Novell, Inc.

Threattrack Security, Inc.

Prathap Adusumilli

Paul Apostolescu

John Melvin Antony

Usman Choudhary

Pattabiraman Srinivasan

Aboubacar Toure

Jeff Markey

Melvin Antony

Dipto Chakravarty

John Paul Gassner

Frank Anthony Pellegrino

Michael Howard Cooper

William Matthew Weiner

Srinivasa Phanindra Mallapragada

Ofer Zajicek

Magdalene Ramona Merritt

Peng Liu

Raghunath Boyalakuntla

Srivani Sangita

Vasile Adiaconitei

Shahid Saied Malik

Karthik Ramu

Walter Mathews

Adedoyin Akinnurun

Brett Hankins

Tao Yu

A threat detection system for detecting malware can automatically decide, without manual expert-level interaction, the best set of features on which to train a classifier, which can result in the automatic creation of a signature-less malware detection engine. The system can use a combination of execution graphs, anomaly detection and automatic feature pruning. Execution graphs can provide a much richer structure of runtime execution behavior than conventional flat execution trace files, allowing the capture of interdependencies while preserving attribution (e.g., D happened because of A followed by B followed by C). Performing anomaly detection on this runtime execution behavior can provide higher order knowledge as to what behaviors are anomalous or not among the sample files. During training the system can automatically prune the features on which a classifier is trained based on this higher order knowledge without any manual intervention until a desired level of accuracy is achieved.

Malware detection based on training using automatic feature pruning with anomaly detection of execution graphs

Apparatus, systems, and methods may operate to generate a reference statistical model of an operating system, such as a computer system, and display the reference statistical model as a hierarchical, segmented time series event stream graph, along with a graph representing current behavior of the system. The event stream graph may be derived from one or more streams of security events. Additional operations may include receiving requests to display further detail respecting discrepancies between the reference statistical model and the current behavior. Other apparatus, systems, and methods are disclosed.

Event management apparatus, systems, and methods

Apparatus, systems, and methods may operate to receive multiple security event data streams from a plurality of hardware processing nodes, the multiple security event data streams comprising multiple security events. Additional operations may include extracting multiple security events from multiple security event data streams, and classifying the extracted multiple security events to form domain-specific, categorized data streams. A hierarchy of statistical data streams may then be generated from the domain-specific, categorized data streams. Additional apparatus, systems, and methods are disclosed.

Security event management apparatus, systems, and methods

A computer-implemented device provides security events from publishers to subscribers. There is provided a message bus, configured to contain a plurality of security events. Also provided is a receiver unit, responsive to a plurality of publishers, to receive the plurality of security events from the publishers. There is also a queue unit, responsive to receipt of the security events, to queue the plurality of security events in the message bus. Also, there is a transport unit, responsive to the security events in the message bus, to transport the plurality of security events in the message bus to a plurality of subscribers.

Computer-implemented method and system for security event transport using a message bus

Growing community of inventors

Herndon, VA, United States of America

Prathap Adusumilli