Capital One Services, LLC

Other

Stephen Fletcher

Farshid Marbouti

Sarvani Kare

Patrick Sofo

Boshika Tara

Christopher Bayan Bruss

Lei Yu

Baharak Saberidokht

Jakob Kressel

Vannia Gonzalez Macias

Vincent Lotito

Urvish Patel

Methods and systems are described herein for detecting anomalous access to system resources. An anomaly detection system may access system events from one or more computing devices and may generate entries from the system events. Each entry may include a corresponding timestamp indicating a time when a corresponding system event occurred, a corresponding user identifier indicating a user account within a computing environment associated with the corresponding system event, a corresponding location identifier indicating a location within the computing environment, and a corresponding action identifier indicating an action that the user account performed with respect to the location or an object within the computing environment. The generated entries may be aggregated and input into an anomaly detection model to obtain anomalous activity identified by the model.

Anomaly detection in computing system events

In some implementations, a system may receive a shell script associated with a computing device. The system may generate a character frequency feature vector based on the shell script. The system may input text of the shell script to a convolutional neural network (CNN) branch of a trained deep learning model. The system may input the character frequency feature vector to a feedforward neural network (FNN) branch of the trained deep learning model. The system may determine using the trained deep learning model, respective probability scores for each of a plurality of obfuscation types for the shell script based on a combined output of the CNN branch and the FNN branch. The system may detect whether the shell script is obfuscated based on respective probability scores for each of the plurality of obfuscation types determined for the shell script.

Deep learning based detection of malicious shell scripts

Systems and methods enable automated and scalable obfuscation detection in programming scripts, including processing devices that receive software programming scripts and a symbol set. The processing devices determine a frequency of each symbol and an average frequency of the symbols in the script text. The processing devices determine a normal score of each symbol based on the frequency of each symbol and the average frequency to create a symbol feature for each symbol including the normal score. The processing devices utilize an obfuscation machine learning model including a classifier for binary obfuscation classification to detect obfuscation in the script based on the symbol features. The processing devices cause to display an alert indicting an obfuscated software programming script on a screen of a computing device associated with an administrative user to recommend security analysis of the software programming script based on the binary obfuscation classification.

Computer-based systems configured for automated computer script analysis and malware detection and methods thereof

In some implementations, a system may receive a shell script associated with a computing device. The system may generate a character frequency feature vector based on the shell script. The system may input text of the shell script to a convolutional neural network (CNN) branch of a trained deep learning model. The system may input the character frequency feature vector to a feedforward neural network (FNN) branch of the trained deep learning model. The system may determine using the trained deep learning model, a respective probability score for each of a plurality of obfuscation types for the shell script based on a combined output of the CNN branch and the FNN branch. The system may detect whether the shell script is obfuscated based on the respective probability score for each of the plurality of obfuscation types determined for the shell script.

A system including at least one processor; and at least one memory having stored thereon computer program code that, when executed by the at least one processor, controls the at least one processor to: receive an email addressed to a user; separate the email into a plurality of email components; analyze, using respective machine-learning techniques, each of the plurality of email components; feed the analysis of each of the plurality of email components into a stacked ensemble analyzer; and based on an output of the stacked ensemble analyzer, determine whether the email is malicious.

Systems and methods of detecting email-based attacks through machine learning

Anomaly detection in computing computing system events

The present invention provides an apparatus for protecting an instrument, such as a wrist-mounted time keeping instrument, from damage or loss. Lengths of flexible material are used for shielding the attaching band of the instrument from the surrounding environment. The flexible material is formed into a band to encircle the user's limb using a hook and loop fastener. A channel is formed on the underside of the flexible material to hold the attaching band in place and to seal out containments found in the surrounding environment. The apparatus is used without removing or modifying the existing attaching band of the instrument. A cover hides the instrument and also seals the instrument from the surrounding environment. The cover is a stretchable cover which has an open position allowing easy access to the instrument and a closed position which seals the instrument from the surrounding environment. The apparatus provides the advantage of being lockable to the attaching band and the instrument preventing loss and damage but yet is removable therefrom without removing the instrument from the limb of the user. The apparatus has applications with many different types of instruments and in many different applications such as sporting activities and work activities.

Apparatus for protecting watches and the like

An aquarium for housing fish and other aquatic life if formed within a pyramidal housing. The upper portion of the housing is formed of transparent triangular walls which enclose the water for the fish while permitting viewing of the fish. The lower portion of the housing serves as a base for supporting the water, and includes a drawer which holds filtration, heating and aeration equipment while permitting ready access for servicing of the equipment. Lighting is provided by an internal pyramidal light situated at the apex of the housing within the walls, the location permitting lighting of the entire water surface without any significant heating of the walls. All plumbing connections for treatment of the water are made through the floor of the chamber holding the water, thereby avoiding the presence of unsightly hoses and tubing. By the placing of the filtering equipment below the water chamber, the filtering system is able to self-prime, thereby eliminating the process of siphoning in the caring of the aquarium.

Growing community of inventors

Arlington, VA, United States of America

Stephen Fletcher