Acronis International Gmbh

Constructor Technology Ag

Constructor Education and Research Genossenschaft

Chainstack Pte. Ltd.

Serg Bell

Stanislav Protasov

Vladimir Strogov

Nickolay Berko

Aliaksei Dodz

Candid Wuest

Sergey Ulasen

Philipp Gysel

Alexander Tormasov

Nikolay Dobrovolskiy

Ilya Shimchik

Laurent Dedenis

Ivan Klimov

Dinil Mon Divakaran

Artem Shapiro

Vasyl Shandyba

Alexander Andreev

Ruslan Mustafin

Maksim Filipenko

Aleksandr Buival

Andrey Kulaga

Ilya Baimetov

Prabhuraj Reddy

Hiten Gajjar

Evgeny A Aseev

Kurt Natvig

Alexander Snorkin

Ivan Kirillov

Nikolay Grebennikov

Andrey Adaschik

Irina Lukasheva

Maxim Cherey

Dmitry Ledenyov

Brad Smith

Kenneth Nwafor

Vladimir Miroshkin

Anton Kivich

Yuri Per

Andrey Kuleshov

Stanislav Protsaov

Oleg Ishanov

Evgeny Aseev

Artem Ushanov

Ilia Iuskevich

Alexey Kostyushko

Denis Parkhomenko

Andrei Boiarov

German Bartenev

Aleksandr Brilliantov

Dmitry Chepurovskiy

Anton Zaslavskii

Marcel De Korte

Alexey Rybak

Dmitriy Obukhov

Igor Milosevic

Vasily Semyonov

Denis Kopyrin

Andrey Ustyuzhanin

Kseniia Alekseitseva

Evgenii Kabantsev

Ivan Krestinin

Anton Enakiev

Mikhail Rybakov

Systems and methods implement artificial intelligence to automatically generate malware detection rules. In a first phase, an AI model is trained on large amounts of data, so the AI model can learn to distinguish between benign applications and different malware families. In a second phase, the AI model is queried with new malware samples, and systems and methods propose new malware detection rules for those samples.

AI assisted generation of rules for malware detection with transformer attention mechanism

A system and method for updating a digital fingerprint library storing data fingerprints with hierarchical security classification levels. The digital fingerprint library is updated when new fingerprints are presented for inclusion in the library. When a new fingerprint matches a fingerprint in the library, the library's fingerprint is updated. When the new fingerprint does not have a match in the library, the new fingerprint is added to the library.

Generation of the digital fingerprints library with hierarchical structure

A system determines whether a first operation performed by an MLM is compatible with a specific encryption scheme, wherein the MLM is distributed over at least one client device and at least one server. In response to determining that the first operation is compatible with the specific encryption scheme, the system encrypts data associated with the first operation using the specific encryption scheme, and transmits the encrypted data to the at least one server configured to apply the first operation. In response to determining that the first operation is incompatible with the specific encryption scheme, the system performs the first operation on the data using the at least one client device without encrypting using the specific encryption scheme.

Partially homomorphic encryption (PHE) in distributed 1-bit large language model (LLM) architecture

Disclosed herein are systems and methods for selecting files for malware analysis. In one aspect, a method may include identifying, in a cloud network, a backup of a client machine; extracting, from the backup, at least one file of a given file type; determining whether to include the at least one file in a sandbox of the cloud network by performing a static analysis of the at least one file; selecting the at least one file for inclusion in the sandbox based on the static analysis; monitoring, for a period of time, a behavior of the at least one file in the sandbox by performing a dynamic analysis of the at least one file; and in response to determining that the at least one file is malicious based on the dynamic analysis, performing a remediation action on the at least one file.

Systems and methods for selecting client backup files for maliciousness analysis

A system and method for regulating a motorsport racing event are disclosed. The system comprises sensor modules for sensing a plurality of race parameters to generate a plurality of input signals. A data analysis module receives the input signals for analysis. A decision-making module receives the analyzed signal and computes a recommendation or a decision corresponding to the level of violation. A penalty and recommendation module receives information associated with the recommendation or the decision and presents the recommendation or the decision.

Automatic automotive race management

Systems and methods for protecting computing systems against ransomware attacks using AI-generated virtual file honeypots. Generative AI comprising a large language model generates virtual file honeypots automatically in response to attack vectors associated with suspect actors and ransomware families.

AI-generated virtual file honeypots for computing systems behavior-based protection against ransomware attacks

Systems and methods for firmware protection of industrial control systems. A kernel-level agent operating at a kernel mode intercepts a request to the resource, collects data associated with the intercepted request, and sends the collected data to a security service. A security service receives the collected data, analyzes the collected data to determine a verdict, and sends the verdict to the kernel-level agent. The kernel-level agent then executes a security action for the resource based on the verdict.

Firmware protection for industrial control systems

Systems and methods for verifying a production system automatically by testing a mirror copy of the production system on a testing computer. The system includes a mirror update transporter to deliver a mirror update from the production system to the mirror system, a mounting module to apply the mirror update to the mirror system, a testing computer on which the mirror system is running, a testing module to automatically execute a set of tests on the mirror system, and a communication module to communicate the results of the tests.

System and method for evaluating active backups using penetration testing

The present disclosure relates to a system to evaluate an avatar generated by an avatar generator. The system comprises an evaluation module including an audio evaluation module for evaluating audio features and a video evaluation module for evaluating video features. Evaluation of the avatar includes extracting audio and video features from the avatar and applying a set of evaluation metrics for generating audio and video evaluation scores. The scores are combined to generate a final score. For avatar generator evaluation, audio clip and video clip are provided to the audio evaluation module and video evaluation module, respectively. A set of evaluation metrics is applied for evaluation. Each metric can generate a score. All scores are combined to generate a final evaluation score.

System and method for an audio-visual avatar evaluation

A system to optimize required resources at an endpoint needed to monitor a user behavior for abnormalities with the endpoint includes a processor processing a plurality of agents running at the endpoint to intercept network traffic metrics, intercept device access metrics, intercept app-specific user-mode metrics, parse intercepted data, and submit the intercepted data to a backend component at a server to collect the intercepted data from the endpoint, predict deviation from a normal profile, in which the backend component assesses available characteristics of a particular endpoint, calculates an endpoint user profile, calculates a degree of variance (DoV) between the user profile and the normal profile, compares the calculated DoV to a predetermined Variance Threshold (VT), and predicts, based on machine learning algorithms, a movement of a trend of the DoV within the VT, creates an adjusted metrics list, and distributes adjusted metrics to a related endpoint.

User behavior anomaly detection-sensors

Systems and methods for automatic generation of highlights of video. The system includes a video processor to select one type of the video to be analyzed and split video clips from the video. The video processor recognizes positive clips, negative clips, and auxiliary clips. A spatio-temporal encoder is configured to select, from the recognized clips, a main positive clip, a main negative clip, and auxiliary positive and negative clips, and generate a three-dimensional (3D) embedding vector of each clip. The selected clips are processed by a ranking network having a self-attention layer. The self-attention layer, using a query head, a key head and the value head produces self-attention resultant vector on which an activation function is performed. A rank value is thus obtained for the selected clip. Based on the rank value, video highlights are generated.

System and method for automatic video summarization

Systems and methods for embedding into a storage stack of a UNIX based computing device. A method includes building a file storage map for a file stored in computing device data storage, intercepting a system call associated with the file, intercepting a storage stack operation, and analyzing the system call and the storage stack operation using the file storage map to determine a change to a data block of the file. The method further includes building a shadow copy of the file on backup storage. The method further includes detecting a malicious operation based on the change to the data block.

Shadow backup and anti-malware protection for UNIX-based machines

Systems and methods for ransomware protection in advanced injection-based attacks. Events from a driver are analyzed to identify a potentially malicious actor. A confidence level is calculated for the potentially malicious actor identification to weigh the probability that the actor is malware or a source of malware. Behavior associated with the potentially malicious actor can be collected, if it is likely that the potentially malicious actor is associated with malware, such as if the confidence level is over a predetermined threshold. Subsequently, one or more virtual honeypots are generated for the suspicious processes and the response to the virtual honeypots is included in anti-ransomware heuristic analysis.

Virtual file honey pots for computing systems behavior-based protection against ransomware attacks

Systems and methods for ransomware protection in advanced injection-based attacks. The call stack(s) of injected threads are analyzed and a preliminary verdict of benign or malicious can be determined. Additional sensors collect data to associate injected threads with other activities or actors to further estimate the injected thread being benign or malicious. If the threat level is high enough, such as over a given threshold, the preliminary verdict can be determined to be malicious. Subsequently, one or more virtual honeypots are generated for the suspicious threads and the injected thread's response to the virtual honeypots included in anti-ransomware heuristic analysis.

Ransomware protection in advanced injection-based attacks

Disclosed herein are systems and method for detecting malware in obfuscated scripts. A method may include receiving the obfuscated script on a computing device written in a first coding language, wherein a malware scanner on the computing device is incompatible with the first coding language, identifying the first coding language based on detected keywords and operators in the obfuscated script, converting each line of the obfuscated script in the first coding language into a respective modified abstract syntax tree (mAST), receiving artifacts of the obfuscated script by executing at least one mAST using a universal emulator, scanning the artifacts for malware using the malware scanner; and in response to detecting the malware in the obfuscated script based on the scanning, performing a remediation action on the obfuscated script.

Systems and methods for detecting malware in obfuscated scripts

Growing community of inventors

Singapore, Singapore

Serg Bell