted by other computing devices or data extraction systems.

Watermarking screen capture content

Programs running on an open architecture, such as a personal computer, are vulnerable to inspection and modification. This is a concern as the program may include or provide access to valuable information. As a defense, the actual location of data can be hidden throughout execution of the program by way of periodic location reordering and pointer scrambling, among other things. These techniques serve to complicate static data flow analysis and dynamic data tracking thereby at least deterring program tampering.

Data location obfuscation

A security technique to reduce the risk of unauthorized release of a software object. The technique allows identification of an individual responsible for the unauthorized release by marking each object with information, which acts as a fingerprint from which a person manipulating the object in a development environment can be identified. The development environment may be configured to quickly and automatically mark the object whenever a manipulation that may precede an unauthorized release occurs. To prevent circumventing the security technique, the object may be configured to enforce a requirement for a valid fingerprint such that the object is disabled if the fingerprint is removed or altered. Despite the marking, personally identifiable information is not revealed because the fingerprint is generated through a one-way cryptographic function performed on identifying information.

Security mechanism for developmental operating systems

Growing community of inventors

Bellevue, WA, United States of America

Mariusz Hieronim Jakubowski