Microsoft Technology Licensing, LLC

Nitin Kumar Goel

Cristian Craioveanu

Mariusz Hieronim Jakubowski

Douglas John Hines

Jugal Parikh

Mark Wodrich

Eleanor Catherine Quint

Amar Dinesh Patel

Kenneth Dean Johnson

Matthew Ryan Miller

John Robert Lambert

Navin Narayan Pai

Jinwook Shin

Grzegorz M Wroblewski

Gregory Justice Riggs

Gavin Shane Thomas

Elia Florio

Craig Douglas Wilkey, Jr

Craig Douglas Wilkey

Generally discussed herein are devices, systems, and methods for improving phishing webpage content detection. A method can include identifying first webpage content comprises phishing content, determining, using a reinforcement learning (RL) agent, at least one action, generating, based on the determined at least one action and the identified first webpage content, altered first webpage content, identifying that the altered first webpage content is benign, generating, based on the determined at least one action and second webpage content, altered second webpage content, and training, based on the altered second webpage content and a corresponding label of phishing, a phishing detector.

Webpage phishing detection using deep reinforcement learning

Potentially malicious uniform resource locators and websites are safely and effectively investigated through live forensic browsing. Live data from an isolated browser feeds a security information and event management (SIEM) tool and other forensic tools during a browsing session, allowing investigators to direct the browsing in response to analysis results. Session data may be translated for SIEM ingestion. Browsing sessions may be manually or automatically customized to obscure their forensic nature, by routing selection, by bandwidth or latency adjustment, or by spoofing externally detectable characteristics such as geolocation, user agent, time zone, and language. Forensic activity by an investigator may also be obscured from discovery by an attacker as a result of spoofing the browser's context, such as plugin status and host machine physical characteristics. Human presence tests relied on by attackers may be satisfied without sacrificing a targeted system's cybersecurity or an investigator's access to forensic tools.

Live forensic browsing of URLs

A processing platform is described herein for performing a task on a physical system. For example, the task may entail testing untrusted code on the physical system. The processing platform provides the same isolation guarantees as a virtual machine, but without using a virtual machine. A processing framework is also described herein which includes two or more processing platforms, together with a control system for administering the operations performed by the processing platforms.

Framework for running untrusted code

The subject disclosure is directed towards detecting software vulnerabilities in an isolated computing environment. In order to evaluate each input submission from an external computer, a plurality of tasks are automatically generated for execution on one or more computing units running within the isolated computing environment. Various configurations of the one or more computing units are defined in which each computing unit executes the plurality of tasks. A report is produced comprising results associated with such an execution.

Detecting software vulnerabilities in an isolated computing environment

Embodiments for tracing dataflow for a computer program are described. The computer program includes machine instructions that are executable on a microprocessor. A decoding module can be configured to decode machine instructions obtained from a computer memory. In addition, a dataflow primitive engine can receive a decoded machine instruction from the decoding module and generate at least one dataflow primitive for the decoded machine instruction based on a dataflow primitive classification into which the decoded machine instruction are categorized by the dataflow primitive engine. A dataflow state table can be configured to track addressed data locations that are affected by dataflow. The dataflow primitives can be applied to the dataflow state table to update a dataflow status for the addressed data locations affected by the decoded machine instruction.

Tracing of data flow

Technologies are described herein for performing targeted, black-box fuzzing of input data for application testing. A dataflow tracing module traces an application while it reads and processes a set of template data to produce operation mapping data that maps data locations in the template data to operations performed by the application in processing the data at the location. The tracing is performed without requiring the application source code, knowledge of the syntactical structure of the input data, or specially instrumented binaries for the application. A fuzzing module is then utilized to target a specific operation or operations in the application by fuzzing data locations within the template data according to the operation mapping data until the desired outcome is achieved.

Targeted black box fuzzing of input data

Growing community of inventors

Bothell, WA, United States of America

Nitin Kumar Goel