Ca, Inc.

Symantec Corporation

Nortonlifelock Inc.

Slawomir Grzonkowski

Aditya Kuppa

Lamine Aouad

Yun Shen

David Luz Silva

Pierre-Antoine Vervier

Johann Roturier

Pratyush Banerjee

Dylan Morss

Alejandro Mosquera Lopez

Piotr Krysiuk

Sidharth Pipriya

Knowledge-aware detection of attacks on a client device conducted with dual-use tools. A method may include obtaining dual-use tool data related to a plurality of dual-use tools; collecting from a client device, by the computing device, user input related to the use of a dual-use tool of the plurality of dual-use tools; determining that the user input contains a feature of the dual-use tool data; creating a behavioral index of the user input, the behavioral index stored on the client device; detecting new input on the client device; determining a similarity level between the user input and the new input; flagging a malicious attack on the client device based on determining that the similarity level does not satisfy a pre-determined threshold; and implementing a security action on the client device based on flagging the malicious attack.

Knowledge-aware detection of attacks on a client device conducted with dual-use tools

Identifying and protecting against an attack against an anomaly detector machine learning classifier (ADMLC). In some embodiments, a method may include identifying training data points in a manifold space for an ADMLC, dividing the manifold space into multiple subspaces, merging each of the training data points into one of the multiple subspaces, training a subclassifier for each of the multiple subspaces to determine a decision boundary for each of the multiple subspaces between normal training data points and anomalous training data points, receiving an input data point into the ADMLC, determining whether the input data point is an attack on the ADMLC due to a threshold number of the subclassifiers classifying the input data point as an anomalous input data point, and, in response to identifying the attack against the ADMLC, protecting against the attack.

Identifying and protecting against an attack against an anomaly detector machine learning classifier

A computer-implemented method for detecting and protecting against malicious use of legitimate computing-system tools may include (i) identifying a computing-system tool that can perform benign actions and malicious actions on a computing system, (ii) creating a set of recorded actions by recording actions performed by the computing-system tool on the computing system over a predetermined period of time, (iii) analyzing the set of recorded actions via a machine learning method that, for each action in the set of recorded actions, determines whether the action is anomalous compared to other actions in the set, (iv) classifying an action in the set of recorded actions as malicious based at least in part on determining that the action is anomalous, and (v) initiating, in response to classifying the action as malicious, a security action related to the action. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting and protecting against malicious use of legitimate computing-system tools

The disclosed computer-implemented method for detecting anomalous system command line data may include (i) receiving command line data from a target computing system, (ii) building a baseline model that utilizes machine-learning to analyze the command line data, the baseline model comprising a support-vector machine (SVM), natural language processing, and a hashing function, (iii) assigning, utilizing the baseline model, a score to each of a plurality of instances of the command line data, and (iv) identifying, based on the score, anomalous commands comprising potentially malicious data when any of the instances of the command line data fails to exceed a threshold. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting anomalous system command line data

The disclosed computer-implemented method for detecting anomalous behavior within computing sessions may include (i) identifying, by the computing device, a set of execution events that correspond to a computing session, (ii) providing, by the computing device, the set of execution events as input to an autoencoder, (iii) receiving, by the computing device and from the autoencoder, a reconstruction error associated with autoencoding the set of execution events, (iv) detecting, by the computing device and based on the reconstruction error, an anomaly within the computing session, and (v) performing, by the computing device, a security action to address the anomaly within the computing session. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting anomalous behavior within computing sessions

Methods and systems are provided for generating a security profile for a new computing system. One example method generally includes obtaining, over a network, information associated with a plurality of existing computing systems and generating, by a clustering algorithm, a set of clusters based on the information associated with the plurality of existing computing systems. The method further includes obtaining external data associated with the computing system and classifying the computing system into a cluster in the set of clusters based on the external data associated with the computing system. The method further includes determining the security profile based on statistics associated with the cluster and transmitting, over the network, an indication of the security profile.

Method to assess internal security posture of a computing system using external variables

The disclosed computer-implemented method for efficiently matching files may include (i) analyzing a file to identify a set of functions within the file and relationships between functions within the set of functions, (ii) creating a set of representations for the set of functions by, for each function, combining a representation of a size of the function with a representation of a size of each function identified, when analyzing the file, as having a relationship to the function, (iii) comparing the set of representations of the set of functions with a set of representations of an additional set of functions identified within an additional file, and (iv) determining, based on comparing the sets of representations, that the file matches the additional file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for efficiently matching files

A computer-implemented method for detecting webpages belonging to spam campaigns may include (1) identifying a web address of a suspicious webpage that potentially hosts a spam message, (2) capturing an image of the suspicious webpage, (3) comparing the image of the suspicious webpage to at least one spam image from a spam database, the spam image being associated with a spam campaign in the spam database, (4) determining, based on the comparison of the image of the suspicious webpage with the spam image, whether the suspicious webpage is associated with the spam campaign, and (5) updating the spam database in response to the determination of whether the suspicious webpage is associated with the spam campaign. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting webpages belonging to spam campaigns

Each node of a metric tree comprises a similarity hash of a member of a dataset of known message threats, calculated using a given similarity hashing algorithm. The nodes are organized into the tree, positioned such that the differences between the similarity hashes are represented as distances between the nodes. Messages are received and tested to determine whether they are malicious. When a message is received, a similarity hash of the message is calculated using the same similarity hashing algorithm that is used to calculate the hashes of the members of the dataset. The tree is searched for a hash of a known message threat that is within a threshold of distance to the hash of the received message. Searching the tree can take the form of traversal from the root node, to determine whether the tree contains a node within the similarity threshold.

Growing community of inventors

Dublin, Ireland

Slawomir Grzonkowski