Microsoft Technology Licensing, LLC

Shay Kels

Jonathan Bar Or

Corina Feuerstein

Amir Kutcher

Arie Agranonik

Efim Hudis

Royi Ronen

Elad Ziklik

Yair Tsarfaty

Amir Rubin

Tomer Brand

Charles Edouard Elie Bettan

Itai Kollmann Dekel

Ofer Raz

Peleg Hadar

Moran Neuhof

Techniques are described herein that are capable of detecting a spoofed entity based on complexity of a distribution of events initiated by the spoofed entity. Frequencies with which events of event types are initiated are determined by an entity during a designated period of time. Complexity of a distribution of the events among the event types is determined based at least on the frequencies with which the events of the event types are initiated by the entity during the designated period of time. Based at least on the complexity of the distribution of the events among the event types being less than or equal to a complexity threshold, the entity is identified as a spoofed entity associated with a spoofing attack. A security action is performed with regard to the entity based at least on the entity being identified as the spoofed entity associated with the spoofing attack.

Detecting a spoofed entity based on complexity of a distribution of events initiated by the spoofed entity

Some embodiments help protect an organization against ransomware attacks by combining incrimination logics. An organizational-level incrimination logic helps detect alert spikes across many machines, which collectively indicate an attack. Graph-based incrimination logics help detect infestations of even a few machines, and local incrimination logics focus on protecting respective individual machines. Graph-based incrimination logics may compare monitored system graphs to known ransomware attack graphs. Graphs may have devices as nodes and device network connectivity, repeated files, repeated processes or actions, or other connections as edges. Statistical analyses and machine learning models may be employed as incrimination logics. Search logics may find additional incrimination candidates that would otherwise evade detection, based on files, processes, IP addresses, devices, accounts, or other computational entities previously incriminated. Incrimination engine results are forwarded to endpoint protection systems, intrusion protection systems, authentication controls, or other intervention mechanisms to enhance monitored system security.

Organization-level ransomware incrimination

Embodiments of the present disclosure provide systems, methods, and non-transitory computer storage media for identifying malicious behavior using a trained deep learning model. At a high level, embodiments of the present disclosure utilize a trained deep learning model that takes a sequence of ordered signals as input to generate a score that indicates whether the sequence is malicious or benign. Initially, process data is collected from a client. After the data is collected, a virtual process tree is generated based on parent and child relationships associated with the process data. Subsequently, embodiments of the present disclosure aggregate signal data with the process data such that each signal is associated with a corresponding process in a chronologically ordered sequence of events. The ordered sequence of events is vectorized and fed into the trained deep learning model to generate a score indicating the level of maliciousness of the sequence of events.

Deep learning-based analysis of signals for threat detection

Embodiments of the present disclosure provide systems, methods, and non-transitory computer storage media for detecting abnormal behavior of device in an enterprise network based on an analysis of behavioral information of the device's neighbors in network. At a high level, embodiments of the present disclosure employ a hive-mind approach to determine anomalous behavior of a device in a network based on analyzing behavior information reported by neighboring devices within the network. Embodiments identify that a device is alive and connected within the network based on multiple neighboring devices reporting behavioral information about the device; however, the device may be dysfunctional and failing to report its own information. By aggregating and analyzing behavioral information of a device based on the reporting information of its neighboring devices, embodiments of the present disclosure are able to determine whether a device is healthy even when the device is unable to report its own information.

Dysfunctional device detection tool

Disclosed herein is a system and method for automatically identifying potential malware files or benign files in files that are not known to be malware. Vector distances for select features of the files are compared to vectors both known malware files and benign files. Based on the distance measures a malware score is obtained for the unknown file. If the malware score exceeds a threshold a researcher may be notified of the potential malware, or the file may be automatically classified as malware if the score is significantly high.

Matrix factorization for automated malware detection

Growing community of inventors

Givatayim, Israel

Shay Kels