Symantec Corporation

Symantex Corporation

Ca, Inc.

Pieter Viljoen

Shaun P Cooley

Mark Kevin Kennedy

Brian C Powell

Keith Newstadt

Zulfikar Ramzan

Adam Glick

Walter Bogorad

Shane Pereira

Vadim Antonov

Patrick Gardner

Vijay Anand Seshadri

George Stahl

Gregory D Vogel

Collin Davis

Richard B Sutton

The disclosed computer-implemented method for evaluating security services may include (i) receiving, at a backend security server from an enterprise, multiple suspicious computing events detected within the enterprise, (ii) recording, within the backend security server, historical security information for each computing event that includes (a) a classification of the computing event as malicious or non-malicious based on a security analysis performed by the backend security server and (b) a point in time at which the classification was determined, (iii) evaluating an ability of the backend security server to detect security threats by (a) detecting an additional computing event within the enterprise and (b) determining, based on the historical security information, a point in time at which the backend security server became capable of classifying the additional computing event, and (iv) adjusting a security policy within the enterprise based on the evaluated ability of the backend security server.

Systems and methods for evaluating security services

The disclosed computer-implemented method for detecting malicious computing events may include (i) determining, for multiple computing events detected within an enterprise, an initial disposition score for each computing event based on currently-available security information, (ii) determining an initial classification of each computing event as malicious or non-malicious by comparing the initial disposition score of each computing event with a threshold disposition score, (iii) for each computing event, determining (a) an updated disposition score based on new security information (b) an updated classification, (iv) calculating a degree to which the threshold disposition score correctly identifies malicious computing events by determining a frequency with which the initial classification of each computing event matches the updated classification of the computing event, and (v) adjusting the threshold disposition score based on the degree to which the threshold disposition score correctly identifies malicious computing events.

Systems and methods for detecting malicious computing events

The disclosed computer-implemented method for improving forest-based malware detection within an organization may include (i) receiving, at a backend computing system, organization data from at least one organization computing device within an organization computer network, (ii) adjusting, at the backend computing system, a general use forest model based on the organization data to generate an organization-specific forest model for detecting malicious computer files within the organization computer network, and (iii) sending, from the backend computing system, the organization-specific forest model to the at least one organization computing device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for improving forest-based malware detection within an organization

Method and apparatus for detecting malware are described. In some examples, files of unknown trustworthiness are identified as potential threats on the computer. A trustworthiness level for each of the files is received from a backend. The trustworthiness level of each of the files is compared to a threshold level. Each of the files where the trustworthiness level thereof satisfies the threshold level is designated as a false positive threat. Each of the files where the trustworthiness level thereof does not satisfy the threshold level is designated as a true positive threat.

Method and apparatus for reducing false positive detection of malware

Aspects of the invention relate to a method, apparatus, and computer readable medium for determining software trustworthiness. In some examples, a software package identified as including at least one file of unknown trustworthiness is installed on a clean machine. A report package including a catalog of files that have been installed or modified on the clean machine by the software package is generated. Identification attributes for each of the files in the catalog is determined. Each of the files in the catalog is processed to assign a level of trustworthiness thereto. The report package is provided as output.

Method and apparatus for determining software trustworthiness

A method may include receiving a request to install a second version of a software product over a first version of the software product, installing the second version of the software product in a dormant state while the first version of the software product is running, and swapping the first and second versions of the software product by activating the second version of the software product and deactivating the first version of the software product. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for updating a software product

A computer-implemented method for predictive responses to internet object queries may include receiving a query from a client to evaluate a first internet object. The computer-implemented method may also include analyzing the query to predict a set of additional internet objects for which the client may subsequently request an evaluation. The computer-implemented method may further include transmitting an evaluation of the first internet object and of each additional internet object in the set of additional internet objects to the client. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for predictive responses to internet object queries

A user's possession of synchronized data is used as an authentication factor. When the user requests an authentication configuration change, an authentication server requests the user to prove possession of synchronized data for that user. The user launches an authentication module on a client device hosting a local copy of the synchronized data. The authentication module creates a hash of the local copy and transmits the hash to the authorization server. Upon successfully verifying the received hash using a server copy of the synchronized data, the authentication server considers the user authorized and thus allows the user to make the authorization configuration change.

Possession of synchronized data as authentication factor in online services

A computer-implemented method for authenticating requests from a client running trialware through a proof of work protocol is described. A request received from a client running trialware is analyzed. A cryptographic puzzle is generated if an authentication token is not included with the request. The cryptographic puzzle is transmitted to the client. A solution to the cryptographic puzzle received from the client is analyzed. A response to the request is generated if the received solution to the puzzle is validated.

Systems and methods for authenticating requests from a client running trialware through a proof of work protocol

A user mode application component invokes the assistance of a kernel mode driver component to detect and/or remediate malicious code on a computer system. The user mode application may include code that detects, for example, spyware and computer viruses, from user mode and when appropriate takes protective action when malicious code is detected. In one aspect, when the user mode application is unable to perform a selected operation in attempting to detect and/or take protective action, the user mode application invokes a kernel mode driver for assistance. The kernel mode driver assists user mode application in detecting malicious code and/or taking protective action by enabling or otherwise performing a selected operation for the user mode application.

Method using kernel mode assistance for the detection and removal of threats which are actively preventing detection and removal from a running system

Files to be installed on a computer system are streamed from an archive as the archive is being extracted directly to one or more final destination locations on the computer system.

Archive stream based install

A computer system uses a clean boot technique to protect against malware attacks. Upon certain detection of a malware infection, the computer system is configured to clean boot off of a fixed secure volume containing its own operating system and security software. The security software in the fixed secure volume is usable to remediate the malware attack by itself or by relying at least in part on security software installed in the infected volume.

Secure automatable clean boot system

A publisher uses a toolbox to graphically define web forms, by selecting and configuring components such as buttons, text boxes, menus, etc. Underlying code for the web forms (such as Extensible Markup Language, or XML) is automatically generated. The publisher defines transforms (such as Extensible Stylesheet Markup Language Transforms, or XSLTs) that process the exchange of data between the front end and the backend web service. The transforms and the code underlying the web forms is automatically combined into a frontend to the web service. The web based frontend is published on a user site, such that users can access the backend web service through the frontend.

Generic web service frontend

An install control module allows installation of a software application onto a computer in presence of malicious code that is attempting to prevent installation. A metamorphic installation program is generated randomly to be substantially unique using metamorphic stealthing techniques. The program can be installed and is executed on the computer. Identifying information in the metamorphic installation program is substantially disguised from the malicious code so the program is substantially unrecognizable. The software application is installed onto the computer, and the metamorphic program protects the installation to allow the software application to be installed without substantial interference from the malicious code. In another embodiment, installation occurs by booting a preinstall environment on the computer without running a primary operating system. The software application is installed offline without the primary operating system running and before malicious code present on the computer is executed.

Growing community of inventors

Redondo Beach, CA, United States of America

Pieter Viljoen