Sophos Limited

Neil Robert Tyndale Watkiss

Kenneth D Ray

Andrew James Thomas

Mark David Harris

Simon Neil Reed

Robert Wendell Cook

Daniel Salvatore Schiappa

Dmitri Samosseiko

Harald Schütz

John Edward Tyrone Shaw

Anthony John Merry

Timothy Rayment

Emile Marcus Kenning

Jonathan Francis Caine

A threat management facility for an enterprise provides security services to a number of virtual compute instances executing on a remote cloud computing platform. In order to prevent or reduce an accumulation of records for abandoned compute instances, each new virtual compute instance is explicitly identified by a user (and optionally a template), and then compared to existing records to identify possible redundancies, which can be deleted or otherwise managed.

Deduplication of endpoint images

An application executing on an endpoint accesses remote resources using a gateway. In response to a requested remote access, the application may be marked with a descriptor that specifies a target action and a pattern of occurrences of the target action. When a second observable action on the endpoint includes the pattern of events following the first observable action, a reportable event may be generated indicating a compromised state of the endpoint. The gateway can then regulate usage of the remote resource based on the reportable event.

Firewall techniques for colored objects on endpoints

Adapting automatic software update behavior for virtual desktop infrastructure deployed endpoints includes detecting a request for services of a threat management facility for an enterprise network that originates from a compute instance embodied as a virtual machine instantiated from a versioned software template, and updating software on the compute instance based on a determination of availability of updated software for the compute instance and an update pause parameter indicating that updating software for virtual machines instantiated from the versioned software template is permitted for the compute instance.

Pausing automatic software updates of virtual machines

Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

A threat management facility that remotely stores global reputation information for network content can be used in combination with a recognition engine such as a machine learning classifier that is locally deployed on endpoints within an enterprise network. More specifically, the recognition engine can locally evaluate reputation for a network address being accessed by an endpoint, and this reputation information can be used to dynamically establish a timeout for a request from the endpoint to the threat management facility for corresponding global reputation information.

Context-dependent timeout for remote security services

Using indications of compromise for reputation based network security

A security agent conditionally hooks a process for malware monitoring based on a persistent hook state for the process that may be stored, for example, in a process cache. When a process launches in a backoff state indicating that the process previously crashed after hooking, the security agent may further conditionally hook the process based on a reputation of the process or any other relevant contextual information.

Method for conditionally hooking endpoint processes with a security agent

Labeling computing objects for improved threat detection

Labeling objects on an endpoint for encryption management

Threat detection using a time-based cache of reputation information on an enterprise endpoint

Growing community of inventors

Oxford, United Kingdom

Neil Robert Tyndale Watkiss