Symantec Corporation

Nortonlifelock Inc.

Ca, Inc.

Mark Kevin Kennedy

William E Sobel

Bruce McCorkendale

Adam Glick

Barry Laffoon

Sourabh Satish

Brian Hernacki

Carey S Nachenberg

Ilya Sokolov

Zulfikar Ramzan

Michael Spertus

Pratyusa Kumar Manadhata

Peter Szor

Shane Pereira

Pieter Viljoen

Patrick Gardner

Henri J Isenberg

Andrew B Gardner

Keith Newstadt

Lei Gu

Spencer Dale Smith

Petrus Johannes Viljoen

Haik A Mesropian

Ronald A Frederick

Abubakar A Wawda

Timothy Michael Naftel

Matt Boucher

Mark Eric Obrecht

David Kane

Kenneth J Coleman

Christopher J Peterson

Everett J Lai

Alexander Danileiko

Peter Linhardt

Qichao Lan

Charles Renert

Ke Fang

Archana S Rajan

XueFeng Tian

Tim Naftel

Leonardo Cohen

Yanjiao Zuo

Ming-Jen Wang

Anthony Schreiner

Edward Bonver

Richard Gough

Vincent Cheong

The disclosed computer-implemented method for protecting geolocation information may include (i) receiving, by a computing device, a geolocation security policy that defines an area in which access to geolocation information by applications will be at least partially limited to protect the privacy of a user, (ii) detecting, by the computing device, a geolocation of the computing device, (iii) applying, by the computing device, the geolocation security policy to the detected geolocation to determine whether the detected geolocation matches the area in which access to geolocation information by the applications will be at least partially limited, and (iv) performing, by the computing device, a security action to protect the privacy of the user based on determining that the detected geolocation matches the area. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting geolocation information

A method for implementing adaptive policy based computer security is described. In one embodiment, the method may include monitoring a behavior of a user on a computing device associated with the user, determining whether the user triggers one or more policy triggers associated with a broad policy or at least one sub-policy of the broad policy, or both, and upon determining the user triggers at least one policy trigger during the monitoring period, implementing a customized version of the broad policy on the computing device. In some cases, the method may include implementing the broad policy on the computing device upon determining the user does not trigger any of the one or more policy triggers. In other cases, the method may include triggering at least one of the policy triggers based at least in part on a requested action and determining whether the requested action includes a security threat.

Automatic adaptive policy based security

The disclosed computer-implemented method for protecting a cloud storage against suspected malware may include (1) receiving a backup of one or more encrypted files over a network, (2) determining that the one or more encrypted files match one or more criteria associated with suspected malware, and (3) performing a security action that protects a computing device against the suspected malware. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting a cloud storage against suspected malware

A computer-implemented method for identifying malicious computer files may include (i) receiving, by a computing device, a set of files from a set of client devices, (ii) performing, by the computing device, a machine learning classification of file attributes on the set of files, (iii) determining, based on the machine learning classification, a node pattern of a suspicious file in the set of files, (iv) calculating, by hashing the node pattern, a file prevalence score of the suspicious file, and (v) performing, by the computing device, a security action based on the file prevalence score of the suspicious file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying malicious computer files

The disclosed computer-implemented method for classifying files as specific types of malware may include (i) identifying an unknown file on a computing device, (ii) performing an analysis of the unknown file by applying, to the unknown file, a machine-learning heuristic that employs at least one decision tree, (iii) classifying the unknown file as malicious based on the analysis, and (iv) after classifying the unknown file as malicious, using the same decision tree employed by the machine-learning heuristic to sub-classify the unknown file by (a) identifying at least one leaf node of the decision tree arrived at by the analysis performed by the machine-learning heuristic on the unknown file, (b) determining that the leaf node of the decision tree is associated with a particular type of malicious file, and (c) sub-classifying the unknown file as the particular type of malicious file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for classifying files as specific types of malware

Providing joint access to an isolated computer object by both an isolated computer application and a non-isolated computer application. In one embodiment, a method may include executing a first computer application as a virtualized first computer application in an isolation layer, executing a second computer application as an actual second computer application in an operating system outside the isolation layer, creating a virtualized second computer object in the isolation layer in a location accessible to the virtualized first computer application, creating a gateway third computer object associated with the virtualized second computer object, storing the gateway third computer object outside the isolation layer in a location accessible to the operating system, and enabling joint access to the gateway third computer object by both the virtualized first computer application and the actual second computer application.

Providing joint access to an isolated computer object by both an isolated computer application and a non-isolated computer application

A method for anonymous reputation requests is described. In one embodiment, the method includes calculating a full thumbprint of an object on a client machine, trimming one or more bits from the full thumbprint to generate a trimmed thumbprint, sending the trimmed thumbprint to a reputation server, and receiving a result from the reputation server regarding the trimmed thumbprint.

Anonymous reputation requests

Methods and apparatus for optimizing computer detection of malware using pattern recognition by refreshing random classification forests are described. In one embodiment, the method may include building a random forest with two or more binary decision trees based at least in part on a first set of categorized data, sending the random forest to a client device with a first random forest control value, identifying a second set of categorized data different from the first set of categorized data, calculating a second random forest control value based on the second set of categorized data and sending the second random forest control value to the client device.

Retuning of random classification forests to improve efficacy

Methods and apparatus for optimizing computer detection of malware using pattern recognition by refreshing random classification forests are described. In one embodiment, one or more selected trees of a random forest on a computing system may be replaced by one or more new trees. As new categorized data becomes available, one or more new trees may be generated using the new categorized data. Once the one or more new trees are available, the performance of the one or more new trees may be compared to the performance of the trees in the current random forest. Based on this comparison, one or more trees of the random forest may be selected to be replaced by one or more of the new trees.

Tree rotation in random classification forests to improve efficacy

The disclosed computer-implemented method for improving forest-based malware detection within an organization may include (i) receiving, at a backend computing system, organization data from at least one organization computing device within an organization computer network, (ii) adjusting, at the backend computing system, a general use forest model based on the organization data to generate an organization-specific forest model for detecting malicious computer files within the organization computer network, and (iii) sending, from the backend computing system, the organization-specific forest model to the at least one organization computing device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for improving forest-based malware detection within an organization

Techniques for automated application analysis are disclosed. In one embodiment, the techniques may be realized as a method comprising detecting a code creation activity; detecting the presence of a previously-unknown application; associating the detected application with the code creation activity; and permitting the application to run based on associating the detected application with the code creation activity.

Techniques for automated application analysis

Systems and methods to automatically generate signatures used to detect malware are provided. The systems and methods use machine learning techniques, to build an over-trained heuristic model to analyze software, cluster identified patterns, validate the clusters against known reputational metrics, automatically create signatures and, in some examples, deploy such signatures to remote computing devices.

Automatic generation of generic file signatures

A computer-implemented method for providing security for synchronized files may include (1) synchronizing, using a cloud folder synchronization service, a backend server with both a client folder on a client machine and an additional client folder on an additional client machine, (2) propagating a file from the client folder to the backend server through the cloud folder synchronization service, (3) identifying, using the cloud folder synchronization service, a result of a security scan of the propagated file, and (4) adjusting, using the cloud folder synchronization service, the synchronization of the file with the additional client folder based on the result of the security scan. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for providing security for synchronized files

A possibly pre-infected system is inspected for the existence of tracked application-specific accounts. In a tracked application-specific account is found, the system is further audited to verify that only authorized processes are using the account and that the authorized account creation application is installed on the host computer system.

Unauthorized account monitoring system and method

A computer-implemented method for detecting an obfuscated executable may include identifying an executable file programmed to execute on a target architecture. The method may also include disassembling a first section of the executable file and determining whether the first section of the executable file comprises a valid instruction. The method may further include determining, based on whether the first section of the executable file comprises a valid instruction, whether the executable file poses a security risk. Various other methods, computer-readable media, and systems are also disclosed.

Methods and systems for detecting obfuscated executables

Growing community of inventors

Redondo Beach, CA, United States of America

Mark Kevin Kennedy