Symantec Corporation

Other

Peter Ashley

Shireen Rivera

Michael Andrew Hart

Darrell Kienzle

Quentin Liu

Piyush Sharma

Hari Veladanda

Scott G Wasson

Jacob J Vos

George Tomic

Kevin McBride

Igor Moochnick

Techniques are presented herein for classifying a variety of enterprise computing resources based on asset characteristics. In particular, a computing asset, e.g., a server, may be classified based on any digital certificates provisioned on that server. That is, the properties of a digital certificate may be used to determine a measure of business value or importance of a server (or data hosted on that server). Once the computing asset has been classified, a monitoring system may use the assigned classifications to prioritize security incidents for review.

Discovery and classification of enterprise assets via host characteristics

The disclosed computer-implemented method for detecting suspicious Internet addresses may include (1) monitoring Internet communications of an entity (e.g., an organization or individual), (2) compiling an Internet-address history for the entity that includes one or more Internet addresses involved in the Internet communications of the entity, (3) detecting, after compiling the Internet-address history for the entity, an additional Internet address that may be used in future Internet communications involving the entity, (4) computing a similarity metric between the additional Internet address and at least one Internet-address in the Internet-address history, (5) determining that the similarity metric indicates that the additional Internet address is suspicious, and (6) performing a security action in response to determining that the similarity metric indicates that the additional Internet address is suspicious. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting suspicious internet addresses

A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided.

Detection of malware using time spans and periods of activity for network requests

Techniques for detecting security vulnerabilities are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting security vulnerabilities including assigning a reputation to an application, distributing the reputation to a client, receiving monitored system behavior from the client related to the client executing the application, determining whether to change the reputation of the application based on the monitored system behavior, distributing the changed reputation to the client, receiving further monitored system behavior from the client, and determining whether to generate a rule for the application based on the monitored system behavior received from the client.

Techniques for detecting a security vulnerability

A computer-implemented method for determining potential impacts of applications on the security of computing systems may include (1) identifying an application subject to a security vulnerability assessment, (2) requesting information that identifies a potential impact of the application on a vulnerability of at least one computing system to at least one exploit associated with the application, (3) receiving the information that identifies the potential impact of the application on the vulnerability of the computing system, wherein the information may be derived at least in part from data from at least one additional computing system on which the application has previously been installed and (4) directing a determination about an installation of the application on the computing system based at least in part on the information that identifies the potential impact of the application on the vulnerability of the computing system. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for determining potential impacts of applications on the security of computing systems

A computer-implemented method for protecting computing resources based on logical data models may include (1) receiving, from a security agent, log data that specifies details of a security event detected by the security agent, (2) creating an instance of a data structure for a logical data model that describes a path cycle of a security threat, (3) populating at least one field of the data structure for the logical data model with a completed value, (4) populating at least one other field of the data structure for the logical data model with a value of incomplete based on a completed value for the other field being unavailable, and (5) performing a security action based on an analysis of the instance of the data structure for the logical data model. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting computing resources based on logical data models

System to identify machines infected by malware applying linguistic analysis to network requests from endpoints

Techniques for detecting advanced security threats are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting a security threat including generating a resource at a client, implementing the resource on the client, monitoring system behavior of the client having the resource implemented thereon, determining whether a security event involving the implemented resource has occurred based on the monitored system behavior, and generating a report when it has been determined that the security event has occurred.

Techniques for detecting advanced security threats

A computer-implemented method to assign a security policy is described. A plurality of components of a device are detected. An individual reputation for each of the plurality of components is determined. An overall reputation is determined based on the individual reputations. A security policy is assigned based at least in part on the overall reputation. In some cases, access to at least one component on the device is restricted according to the security policy.

Systems and methods for modifying security based on reputation information

A computer-implemented method for managing delivery of email to local recipients. The computer-implemented method may include establishing a local reputation for an email sender address. The method may include storing a domain-name-system record associated with the local reputation on a domain-name system. The domain-name system may be mail-transfer agent agnostic. The method may also include identifying one or more emails sent from the email sender address to one or more local recipients. The method may include forming a spam verdict for each of the one or more emails by analyzing contents of each of the one or more emails. The method may additionally include updating the local reputation for the email sender address based on the one or more spam verdicts.

Methods and systems for managing delivery of email to local recipients using local reputations

A computer-implemented method for determining trustworthiness of software programs may include (1) determining, for at least one software program, a prevalence score that indicates a prevalence of the software program within a local network, (2) obtaining, for the software program, a reputation score that indicates a reputation of the software program, (3) determining a trustworthiness of the software program based on both the reputation score of the software program and the prevalence score of the software program, and (4) performing a security action based on the trustworthiness of the software program. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for determining trustworthiness of software programs

A method implemented by a computing component for providing adaptive views of reputation data associated with a domain name system query is described. A domain name system query is received. A filter portion within the query is identified. A virtual zone file is queried according to the filter portion of the query. A response to the query is generated. The response comprises an analysis of the reputation data according to the filter portion.

Systems and methods for providing adaptive views of domain name system reputation data

A message transfer agent generates specific error codes indicating that it has adjudicated specific received email traffic to comprise spam. The message transfer agent transmits the generated specific error codes to the sources of the specific received email traffic. An antispam computing device filters email traffic, and receives the error codes transmitted by the message transfer agent to the sources of email traffic. The antispam computing device interprets the specific received error codes as indicating that the message transfer agent adjudicated the specific email traffic to comprise spam. In response, the antispam computing device can block email traffic from these sources, such that the blocked email traffic does not reach the message transfer agent.

Using configured error codes to enable spam blocking downstream from a mail transfer agent

The reputations of content sources are tracked as running rates of content origination. Information concerning content origination from multiple sources is received and aggregated. The aggregated information is used to calculate running rates of content origination. An initial running rate of content origination can be calculated based on the number of detections of originations from a given source over a period of time. Running rates can be updated based on additional detections from the source since the last update. As incoming electronic content is received from specific sources, the running rates from given sources are used to determine whether to block or allow the incoming content. Reputation characterization percentages can be calculated based on the running rates, and incoming content from a specific source can be blocked if a reputation characterization percentage is above a given threshold.

Growing community of inventors

Hopkinton, MA, United States of America

Peter Ashley