Symantec Corporation

Ziften Technologies, Inc.

Symantec Operating Corporation

Six Engines, LLC

Mark Eric Obrecht

Andy Payne

Michael Tony Alagna

Peter Norwood

Alfred C Hartmann

Charles Andrew Payne

Scott D Sullivan

Michael Anthony Alagna

Robert P Myers

Michael W Little

Nick F Alagna

Kevin N Pyle

Mark Kevin Kennedy

Shane Pereira

Taylor Crumpton

David Glenn Lemley, Iii

Zhixiong Wu

Robert Myers

Vijay Bharti

Barrett Baxter

Bret Michael Needle

Methods, devices, and systems disclosed herein measure endpoint user security event susceptibility (e.g., a malware infection) and provide information for endpoint/user posture evaluation. A relatively small software application may be installed using, for example, a systems management push system where the software runs on each endpoint system and reports back to a central repository or base system. The software runs on machines that it is pushed to and generates a score for that endpoint. That score is a quantification of endpoint user security risk, i.e., the likelihood that a particular endpoint is likely to be the source of a security event at some point in the future. This information may be used to generate a Relative Score for each endpoint so that the endpoints can be ranked from most secure to least secure and an Absolute Score so that a given distributed system can be compared to other distributed systems.

Method and apparatus for measuring information system device integrity and evaluating endpoint posture

Techniques are disclosed relating to improving resource usage on a computer system. In one embodiment, a computer system identifies a plurality of processes running on the computer system and determines an importance value and a resource consumption value. In such an embodiment, the importance value is indicative of an importance of an identified process, and the resource consumption value is indicative of a resource consumption of the identified process. The computer system evaluates the importance value and the resource consumption value relative to a usage policy, and takes a corrective action with respect to the identified process based on the evaluating to reconcile resource consumption with process importance value.

Monitoring computer process resource usage

Techniques for categorizing programs running on an information handling system. One method includes, while a program is running on an information handling system in a manner that permits the program to infect the information handling system, calculating a first score and a second score. The first score is indicative of the likelihood that the program is malicious; the second score is indicative of the likelihood that the program is valid. This method further includes categorizing the program with respect to the likelihood of the program infecting the information handling system, including by categorizing the program as valid code based on the second score being above a threshold value, regardless of the first score.

Method, computer software, and system for providing end to end security protection of an online transaction

A method for classifying a process that modifies a registry attribute is described. At least one attribute associated with a registry is monitored. A determination is made that the at least one attribute has been modified. The process that modified the at least one attribute is identified. One or more characteristics of the identified process is evaluated. The identified process is classified based on the evaluation of the one or more characteristics of the identified process.

Systems and methods for determining if a process is a malicious process

Behavioral blocking of overlay-type identity stealers is achieved by detecting a transactional web page session, evaluating a property of a window corresponding to a process running on the computer system, and then, based on a result of the evaluation, blocking a behavior of the process for a duration of the transactional web page session. The evaluation of the property window involves determining whether the window exhibits one or more characteristics representing activity of an overlay-type identity stealer.

Real-time behavioral blocking of overlay-type identity stealers

Various embodiments of a system and method for providing protection against malicious software programs are disclosed. The system and method may be operable to detect that a first window of a legitimate software program has been replaced by a second window of a malicious software program, e.g., where the second window includes features to mimic the first window in an effort to fool the user into inputting sensitive information into the second window. The method may operate to alert the user when the window replacement is detected.

Detection of window replacement by a malicious software program

Systems and methods for configuring a specific-use computing system are disclosed. A computing system may comprise a first set of predetermined application programs and a processor limited to executing the first set of predetermined application programs and pre-approved application programs received from a pre-approved computing device. The computing system may also include a communication interface configured to enable communication between the first computing system and the pre-approved computing device. Exemplary methods and computer-readable media are also enclosed.

Methods and systems for configuring a specific-use computing system limited to executing predetermined and pre-approved application programs

A method for implementing an online transaction security product includes downloading an online transaction security product program from a web site to an information handling system. The security product program includes an anti-malicious code program configured to detect malicious code on the information handling system. Lastly, the security product program is executed, wherein the anti-malicious code program of the security product program operates to detect malicious code on the information handling system.

A method for detecting malicious code on an information handling system includes executing malicious code detection code (MCDC) on the information handling system. The malicious code detection code includes detection routines. The detection routines are applied to executable code under investigation running on the information handling system during the execution of the MCDC. The detection routines associate weights to respective executable code under investigation in response to detections of a valid program or malicious code as a function of respective detection routines. Lastly, executable code under investigation is determined a valid program or malicious code as a function of the weights associated by the detection routines. Computer-readable media and an information handling system are also disclosed.

Method and apparatus for detecting malicious code in an information handling system

Malicious code detection code is executed by an information handling system. The malicious code detection code includes detection routines. The detection routines are applied to executable code under investigation. The detection routines associate weights to respective code under investigation in response to detections of a valid program or malicious code as a function of the detection routines. It is determined whether code under investigation is a valid program or malicious code as a function of the weights associated by the detection routines.

Various embodiments of a system and method for blocking malicious program behaviors, such as keystroke logging behavior or screen capture behavior, are disclosed. Security software may execute on a computer system, where the security software is operable to monitor the computer system to detect malicious program behavior. In response to detecting a first condition indicating that monitoring of the computer system to detect malicious program behavior should be initiated, the security software automatically initiates monitoring of the computer system to detect malicious program behavior. After initiating the monitoring for malicious program behavior, the security software may detect malicious program behavior of a second program executing on the computer system and block the malicious program behavior of the second program.

Method, system, and computer program product for blocking malicious program behaviors

From a first information handling system ('IHS') to a second IHS, in response to a request for initiating an online transaction, a program is downloaded for detecting malicious code on the second IHS.

Growing community of inventors

Austin, TX, United States of America

Mark Eric Obrecht