Intel Corporation

Mcafee, Inc.

Steven L Grobman

Jonathan B King

Carl D Woodward

Yonghong Huang

Ned M Smith

Jason W Brandt

Simon R Hunt

Amit Kumar

Kunal Mehta

Sorcha Bairbre Healy

Ryan M Durand

Gerard Donal Murphy

Baiju V Patel

Tobias Max Kohlenberg

David W Grawrock

Craig T Owen

Gal Chanoch

Vedvyas Shanbhogue

Ioannis T Schoinas

Sven Schrecker

Venkata Ramanan Sambandam

Dmitri Rubakha

Eran Birk

Narendar Bahadur Sahgal

Joe R Gruber

Niall Fitzgerald

Uttam K Sengupta

German Lancioni

Victoria C Moore

Michael Kinney

Ofir Arkin

Rajeev Gopalakrishna

Raj Samani

Ryan Permeh

Jillian Anne Daly

Sandeep Thakur

Brian Gaither

Niamh Minihane

Catherine Costigan

Rajeev Gopalakrisha

Carl C Jones

Michael D Kinney

Joe Gruber

Thomas H James

Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus includes at least one memory, instructions, and processor circuitry to execute the instructions. The processor circuitry executes the instructions to identify a test data distribution, generate a first visualization of the identified test data distribution, select a visualization type for a machine learning model, generate a second visualization including an indication of features extracted from the test data by the machine learning model, and generate a third visualization of results of inference performed by the machine learning model, the inference performed on the test data.

Methods and apparatus to visualize machine learning based malware classification

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor circuit and a memory circuit; first means for accessing a machine learning engine; second means for accessing a user interface; and instructions encoded within the memory to instruct the processor to: load into the machine learning engine via the first means an object prevalence model, including an enterprise-specific prevalence model; provide to the machine learning engine an object set from the enterprise; identify an enterprise-novel object from the object set; solicit and receive via the second means user-sourced feedback for the enterprise-novel object; and act according to the user-sourced feedback.

User-sourced object reputations

There is disclosed a computer-implemented system and method of analyzing a batch of objects, including bucketizing the batch of objects into a plurality of buckets according to a feature of the objects; for objects within a batch, performing malware analysis on the objects to assign a malware analysis score, and adjusting the malware analysis score based on the batch; and performing respective security actions on the objects within the batch, based on the adjusted malware analysis score.

Multi-dimensional malware analysis

System, method, and apparatus embodiments for creating, using, and managing protected cryptography keys are described. In an embodiment, an apparatus includes a decoder, an execution unit, and a cache. The decoder is to decode a single instruction into a decoded single instruction, the single instruction having a first source operand to specify encrypted data and a second source operand to specify a handle including a first including ciphertext of an encryption key, an integrity tag, and additional authentication data. The execution unit is to execute the decoded single instruction to perform a first check of the integrity tag against the ciphertext and the additional authentication data for any modification to the ciphertext or the additional authentication data, perform a second check of a current request against one or more restrictions specified by the additional authentication data of the handle, decrypt the ciphertext to generate an encryption key only when the first check indicates no modification to the ciphertext or the additional authentication data and the second check indicates the one or more restrictions are not violated, decrypt the encrypted data with the encryption key to generate unencrypted data, and provide the unencrypted data as a result of the single instruction. The cache is to store the handle, wherein only a portion of the integrity tag is to be used in a lookup of the handle.

Creating, using, and managing protected cryptography keys

There is disclosed in one example a computing apparatus, including: a hardware platform, including a processor, a memory, and a network interface; a bucketized reputation modifier table; and instructions encoded within the memory to instruct the processor to: perform a feature-based malware analysis of an object; assign the object a malware reputation according to the feature-based malware analysis; query and receive via the network interface a complementary score for a complementary property of the object; query the bucketized reputation modifier table according to the complementary score to receive a reputation modifier for the object; adjust the object's reputation according to the reputation modifier; and take a security action according to the adjusted reputation.

There is disclosed in one example a computing apparatus, including: a processor and a memory; a data store having stored thereon trained models Mand M, wherein model Mincludes a clustering model of proximity and prevalence of a first body of computing objects, and Mincludes a clustering model of proximity and prevalence of a second body of computing object; and instructions encoded within the memory to instruct the processor to: receive an object under analysis; apply a machine learning model to compute a global variance score between the object under analysis and M; apply the machine learning model to compute an enterprise variance score between the object under analysis and M; compute from the global variance score and the enterprise variance score a cross-sectional variance score; and assign the object under analysis an analysis priority according to the cross-sectional variance score.

Analysis priority of objects from cross-sectional variance

There is disclosed in one example a computer-implemented method of detecting a statistically-significant security event and automating a response thereto, including: querying, or causing to be queried, a security intelligence database for sector-wise historical norms for an indicator of compromise (IoC); obtaining sector-wise expected prevalence data for the IoC; receiving observed sector-wise prevalence data for the IoC; computing a first test statistic from a goodness-of-fit test between the observed and expected prevalences; from the observed sector-wise prevalence data, computing a second test statistic from a difference between a highest prevalence and a next-highest prevalence; computing a third test statistic from a difference between the observed prevalence of a highest prevalence sector and the expected prevalence for the highest prevalence sector; selecting a least significant statistic from among the first, second, and third test statistics; and determining from the least significant statistic whether to notify a subscriber.

Skewness in indicators of compromise

A method including receiving a feature vector of an unknown sample, computing a MinHash of the unknown sample based on Jaccard-compatible features, querying a Locality Sensitive Hashing forest of known samples with the MinHash of the unknown sample to identify a first subset of known samples that are similar to the unknown sample, receiving for each individual known sample in the first subset, a feature vector including non-Jaccard distance-compatible features, computing a first sub-distance and a second sub-distance between the unknown sample and the known samples in the first subset, calculating a total distance for each known sample in the first subset by combining the first and the second sub-distances, identifying, based on the calculated total distances, a second subset of known samples that are most similar to the unknown sample, and classifying the unknown sample based on the second subset.

Large scale malware sample identification

A method, apparatus, system, and computer program product for domain-authenticated control of platform resources. Resources under the control of the platform are managed in accordance with access control rules that are centrally managed by a directory service. Security policies are uniformly applied by requiring authorization of the user's access to platform resources including hard drives, flash memory, sensors, network controllers and power state controllers.

Domain-authenticated control of platform resources

A first storage device or first storage disk including first executable instructions that, when executed, cause a processor to at least: in response to determining a variable associated with a memory page that (1) has been loaded into local memory from a second storage device and (2) has been accessed from the local memory, has a first state, identify the memory page as a modified memory page, the memory page including second executable instructions. The first instructions also cause the processor to, in response to determining the second executable instructions of the modified memory page have been changed since a previous analysis of the modified memory page, perform anti-malware analysis of at least a portion of the modified memory page.

Detecting execution of modified executable code

In an example, there is a disclosed a computing apparatus, including: a psychological state data interface to receive psychological state data; one or more logic elements, including at least one hardware element, including a verification engine to: receive a requested user action; receive a psychological state input via the psychological state data interface; analyze the psychological state input; and bar the requested user action at least partly responsive to the analyzing.

Verified social media content

There is disclosed in one example a social media server, including: a processor; a trusted input/output (IO) interface to communicatively couple to a consumer device; a network interface to communicatively couple to an enterprise; and a memory having stored thereon executable instructions to instruct the processor to provide a data loss prevention (DLP) engine to: receive via the trusted IO interface a signed and encrypted user posting for the social media service, the user posting including a signed user state report verifying that the user has passed a biometric screening; transmit content of the user posting to the enterprise via the network interface for DLP analysis; receive from the enterprise a notification that the user posting has passed DLP analysis; and accept the user posting.

A technique for detecting malware uses hardware capabilities of the processing element of a programmable device to detect modification of executable code during execution. By monitoring a dirty bit in page tables, pages that have been modified can be detected, allowing analysis of those pages during execution. An indication may then be passed to an anti-malware software to analyze the executable further.

Growing community of inventors

El Dorado Hills, CA, United States of America

Steven L Grobman