F-Secure Corporation

Withsecure Corporation

Paolo Palumbo

Dmitriy Komashinskiy

Andrew Patel

Dmitry Komashinskiy

Valtteri Niemi

Jarno Niemela

Juha Ylipekkala

Henri Nurmi

Artturi Lehtio

Alexey Kirichenko

Sara Ramezanian

Tommi Meskanen

Szymon Grzybowski

Johannes Rave

Disclosed is a threat detection network for monitoring a security threat for a computer network, including a back end system and sensors coupled to the back end system, wherein each sensor: collects data describing respective predefined events in a respective node of the network, each event involving interaction of a subject entity operating in the respective node with an object entity associated with the node, applies predefined anomaly detection models to determine respective anomaly detection scores for interactions captured in the collected data, arranges the captured interactions into a local activity graph describing interactions of subject entities operating in the node with object entities associated with the node, and transmits portions of the local activity graph as status data to the back end system depending on the anomaly scores for the respective interactions captured in the local activity graph. The back end system derives security parameters describing security threats.

Threat detection network

A network node of a threat detection network, a backend system of a threat detection network including interconnected network nodes and a backend system, a threat detection network and a threat detection method for such network detect network threats. The backend system utilizes a backend threat detection model, and at least part of f the network nodes include security agent modules collecting data related to the respective network node. The network nodes utilize a local threat detection model and a local consistency model. The local consistency model provides confidence level information between the local and backend detection models. The method includes collecting data related to the network node by the security agent module at the network node, applying local threat detection model to the collected data, and making a decision at the endpoint based on the results of the local threat detection model and consistency models.

Method of threat detection in a threat detection network and threat detection network utilizing threat detection model and local consistency model

A system and a method for distributing components of a threat detection model for a threat control network, the threat control network comprising interconnected network nodes. The threat control network comprises security agent modules which collect data related to the respective network node of the security agent module, share information based on the collected data in the established internal network and use the collected data and information received from the internal network for generating and adapting threat detection models related to the respective network node. At least part of the nodes comprise at least the following components of the threat detection model: detection logic part comprising detection rules, detection logic parameter part comprising parameter values, core data primitive part comprising a set of key primitives. The method comprises distributing the said components of a threat detection model to a node independently from the other said components of the same node.

Threat control method and system

Disclosed is a system and a method of threat detection in a computer network, the method including detecting by a first node a security threat, e.g. relating to anomalous or malicious behavior, digital object and/or context, at the first node, collecting context information at the first node relating to the detected security threat, reporting at least one detected security threat and the collected context information to at least a second node, analyzing at the second node the received information relating to the security threat and collecting context information relating to the analysis at the second node, and sending the threat related information with added analysis and context information collected from the second node to at least one further node or backend.

There is provided a method comprising: detecting a new process start at a network node of a computer network; determining that said process requires external code modules; observing the times at which one or more external code modules required by the new process are loaded relative to the process starting time; determining that the usage of an external code module required by the new process is anomalous when the time elapsed between the start of the process and loading of said external code module lies outside predetermined expected boundaries; and taking further action to protect the network node and/or the computer network based on determining that the usage of the external code module required by the detected new process is anomalous.

Method of threat detection

A method of probing and responding to a security breach in a computer network security system includes defining first and second rules and defining a model to output a probability that a security breach has occurred based on an input and to generate commands. Data is collected at first nodes according to the first rules and a first portion of the collected data is selected and sent from the first nodes to a second node. The selected first portion is input into the model to obtain an output probability that a security breach has occurred and the following steps are performed: determining signs of a security breach, generating a first command with the model to cause a second portion of the collected data to be selected, and generating a second command with the model to cause a change in settings at one or more of the first nodes.

Probing and responding to computer network security breaches

There is provided a method comprising: generating and sharing an initial value of an integrity token between an endpoint node and a security backend computer, collecting data at the endpoint node, wherein dissimilar data types are aligned as input events, generating a new integrity token every time a new input event is written to a local repository of the endpoint node, wherein the new integrity token is generated based on the new input event and a prior integrity token that was generated prior to the new integrity token, removing the prior integrity token generated prior to the new integrity token from the endpoint node each time a new integrity token has been generated, and sending one or more input events with the new integrity token to the security backend computer for enabling the security backend computer checking integrity of the data received from the endpoint.

Method for integrity protection in a computer network

There is provided a threat control method on a computer system including: collecting one or more events from a first endpoint, each event identifying one or more attributes associated to the event; detecting a security threat related to one or more of the collected events; searching matching events from one or more further endpoints, wherein the matching event includes at least part of the same attributes than the one or more events related to the detected security threat; and in case a matching event with at least part of the same attributes is found, identifying the associated endpoint as being related to a security threat similar to what was earlier detected.

Threat control

A method including collecting and aligning raw data from a plurality of network nodes, wherein dissimilar data types are aligned as input events; filtering the input events by discarding events and/or parts of events that are detected to be equal or similar to previously observed events or events and/or parts of events found to be redundant by using predetermined criteria; separating processing of the input events into event aggregation and event enrichment processes, wherein the event aggregation process includes processing all the input events for generating aggregated events, and the event enrichment process includes processing only events passed by the filtering and the aggregated events from the event aggregation process; and analysing the data received from the event enrichment process for generating a security related decision.

Method for data reduction in a computer network security system

There are provided measures for improvement of distributed behavioral monitoring. Such measures exemplarily include receiving activity data indicative of a behavior of an entity to be monitored from at least one sensor sensing activity of the entity, wherein the at least one sensor is provided to an endpoint associated with said entity, assessing an activity represented by said activity data as malicious, validating a result of said assessing based on a categorization assigned to said entity in relation to said at least one sensor, and deciding, based on a result of said validating, on a response to said assessing.

Distributed behavioral monitoring

There are provided measures for machine learning based malware detection systems. Such measures exemplarily include analyzing a set of training data, said set of training data comprising a plurality of training data elements, wherein each of said plurality of training data elements is associated with a respective one of at least two maliciousness related properties, learning a malicious object detection model on the basis of first feature combinations of said plurality of training data elements, said first feature combinations characterizing each of said at least two maliciousness related properties, learning an anomalous data detection model on the basis of second feature combinations of said plurality of training data elements, said second feature combinations characterizing said set of training data, said anomalous data detection model being associated with said malicious object detection model, and providing said malicious object detection model and said anomalous data detection model.

Machine learning based malware detection system

A method of detecting malware on a client computer, the method including generating a hash of an entity at the client computer, whereby the entity is suspected to be malware, sending the hash to a network server, considering the reputation of the hash at the network server by comparing the hash to a database of hashes of known reputation, returning the results of said considering to the client computer, and, if the reputation is not known at the server, sending instructions to the client computer for obtaining further information about the entity at the client computer, wherein said further information is obtained by executing code at the client computer sent by the server to the client computer after said considering the reputation if said code is not stored at the client computer before said generating a hash.

Malware detection method

This document discloses a solution for automatically detecting malicious content by computer security routine executed in a processing device. A user input to a social media application is detected by the computer security routine. The user input indicates that a user wants to share content with at least one other user through the social media application. In response, the computer security routine suspends said sharing and performs, before determining whether or not to allow the sharing, a security check for suspiciousness of contents the user intends to share.

Automated detection of harmful content

A method of inhibiting the spread of malware across a network of interconnected computer terminals. The method includes detecting malware or suspicious behavior at a first computer terminal and inspecting the first computer terminal, before and/or after said step of detecting malware or suspicious behavior, to identify contacts forming part of a social network. Identities of the identified contacts are sent to a backend security system, and at the backend security system, said identities are received and instructions sent to one or more second computer terminals associated with respective identities to cause those second computer terminals to implement an increased level of security.

Social network protection system

The present invention relates to a method of controlling the download of anti-virus software updates to a device. The device is configured to transmit an update query to a network device requesting information on whether any updates are available for the anti-virus software. When the device receives the response it stores the response in the cache. The cache can then be queried following a trigger and, if the cache indicates an update to the anti-virus software is available the device downloads an update to the anti-virus software. In an alternative embodiment the device may download and install an update upon receiving the response to the query if the response to the query indicates that an update is available. The query may be transmitted during a scan or upon determining a change in a connection at a device.

Growing community of inventors

Helsinki, Finland

Paolo Palumbo