Sophos Limited

Mcafee, Inc.

Simon Neil Reed

Kenneth D Ray

Andrew James Thomas

Mark David Harris

Neil Robert Tyndale Watkiss

Robert Wendell Cook

Russell Humphries

Joshua Daniel Saxe

Joseph H Levy

Daniel Salvatore Schiappa

Dmitri Samosseiko

Karl Ackerman

Harald Schütz

John Edward Tyrone Shaw

Anthony John Merry

Guy Roberts

Fraser Howard

Erik Jan Loman

Ross McKerchar

Christopher Barton

Martin Alan Brown

Gabor Szappanos

Peter Adam Mackenzie

Marc Ashley McGinnis

James Gordon Wilson

A threat management application is decoupled into a backend tier deployed at a regional compute resource of a cloud environment and a frontend tier deployed at one or more local compute resources of the cloud environment. A threat lookup request is routed from an endpoint to a frontend tier deployed at a respective local compute resource. The frontend tier determines if a local threat response is available within a cache of the respective local compute resource. If the local threat response is available, the local threat response is provided to the endpoint. If the local threat response is not available, the threat lookup request is forwarded from the respective local compute resource to the backend tier deployed at the regional compute resource.

Self-optimizing deployment of decoupled threat management applications within cloud environments

Malware detections are received from a plurality of endpoints in one or more enterprise networks. A first and second set of indicators of breach may be identified from the malware detections and, where appropriate, grouped by specific customers. The pattern of progressive deployment of malware directed toward a customer can then be used as a basis for identifying generalized targeting of the customer, or extended staging for a specific attack on the customer such as a ransomware attack.

Early malware detection

An automated system attempts to characterize code as safe or unsafe. For intermediate code samples not placed with sufficient confidence in either category, human-readable analysis is automatically generated to assist a human reviewer in reaching a final disposition. For example, a random forest over human-interpretable features may be created and used to identify suspicious features in a manner that is understandable to, and actionable by, a human reviewer. Similarly, a k-nearest neighbor algorithm may be used to identify similar samples of known safe and unsafe code based on a model for, e.g., a file path, a URL, an executable, and so forth. Similar code may then be displayed (with other information) to a user for evaluation in a user interface. This comparative information can improve the speed and accuracy of human interventions by providing richer context for human review of potential threats.

Computer augmented threat evaluation

Malware uses various techniques to detect a sandbox environment so that malicious code can avoid execution in closely monitored contexts that might otherwise trigger detection and remediation. A security system is dynamically updated to exploit these anti-sandbox techniques, e.g., by causing endpoints to mimic sandbox environments in a manner that discourages malware execution on the endpoint, and by updating sandboxes to alter or hide sandbox detection triggers.

Dynamic sandbox scarecrow for malware management

An endpoint in an enterprise network is monitored, and when a potential trigger for a distributed denial of service (DDoS) attack is followed by an increase in network traffic from the endpoint to a high reputation network address, the endpoint is treated as a DDoS service bot and isolated from the network until remediation can be performed.

Detecting triggering events for distributed denial of service attacks

An ensemble of detection techniques are used to identify code that presents intermediate levels of threat. For example, an ensemble of machine learning techniques may be used to evaluate suspiciousness based on binaries, file paths, behaviors, reputations, and so forth, and code may be sorted into safe, unsafe, intermediate, or any similar categories. By filtering and prioritizing intermediate threats with these tools, human threat intervention can advantageously be directed toward code samples and associated contexts most appropriate for non-automated responses.

Computer assisted identification of intermediate level threats

Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

Using indications of compromise for reputation based network security

In one aspect, a method for securing a device includes receiving a first set of boot information of a device, receiving a first cryptographic proof of the first set of boot information, receiving a second set of boot information of the device, receiving a second cryptographic proof of the second set of boot information, comparing the first set of boot information and the second set of boot information, and, upon determining that the first set of boot information and the second set of boot information are different, determining whether differences between the first set of boot information and the second set of boot information are permitted. The method may also include generating an alert upon determining that differences between the first set of boot information and the second set of boot information are not permitted.

Boot security

Labeling computing objects for improved threat detection

Labeling objects on an endpoint for encryption management

In one aspect, a method for securing a device includes receiving a first set of boot information from a first device, the first set of boot information including a first list of boot items, receiving from the first device a first proof based on the first set of boot information, verifying the first set of boot information based on the first proof, determining a reputation for one or more of the boot items in the first list of boot items. and reporting the determined reputation. In one aspect, a method for securing a device includes receiving a first set of boot information of a device, receiving a first cryptographic proof of the first set of boot information, receiving a second set of boot information of the device, receiving a second cryptographic proof of the second set of boot information, comparing the first set of boot information and the second set of boot information, and upon determining that the first set of boot information and the second set of boot information are different, determining whether differences between the first set of boot information and the second set of boot information are permitted, and generating a report or an alert upon determining that differences between the first set of boot information and the second set of boot information are not permitted.

Threat detection using a time-based cache of reputation information on an enterprise endpoint

Growing community of inventors

Wokingham, United Kingdom

Simon Neil Reed