Acronis International Gmbh

Ao Kaspersky Lab

Sergey Ulasen

Serguei M Beloussov

Stanislav Protasov

Vladimir Strogov

Vyacheslav Levchenko

Nikolay Grebennikov

Alexey Dod

Anatoly Stupak

Kirill Korotaev

Alexey Kostyushko

Oleg Melnikov

Denis I Parinov

Artem Shapiro

Vasyl Shandyba

Valery Chernyakovsky

Alexander Snorkin

Alexey Yakushkin

Valeriy Chernyakovsky

Konstantin Y Sviridov

Andrey Adaschik

Serg Bell

Mark Shmulevich

Andrey Kulaga

Oleg Ishanov

Anton Enakiev

Dmitry Martynov

Igor Kornachev

Alexey Malanov

Georgy Gomenyuk

Aliaksei Dodz

Valerii Cherniakovskii

Disclosed are systems and methods for data archiving using machine learning techniques. The system collects statistical information and event data and processes them using machine learning techniques to classify data and/or predict data access demands. The system receives statistical information related to user access of a plurality of files, which can effectively 'train' the system to archive data that is not needed at a certain moment and extract it at other moments. The system identifies, using a machine learning module, a pattern of access in the plurality of files based on the received statistical information. The system modifies, using the identified pattern of access, a threshold value related to file access, and assigns a set of files from the plurality of files an access classification based on the modified threshold value. The system migrates the set of files between hot and cold data areas based on the assigned access classification.

System and method for data classification using machine learning during archiving

Disclosed herein are systems and method for classifying objects in an image using a color-based neural network. A method may include: training a neural network to classify an object in a given image into a color class from a set of color classes; determining, from the set of color classes, a subset of color classes that are anticipated to be in a received input image based on image metadata; generating a matched mask input indicating the subset; inputting both the input image and the matched mask input into the neural network, wherein the neural network is configured to: determine a first semantic embedding of the input image and the matched mask input; outputting a color class associated with a second semantic embedding with a least amount of distance to the first semantic embedding from a plurality of semantic embeddings.

Systems and methods for color-based outfit classification using semantic embeddings

A system and method for malware classification using machine learning models trained using synthesized feature sets based on features extracted from samples of known malicious objects and known safe objects. The synthesized feature sets act as virtual samples for training a machine learning classifier to recognize new objects in the wild that are likely to be malicious.

System and method of synthesizing potential malware for predicting a cyberattack

Disclosed herein are systems and method for detecting small objects in an image using a neural network (NN). An exemplary method may include: receiving a first NN that is trained on a dataset including a plurality of images depicting various objects; identifying a first structure of the first NN, the first structure indicative of each layer and layer size in the first NN; determining, based on the first structure, whether the first NN can classify an object less than a threshold size in an input image; in response to determining that the first NN cannot classify the object, identifying a subset of detection layers in the first NN; generating and training a second NN that has a second structure in which the subset of detection layers are replaced by at least one layer not in the subset; and receiving, from the second NN, a classification of the object.

Systems and methods for detecting small objects in an image using a neural network

A system and method of anti-malware analysis including iterative techniques. These techniques are used to create a file attribute tree used by a machine learning analyzer to identify malicious files.

Machine learning through iterative memory analysis for malware detection

A system and method is provided for detecting a suspicious process in an operating system environment. In an exemplary aspect, a method comprises generating, by a hardware processor, a file honeypot in a directory in a file system and receiving a directory enumeration request from a process executing in the operating system environment. The method comprises determining whether the process is identified in a list of trusted processes and in response to determining that the process is not in the list of trusted processes, providing, to the process by the file system, a file list including the file honeypot responsive to the directory enumeration request. The method further comprises intercepting, by a file system filter driver, a file modification request for the file honeypot from the process, and identifying the process as a suspicious object responsive to intercepting the file modification request from the process.

Systems and methods for detecting a suspicious process in an operating system environment using a file honeypots

Disclosed herein are systems and method for malicious behavior detection in processing chains comprising identifying and monitoring events generated by a first process executing on a computing device; storing snapshots of data modified by any of the events; determining a level of suspicion for the first process, wherein the level of suspicion is a likelihood of the first process being attributed to malware based on the data modified by any of the events; in response to determining that the first process is not trusted based on the determined level of suspicion, identifying at least one sub-process of the first process; and restoring, from the snapshots, objects affected by the first process and the at least one sub-process.

Systems and methods for detecting malicious behavior in process chains

Disclosed are systems and methods for detecting malicious applications. An exemplary method may comprise detecting that a first process has been launched on a computing device. The method may comprise receiving, from the first process, an execution stack associated with one or more control points of the first process. The method may comprise applying a machine learning classifier on the execution stack, wherein the machine learning classifier is configured to classify whether a process is malicious based on activity on control points captured on a given execution stack, and wherein a feature of a malicious process is detection of a system call to create a remote thread that runs in a virtual address space of a shared-service process configured to import third-party processes to be embedded as separate threads. The method may comprise generating an indication that the execution of the first process is malicious/non-malicious.

Systems and methods for detecting malicious processes

Methods for file archiving using machine learning are disclosed herein. An exemplary method comprises archiving a first file of a plurality of files from a storage server to a tiered storage system, training a machine learning module based on file access operations for the plurality of files, determining one or more rules for predicting access to the archived files using the machine learning module, determining a prediction of access of the archived file based on the one or more rules and retrieving the archived file from the tiered storage system into a file cache in the storage server based on the prediction of access.

System and method for file archiving using machine learning

Disclosed herein are methods and systems for providing data recovery recommendations. In an exemplary aspect, a method may comprise identifying a plurality of storage devices. For each respective device of the plurality of storage devices, the method may comprise extracting a respective input parameter indicative of a technical attribute of the respective device, inputting the respective input parameter into a machine learning algorithm configured to output both a first likelihood of the respective device needing a data recovery and a second likelihood that the data recovery will fail, and determining a respective priority level of the respective device based on the first likelihood and the second likelihood. The method may comprise normalizing each respective priority level, and recommending a device of the plurality of storage devices for a test data recovery procedure based on each normalized priority level.

Systems and methods for providing data recovery recommendations using A.I

Disclosed are systems and methods for detecting multiple malicious processes. The described techniques identify a first process and a second process launched on a computing device. The techniques receive from the first process a first execution stack indicating at least one first control point used to monitor at least one thread associated with the first process, and receive from the second process a second execution stack indicating at least one second control point used to monitor at least one thread associated with the second process. The techniques determine that both the first process and the second process are malicious using a machine learning classifier on the at least one first control point and the at least one second control point. In response, the techniques generate an indication that an execution of the first process and the second process is malicious.

Systems and methods for protecting against malware code injections in trusted processes by a multi-target injector

Disclosed herein are systems and method for anti-virus scanning of backup data at a centralized storage. In an exemplary aspect, a method may receive, at the centralized storage, a backup slice from each respective computing device in a plurality of computing devices, wherein the centralized storage comprises, for each respective computing device, a respective backup archive including a plurality of backup slices. The method may mount the received backup slice as a virtual disk. The method may detect, for the respective computing device, a change between the mounted virtual disk and any number of previous backup slices and may evaluate the change against behavioral rules to identify malicious behavior. In response to determining that the change exhibits malicious behavior, the method may execute a remediation action to prevent an attack on the plurality of computing devices or the centralized storage.

Method and system for antivirus scanning of backup data at a centralized storage

Methods and systems are provided for modifying configuration of a storage system using artificial intelligence. An exemplary method comprises collecting, over a period of time, health and parameter information of the storage system. The method comprises predicting, using a machine learning algorithm, upcoming events that may degrade performance of the storage system based on the health and parameter information. The method comprises determining that the storage system will not operate in accordance with a set of goals based on the upcoming events. In response to determining that the storage system will not operate in accordance with the set of goals, the method comprises generating parameter changes, and applying the parameter changes to the storage system.

Systems and methods for modifying storage system configuration using artificial intelligence

Disclosed are systems and methods for detecting malicious applications. The described techniques detect a first process has been launched on a computing device, and monitor at least one thread associated with the first process using one or more control points of the first process. An execution stack associated with the one or more control points of the first process is received from the first process. In response to detecting activity on the one or more control points of the first process, an indication that the execution of the first process is malicious is generated by applying a machine learning classifier to the received execution stack associated with the one or more control points of the first process.

Protecting against malware code injections in trusted processes

Disclosed herein are systems and method for determining a boot status of a failover server. In an exemplary aspect, a method may receive a failover test request for a failover server that provides disaster recovery for a production server, wherein the failover test request queries a successful boot status of the failover server. The method may determine whether a login into the failover server can be performed to execute the failover test request. In response to determining that the login cannot be performed, the method may retrieve server metrics for a failover server from a metric store and may determine a probability of the successful boot status based on both the retrieved server metrics and historic server metrics. In response to determining that the probability is greater than a threshold probability, the method may mark a recovery point of the failover server as validated.

Growing community of inventors

Moscow, Russia

Sergey Ulasen