Fireeye, Inc.

Peter J Gilbert

Osman Abdoul Ismael

Phung-Te Ha

Dawn Song

Hui Xue

For one embodiment, a method is described that involves the instrumenting of an application of a computing system with at least one monitoring function, where the monitoring function is capable of operating in a run-time environment during processing of the instrumented application. The movement of data associated with the application is tracked by one or more monitoring functions. This data is at least partially identified by a storage location. Thereafter, a determination is made whether movement of the data from a first storage location to a second storage location is suspicious, and if so, suspicious movement of the data is reported.

Framework for efficient security coverage of mobile software applications using machine learning

A method is described that involves generating one or more machine learned rules with a machine learning system. The method also involves generating a representation of an application that describes various states and state transitions of the application. The method also involves referring to the one or more machine learned rules and the representation to identify a region of interest of the application. The method also involves configuring one or more monitors for the application to be enabled in a run time environment of the application. The method also involves setting conditions of the application within the run time environment to drive the application's execution to the region of interest. The method also involves observing behaviors of the application and determining whether the region of interest corresponds to improperly behaving code.

Growing community of inventors

Winston Salem, NC, United States of America

Peter J Gilbert