Microsoft Technology Licensing, LLC

Microsoft Corporation

Mihai Costea

Anil Francis Thomas

Adrian Mihail Marinescu

Malcolm Erik Pearson

David Allen Goebel

Gilad Odinak

Scott Field

David Milstein

Eliot Carleton Gillum

Vinay Deo

Krishna C Vitaldevara

Jason D Walter

Mahesh Sharad Lotlikar

Douglas John Hines

Tak Chung Lung

Michael Todd Kramer

Yun Lin

Pradeep Bahl

Efim Hudis

Wei Jiang

Mayank Mehta

Yigal Mordechai Edery

Malcolm Hollis Davis

Michael A Schmidt

Gerardo Bermudez

Rajesh K Dadhia

Chandresh Kumar Jain

Vasantha K Vemula

Michael James Ahiakpor

Paul M Midgen

Samuel J L Albert

Damodharan Ulagaratchagan

Yi-Min Wang

Cenk Ergan

Michael Richard Fortin

Patrick Markus Baudisch

Balan Sethu Raman

David W Aucsmith

Nigel Robin Ellis

Marc E Seinfeld

Michael G Sheldon

Aleksander R Kolcz

Johannes Klein

Sameet Harishanker Agarwal

Jeffrey B Kay

Roy Williams

Alexey A Polyakov

Zeke Book Odins-Lucas

Rohan Kumar

Eric Dean Tribble

Nathan Waddoups

Weisheng Li

Sanjay Anand

Daniel Dwight Longley

Konstantin E Ryvkin

Jesse M Dougherty

Ravi Kiran Reddy Poluri

David Nicholas Yost

Michael Abraham Betser

Mayerber L Carvalho Neto

Gheorghe Marius Gheorghescu

George Cristian Chicioreanu

Mayerber Carvalho Neto

Hua Ding

Kyle A Larsen

Marius Gheorghe Gheorghescu

Yuxiang Xu

Harsh Satyanarayan Dangayach

Aidan M Delaney

Vincent R Orgovan

Gretchen L Loihle

Scott A Field

Phanindra Pampati

Robert J Hensing, Jr

Vadim N Bluvstein

Adrian Bivol

Jain Chandresh

Yigal Edery

Zeke B Odins-Lucas

Gary Gilchrist

Methods, systems, and computer storage media for providing a multi-attribute cluster-identifier that supports identifying malicious activity in computing environments. An instance of an activity having an attribute set can be assessed. The attribute set of the instance of the activity is analyzed to determine whether the instance of the activity is a malicious activity. The attribute set of the instance of the activity is compared to a plurality of multi-attribute cluster-identifiers of previous instances of the activity, such that, a determination that the instance of the activity is a malicious activity is made when the attribute set of the instance of the activity corresponds to an identified multi-attribute cluster-identifier. The identified multi-attribute cluster-identifier has a risk score and an attribute set that indicate a likelihood that the instance of the activity is a malicious activity. A visualization that identifies the instance of the activity as a malicious activity is generated.

Campaign intelligence and visualization for combating cyberattacks

Message management and classification techniques are described. In one or more implementations, a message received from a sender for delivery via a user account is examined to extract one or more features of the message. A determination is then made as to whether the message corresponds to one or more categories based on the extracted features, the categories usable to enable features to be applied to the message in a user interface.

Message classification and management

A system and method for efficiently determining that a received file is not malware is presented. In operation, when a file is received at a computing device, an evaluation is made as to whether the file includes user-modifiable, or superficial, data areas, i.e., areas of the file that by their nature do not typically carry or embed malware. If the file includes superficial data areas, those superficial data areas are filtered out and a file signature is generated based on the remaining portions of the received file. The file can then be compared to a list of know malware to determine if the file is malware. Alternatively, the file can be compared to a list of known, trusted files to determine whether the file is trustworthy.

Efficient white listing of user-modifiable files

Techniques for aggregating a knowledge base of a plurality of security services or other event collection systems to protect a computer from malware are provided. In embodiments, a computer is protected from malware by using anti-malware services or other event collection systems to observe suspicious events that are potentially indicative of malware. A determination is made as to whether a combination of the suspicious events is indicative of malware. If the combination of suspicious events is indicative of malware, a restrictive security policy designed to prevent the spread of malware is implemented.

Aggregating the knowledge base of computer systems to proactively protect a computer from malware

Campaign detection techniques are described. In implementations, a signature is computed for each of a plurality of emails to be communicated by a service provider to respective intended recipients. A determination is made that two or more of the plurality of emails is similar based on the respective signatures. Responsive to a finding that a number of similar emails exceeds a threshold, an indication is output that the similar emails have a likelihood of being involved in a spam campaign.

Campaign detection

A perimeter network may be utilized to filter electronic mail messages destined for an internal network. A computer may be utilized to monitor an electronic mail mailbox for changes to a safe recipients list and/or a blocked senders list. The computer may further be utilized to automatically copy the safe recipients list and/or the blocked senders list to a network directory in the internal network. The computer may further be utilized to automatically send the safe recipients list and/or the blocked senders list to a network directory in the perimeter network for utilization by one or more agents executing on a computer in the perimeter network. The one or more agents may be configured to utilize the safe recipients list and/or the blocked senders list to filter electronic mail messages received by the perimeter network which are destined for delivery to the internal network.

Filtering of electronic mail messages destined for an internal network

In accordance with the present invention, a system, method, and computer-readable medium for aggregating the knowledge base of a plurality of security services or other event collection systems to protect a computer from malware is provided. One aspect of the present invention is a method that proactively protects a computer from malware by using anti-malware services or other event collection systems to observe suspicious events that are potentially indicative of malware; determining if the suspicious events satisfy a predetermined threshold; and if the suspicious events satisfy the predetermined threshold, implementing a restrictive security policy designed to prevent the spread of malware.

An electronic mail message (EMM) addressed to a distribution list of an enterprise is received at a server of the enterprise from a sending address outside of the enterprise. If the distribution list has no external addresses, then the EMM is blocked from being delivered to the distribution list. In an embodiment, if the distribution list has an external address and the sending address is identified in a safe sender list corresponding to the distribution list, then the EMM is delivered to the distribution list. In an embodiment, if the distribution list has an external address, the sending address is not in a safe sender list corresponding to the distribution list, and the content of the message is approved, then the EMM is delivered to the distribution list.

Access limited EMM distribution lists

In accordance with this invention, a system, method, and computer-readable medium that selectively scans files stored on a computing device for malware is provided. One aspect of the present invention includes identifying files that need to be scanned for malware when a software update that includes a malware signature is received. More specifically, attributes of the new malware are identified by searching metadata associated with the malware. Then, the method searches a scan cache and determines whether each file with an entry in the scan cache is the type that may be infected by the malware. If a file is the type that may be infected by the malware, the file is scanned for malware when a scanning event such as an I/O request occurs. Conversely, if the file is not the type that may be infected by the malware, the file may be accessed without a scan being performed.

System and method of caching decisions on when to scan for malware

Propagating messaging preferences of one or more users from a recipient mailbox to a perimeter network administering e-mail content blocking and routing. A content filtering application located outside a trusted network receives messaging preferences information from within the trusted network regarding the mail recipients. This messaging preferences information may be utilized to allow certain pre-authorized messages from particular senders to bypass content filtering. Moreover, the messaging preferences information may be hashed to further protect the information on the perimeter network and to speed in review and comparison of the messaging preferences information. In addition, other types of user-specific information may be propagated to the perimeter network for use with other applications other than messaging.

Perimeter message filtering with extracted user-specific preferences

Systems for providing sign-up email addresses are disclosed herein. A user may set up a sign-up email address for receiving emails from a trusted, Internet-based enterprise. The user may set up a dedicated mailbox folder associated with the sign-up email address or enterprise. The email server may automatically direct emails coming from that enterprise into that folder. To 'unsubscribe,' the user needs only to delete the folder or the sign-up address. Emails from the enterprise to the sign-up address may be highlighted in the user's main inbox. Thus, the user may be assured that any such email is truly from the enterprise, and not a phishing expedition or spam. Such systems also provide the user with effective tools to recognize phish or spam emails that appear to be from the trusted enterprise and not to act on them.

Secure transactional communication

Sources of spam, such as botnets, are detected by analyzing message traffic for behavioral patterns and indications of suspicious content. The content of a known malicious source is analyzed. Message traffic associated with the known malicious source is analyzed. Associated message traffic includes messages sent directly from the known malicious source to recipients, and messages sent from the recipients to subsequent direct and indirect recipients. Portions of the content of the known malicious source are selected and content of associated message traffic is analyzed for an indication of the selected content. If the selected content is found in the content of a message, the source of the message is determined to be a source of spam. Associated message traffic is additionally analyzed for behavioral patterns, such as anomalies and/or flurries of activity, to determine a potential malicious source.

Determination of participation in a malicious software campaign

Growing community of inventors

Redmond, WA, United States of America

Mihai Costea