Acronis International Gmbh

Constructor Education and Research Genossenschaft

Constructor Technology Ag

Sergey Ulasen

Stanislav Protasov

Serguei M Beloussov

Vladimir Strogov

Serg Bell

Aliaksei Dodz

Artem Shapiro

Vasyl Shandyba

Alexander Snorkin

Vyacheslav Levchenko

Dmitry Martynov

Ilya Shimchik

Nikolay Dobrovolskiy

Alexey Malanov

Seguei Beloussov

Andrey Adaschik

Anton Kivich

Andrei Boiarov

Kseniia Alekseitseva

Systems and methods for firmware protection of industrial control systems. A kernel-level agent operating at a kernel mode intercepts a request to the resource, collects data associated with the intercepted request, and sends the collected data to a security service. A security service receives the collected data, analyzes the collected data to determine a verdict, and sends the verdict to the kernel-level agent. The kernel-level agent then executes a security action for the resource based on the verdict.

Firmware protection for industrial control systems

Systems and methods for automatic generation of highlights of video. The system includes a video processor to select one type of the video to be analyzed and split video clips from the video. The video processor recognizes positive clips, negative clips, and auxiliary clips. A spatio-temporal encoder is configured to select, from the recognized clips, a main positive clip, a main negative clip, and auxiliary positive and negative clips, and generate a three-dimensional (3D) embedding vector of each clip. The selected clips are processed by a ranking network having a self-attention layer. The self-attention layer, using a query head, a key head and the value head produces self-attention resultant vector on which an activation function is performed. A rank value is thus obtained for the selected clip. Based on the rank value, video highlights are generated.

System and method for automatic video summarization

Disclosed herein are systems and method for determining environment dimensions based on landmark detection, the method including: training, with a dataset including a plurality of images featuring an environment and labelled landmarks in the environment, a neural network to identify the labelled landmarks in an arbitrary image of the environment; receiving an input image depicting the environment; generating an input tensor based on the received input image; inputting the input tensor into the neural network, wherein the neural network is configured to generate an output tensor including a position of each identified landmark and a visibility score associated with each position; calculating a homography matrix between each position in the output tensor along a camera plane and a corresponding position in an environment plane, based on a pre-built model of the environment; and outputting an image that visually connects each landmark along the environment plane based on the homography matrix.

Systems and methods for determining environment dimensions based on landmark detection

Systems and methods for threat detection and analysis. A method includes monitoring at least one thread associated with at least one user process on a computing device. The method further includes detecting specific-system calls associated with at least one user process at user level. The specific-system calls are analyzed by applying a filter to system calls sequence feature sets associated with the specific-system calls for detecting one or more events of interest. A capture of a full stack trace of at least one user process is requested if the system calls sequence feature set is filtered and at least one event of interest is detected. A first level monitoring is provided to the computing device, which includes processing and analyzing the captured full stack trace by a machine learning (ML) stack trace analyzer to generate a first verdict for threat detection and analysis.

System and method for threat detection based on stack trace and user-mode sensors

The present disclosure relates to a system and method for creating a backup and restoring the exact clean system state prior to malware detection. The system includes a security system, in communication with one or more applications of a computing system, and a backup unit. The security system detects malware during execution of the applications or events based on a memory dump analysis. The backup unit creates a backup copy of the system state corresponding to each event, labels each copy and creates an index. When the security system detects presence of the malware at a particular event, the backup system parses the index, and with use of the labels, retrieves the exact backup copy that belongs to the event preceding the other event that caused the malware attack.

Exact restoration of a computing system to the state prior to infection

Forensic analysis on consistent system footprints relates to a system and method for rootkit detection based on forensic analysis performed on consistent system footprints, such as application events, application network communications and application files. The system includes a security system periodically monitoring one or more applications of a computing system. The security system includes a threat detection unit for collecting and storing system memory dumps, a machine learning module trained on clean and infectious memory dump, a similarity scanner to identify similarity between suspicious memory block and consistent system footprints, and a forensic analyzer to perform forensic analysis and detect infection, if any, based on the similarity found. The suspicious memory block is identified by the threat detection unit based on the analysis performed by the machine learning model. Upon rootkit detection an alert and forensic analysis report are generated.

Forensic analysis on consistent system footprints

Disclosed herein are systems and method for forming and executing a backup strategy. In one aspect, an exemplary method comprises forming a respective backup strategy for each respective file of a plurality of files stored in a data source based on a frequency of occurrence, a desired recovery time, and a criticality of data loss for the respective file. The method further comprises executing the respective backup strategy for the respective file.

System and method for automating formation and execution of a backup strategy

Disclosed herein are systems and method for determining environment dimensions based on environment pose. In one aspect, the method may include training, with a dataset including a plurality of images featuring an environment and labelled landmarks in the environment, a neural network to identify a pose of an environment. The method may comprise receiving an input image depicting the environment, generating an input tensor based on the input image, and inputting the input tensor into the neural network, which may be configured to generate an output tensor including a position of each identified landmark, a confidence level associated with each position, and a pose confidence score. The method may include calculating a homography matrix between each position in the output tensor along a camera plane and a corresponding position in an environment plane in order to output an image that visually connects each landmark along the environment plane.

Systems and methods for determining environment dimensions based on environment pose

A rootkit detection system and method analyzes memory dumps to determine connections between intercepted system driver operations requested by unknown files and changes in system memory before and after those operations. Memory dump differences and I/O buffers are analyzed with machine learning models to identify clustered features associated with rootkits.

Rootkit detection based on system dump files analysis

A system and method for malware detection uses static and dynamic analysis to train a machine learning model. At the training step, static and dynamic features are extracted from training datasets and used to train a malware classification model. The malware classification model is used to classify unknown files based on verdicts from both static and dynamic models.

Integrated static and dynamic analysis for malware detection

The present disclosure relates to a system and method for rootkit detection based on a system dump sequence analysis. The system includes a security system in communication with one or more applications of a computing system. The security system includes a system event monitor to monitor events occurring at the applications, a system dump capture driver to capture differential system dumps corresponding to each event, and a rootkit detection engine to determine if a system state is infected. The rootkit detection engine is based on a machine learning model, where the machine learning model is trained on collection of clean system dumps and infectious system dumps. Based on analysis carried out by the machine learning model, the rootkit detection engine can classify the system state as suspicious, infectious, or clean state.

Rootkit detection based on system dump sequence analysis

A system and method for malware detection uses static and dynamic analysis to augment a machine learning model. At the training step, static and dynamic features are extracted from training datasets and used to train a malware classification model. The malware classification model is used to classify unknown files based on verdicts from both static and dynamic models.

Augmented machine learning malware detection based on static and dynamic analysis

A system and method of anti-malware analysis including iterative techniques that combine static and dynamic analysis of untrusted programs or files. These techniques are used to identify malicious files by iteratively collecting new data for static analysis through dynamic run-time analysis.

Growing community of inventors

Singapore, Singapore

Sergey Ulasen