Amazon Technologies, Inc.

Thibault Candebat

Jon Arron McClintock

David Erdmann

Karl Andre McCabe

Adam Cecchetti

Eric J Martin

David James Kane-Parry

Aridaman Tripathi

Nima Sharifi Mehr

Scott Gerard Carmack

Narasimha Rao Lakkakula

William Frederick Kruse

Sachin Purushottam Joglekar

Alun Jones

Sunu Aby Mathew

Shailendra Batra

A robust digital fingerprint of a file ensures that one able to produce the robust digital fingerprint has possession of the file. A client obtains information that is unpredictable to the client and uses that information to modify the file and generate a robust digital fingerprint from the modified file. A server, with access to the same unpredictable information, verifies the generated robust digital fingerprint. An algorithm for generating the robust digital fingerprint has a property that different representations of the same content will produce matching digital fingerprints.

Proving file ownership

Disclosed are various systems, methods, and other embodiments directed to detection of malware in content items. To detect the malware, for example, one or more content items are identified in association with the rendering of a network page in a simulated environment. A plurality of tests are applied to the one or more content items to detect an existence of malware associated with the content items.

Detecting malware in content items

A secure and efficient technique to prevent cross-site scripting attacks based on segregating the content within a given content page among independent endpoints, or servers, where static content is provided from one endpoint and active content is provided from another endpoint. Together, the different endpoints make up an endpoint segregation system. Further, security features of HTTP/HTML are used to restrict sources from which active content may be executed according to the division of static and active content among the endpoints of the endpoint segregation system.

Endpoint segregation to prevent scripting attacks

A secure and efficient technique to prevent cross-site scripting attacks based on segregating the content within a given content page among independent endpoints, or servers, where static content is provided from one endpoint, active content for downloading a filtering component to enforce filtering of content passed to active content methods is provided from a loader endpoint, and active content is provided from an active content endpoint. Together, the different endpoints make up an endpoint segregation system. Further, security features of HTTP/HTML are used to restrict sources from which active content may be executed according to the division of static and active content among the endpoints of the endpoint segregation system.

Techniques are described for automatically determining application composition and application ownership of an application that may include a plurality of files deployed to a plurality of host devices. The determination of application composition may be based on analyzing various types of metadata that may provide evidence of associations between deployed files, such as metadata describing the deployment of files to host devices, metadata describing the files tracked within a source control system, or other types of metadata. The determination of application ownership may also be based on analyzing the various types of metadata that provide evidence of associations between files and individuals or groups of individuals within an organization.

Determining application composition and ownership

Techniques are described for identifying security credentials or other sensitive information by creating a dictionary of data elements included in documents such as source code files, object code files, or other types of files. The data elements may be identified for inclusion in the dictionary based on parsing the documents for delimiter characters, and based on the context of the data elements within the documents. The data elements may also be identified through an entropy-based analysis to detect portions of the documents exhibiting a high degree of entropy compared to a baseline entropy for the documents. The dictionary may be used in a dictionary attack against various systems to determine whether any of the data elements included in the dictionary enable access the systems. The data elements that enable access may be designated as sensitive information hard-coded into the documents.

Dictionary generation for identifying coded credentials

Techniques are described for identifying security credentials or other sensitive information based on an entropy-based analysis of information included in documents such as source code files, object code files, or other types of files. A baseline information entropy may be determined for one or more documents, indicating a baseline level of randomness for information in the document(s). One or more of the documents may be analyzed to identify the presence of high entropy portions that have an information entropy above a threshold value. The threshold value may be based on the baseline information entropy, or based on other criteria such as a programming language of the document(s). Because security credentials may have a higher level of information entropy than the surrounding code, any high entropy portions of the document(s) may be identified as potential security risks.

Entropy-based detection of sensitive information in code

Disclosed are various systems, methods, and other embodiments directed to detection of malware in content items. To detect the malware, for example, an environment is simulated in a computing device configured to render a network page having a container for content placement. The existence of malware in a content item is detected in the computing device by implementing a rendering of the network page in the environment with the content item inserted in the container to detect an unauthorized action by the content item.

Growing community of inventors

Saint Germain-en-Laye, France

Thibault Candebat