Sophos Limited

Cisco Technology, Inc.

US Government As Represented by the Secretary of the Army

Richard Edward Harang

Joshua Daniel Saxe

Ethan McAvoy Rudd

Konstantin Berlin

Shayne Miel

Felipe Nicolás Ducau

Cody Marie Wild

Lisa M Marvel

Tamás Vörös

Joshua Terry

Jake Ingman

Michael Thaddeus Moran

Robert Small

Joshua Brian Lindauer

Rebecca Ann Lynch

Patrick McMahon

Travis W Parker

Felipe Ducau

Gillian Gacusan

Kevin Tyler Burchfield

An apparatus can include a memory and a processor. The processor can be configured to train a machine-learning (ML) model to output (1) an identification of whether an artifact is malicious and (2) a confidence value associated with the identification of whether the artifact is malicious. The processor can further be configured to receive a set of artifacts during a set of time periods, and provide a representation of each artifact from the set of artifacts to obtain as an output of the ML model including an indication of whether that artifact is malicious and a confidence value associated with the indication. The processor can be further configured to calculate a confidence metric for each time period based on the confidence value associated with each artifact and send an indication to retrain the ML model based on the confidence metric for at least one time period meeting a retraining criterion.

Methods and apparatus for management of a machine-learning model to adapt to changes in landscape of potentially malicious artifacts

A system of one embodiment provides for efficient grid-estimation of spherical geo-probability function. The system includes a memory and a processor. The system accesses data, wherein the data includes training points and each training point includes a latitude value and a longitude value. The system also generates one or more grid points around each training point in the data. The system calculates a probability value for each grid point in the plurality of grid points using a probability density function. The system also combines each grid point into a geo-grid. The systems stores the geo-grid. In some embodiments, the system combines each grid point into a geo-grid by adding a probability value of a first grid point to a probability value of second grid point.

Systems and methods for efficient grid-estimation of spherical geo-probability function

The present technology provides for altering an authentication technique in response to a detection of a possible attack to which the authentication technique is vulnerable. An authentication provider can receive an authentication request to authenticate to a first resource, where the authentication to the first resource is permitted using a particular authentication technique, includes contextual information associated with the first access device and information identifying the first resource. Based on the contextual information, the authentication provider can determine that the authentication request is subject to an ongoing attack, and determine, an alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique. The authentication provider can require the first user account to authenticate with the first resource using the alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique.

Risk-based factor selection

An apparatus for detecting malicious files includes a memory and a processor communicatively coupled to the memory. The processor receives multiple potentially malicious files. A first potentially malicious file has a first file format, and a second potentially malicious file has a second file format different than the first file format. The processor extracts a first set of strings from the first potentially malicious file, and extracts a second set of strings from the second potentially malicious file. First and second feature vectors are defined based on lengths of each string from the associated set of strings. The processor provides the first feature vector as an input to a machine learning model to produce a maliciousness classification of the first potentially malicious file, and provides the second feature vector as an input to the machine learning model to produce a maliciousness classification of the second potentially malicious file.

Methods and apparatus for detection of malicious documents using machine learning

Statistical properties of known malware distributions may be used to improve estimates of malware detection metrics such as a base rate of malicious events in a target environment or missed detections (also referred to as false negatives). In particular, numerous synthetic sample distributions may be generated based on the statistical properties of a base data set and/or additional observed data, and used to identify malware distributions that produce overall detection statistics corresponding to model output for live target data. The malware detection metrics for the live target data can then be characterized using the observed distributions of malware (and malware detections) for the synthetic sample distributions.

Cybersecurity system evaluation and configuration

A system for conducting a security recognition task, the system comprising a memory configured to store a model and training data including auxiliary information that will not be available as input to the model when the model is used as a security recognition task model for the security recognition task. The system further comprising one or more processors communicably linked to the memory and comprising a training unit and a prediction unit. The training unit is configured to receive the training data and the model from the memory and subsequently provide the training data to the model, and train the model, as the security recognition task model, using the training data to predict the auxiliary information as well as to perform the security recognition task, thereby improving performance of the security recognition task. The prediction unit is configured to use the security recognition task model output to perform the security recognition task while ignoring the auxiliary attributes in the model output.

Augmented security recognition tasks

In some embodiments, a method includes processing at least a portion of a received file into a first set of fragments and analyzing each fragment from the first set of fragments using a machine learning model to identify within each fragment first information potentially relevant to whether the file is malicious. The method includes forming a second set of fragments by combining adjacent fragments from the first set of fragments and analyzing each fragment from the second set of fragments using the machine learning model to identify second information potentially relevant to whether the file is malicious. The method includes identifying the file as malicious based on the first information within at least one fragment from the first set of fragments and the second information within at least one fragment from the second set of fragments. The method includes performing a remedial action based on identifying the file as malicious.

Methods and apparatus for using machine learning on multiple file fragments to identify malware

This disclosure describes techniques and mechanisms for authenticating user device(s) by ensuring that two user devices accessing the same online service are co-located, while protecting private information associated with a user's network landscape and/or Bluetooth device(s). The techniques may ensure that a second factor authentication device is in the same location as a first factor access device, and that a first factor access device is in the same location as it was during previous access attempts).

Privacy preserving zero knowledge proof of device co-location

Embodiments disclosed include methods and apparatus for detecting a reputation of infrastructure associated with potentially malicious content. In some embodiments, an apparatus includes a memory and a processor. The processor is configured to identify an Internet Protocol (IP) address associated with potentially malicious content and define each row of a matrix by applying a different subnet mask from a plurality of subnet masks to a binary representation of the IP address to define that row of the matrix. The processor is further configured to provide the matrix as an input to a machine learning model, and receive, from the machine learning model, a score associated with a maliciousness of the IP address.

Methods and apparatus for using machine learning to classify malicious infrastructure

In some embodiments, an apparatus includes a memory and a processor. The processor is configured to extract a set of features from a potentially malicious file and provide the set of features as an input to a normalization layer of a neural network. The processor is configured to implement the normalization layer by calculating a set of parameters associated with the set of features and normalizing the set of features based on the set of parameters to define a set of normalized features. The processor is further configured to provide the set of normalized features and the set of parameters as inputs to an activation layer of the neural network such that the activation layer produces an output based on the set of normalized features and the set of parameters. The output can be used to produce a maliciousness classification of the potentially malicious file.

Methods and apparatus for preserving information between layers within a neural network

In some embodiments, a non-transitory processor-readable medium stores code representing instructions to be executed by a processor. The code includes code to cause the processor to receive a structured file for which a machine learning model has made a malicious content classification. The code further includes code to remove a portion of the structured file to define a modified structured file that follows a format associated with a type of the structured file. The code further includes code to extract a set of features from the modified structured file. The code further includes code to provide the set of features as an input to the machine learning model to produce an output. The code further includes code to identify an impact of the portion of the structured file on the malicious content classification of the structured file based on the output.

Methods and apparatus for identifying an impact of a portion of a file on machine learning classification of malicious content

A system for conducting a security recognition task, the system comprising a memory configured to store a model and training data including auxiliary information that will not be available as input to the model when the model is used as a security recognition task model for the security recognition task. The system further comprising one or more processors communicably linked to the memory and comprising a training unit and a prediction unit. The training unit is configured to receive the training data and the model from the memory and subsequently provide the training data to the model, and train the model, as the security recognition task model, using the training data to predict the auxiliary information as well as perform the security recognition task, thereby improving performance of the security recognition task. The prediction unit is configured to use the security recognition task model output to perform the security recognition task while ignoring the auxiliary attributes in the model output.

In some embodiments, an apparatus includes a memory and a processor. The processor can further be configured to extract a set of scripts from potentially malicious a file. The processor can further be configured to concatenate a representation of each script from the set of scripts with a representation of the remaining scripts from the set of scripts to define a script string. The processor can further be configured to define a feature vector based on the set of n-gram representations of the script string for input of the feature vector to a neural network for output. The processor can further be configured to identify, based on the output from the neural network, a maliciousness classification of the file.

Growing community of inventors

Alexandria, VA, United States of America

Richard Edward Harang