Area 1 Security, Inc.

Peter Stein

Philip Syme

Torsten Zeppenfeld

Jesse Collins

Rahul Sridhar

Ali Soylemezoglu

Tamar Weseley

Donghyun Michael Choi

Hunter Van Adelsberg

Connie Siu

Andrea Li

Techniques are described herein for detecting malicious program code stored on computer devices before the code can be executed to potentially compromise a computer network. In an embodiment, a method comprises receiving, at a computer device, a file containing instructions in a programming language; based on a syntax of the programming language, parsing the file to generate parsed information, and based on the parsed information, generating a syntax tree for the file; identifying one or more alphanumeric strings in the syntax tree, and based on the alphanumeric strings, generating a syntax string for the syntax tree; generating a hash digest by applying a piecewise hashing to the alphanumeric strings in the syntax string; determining whether the hash digest indicates that the file contains potentially malicious code; in response to determining that the hash digest indicates that the file contains the potentially malicious code, performing a responsive action.

Detecting malicious program code using similarity of hashed parsed trees

In an embodiment, a data processing method providing an improvement in computer security, comprises selecting, from a domain name queue comprising a plurality of domain names, a particular domain name to analyze; extracting one or more features of the particular domain name; determining a particular risk priority score of the particular domain name based on analyzing the one or more features of the particular domain name by applying a classifier to the one or more features of the particular domain name; inserting the particular risk priority score and an identifier associated with the particular domain name into a priority queue comprising a plurality of risk priority scores and a plurality of domain names; repeating the selecting, extracting, determining, and inserting steps for the remaining domain names in the domain name queue; retrieving from the priority queue, based upon the risk priority score, the identifier associated with the particular domain name; determining the particular domain name associated with the identifier; scanning the particular domain name for malicious content or security vulnerabilities; and outputting results of the scanning to a system, database, or report.

Domain feature classification and autonomous system vulnerability scanning

In an embodiment, a data processing method providing an improvement in computer security, comprises selecting a uniform resource location (URL) for classification wherein the selected URL is associated with a webpage; determining a URL risk score for the selected URL; comparing the URL risk score to a URL risk threshold; in response to determining that the URL risk score exceeds the URL risk threshold, determining a maliciousness risk score for the webpage content associated with the selected URL; comparing the maliciousness risk score to a maliciousness risk threshold; and classifying the URL based on the comparison between the maliciousness risk score and the maliciousness risk threshold; in response to determining that the maliciousness risk score exceeds the maliciousness risk threshold, classifying the URL as malicious; in response to determining that the maliciousness risk score does not exceed the maliciousness risk threshold, classifying the URL as benign.

Using machine learning for classification of benign and malicious webpages

Growing community of inventors

Oak Park, IL, United States of America

Peter Stein