Verisign, Inc.

Accenture Global Solutions Limited

Trevor Tonn

Ralph Thomas

Matthew Cote

Gregory S Sinclair

Michael Lapilla

Blake Hartstein

Abedelaziz Mohaisen

Allison Mankin

Ryan Olson

Karthik Shyamsunder

Srinivas Sunkara

Alexander Holmes

James Krahulec

Ray-yu Chang

Abedelaziz Moheisen

A system, method, and computer-readable medium for detecting malicious computer code are provided. Instructions, such as HTML or JavaScript instructions may be received from a server, parsed, and executed. During execution of the instructions, one or more functions of a software application, such as a web browser, may be hooked, and an event object may be created for each called function that is hooked, resulting in a collection of event objects. Rules may be matched with event objects of the collection of event objects to detect malicious code. Attributes from the matched event objects may then be used to locate original malicious script or code injected into a web page.

Systems and methods for detecting malicious code

Systems and methods are provided for malware scanning and detection. In one exemplary embodiment, the method includes a hub computing device that receives, from a controller computing device, a scan request, and identifies spoke computing devices for performing the scan request. The method performed by the hub computing device also includes sending to the identified spoke computing devices, the scan request, receiving, from the spoke computing devices, results associated with the scan request, and sending, to the controller computing device, the results associated with the scan request.

Systems and methods for malware detection and scanning

Techniques for providing information security threat assessment and amelioration are disclosed. The techniques may include obtaining fundamental data, obtaining document data, preparing fundamental instance nodes from the fundamental data, preparing document nodes from the document data, preparing edges between at least some of the nodes, storing the nodes and the edges in a manner that reflects a graph structure, and causing to be displayed at least a portion of a graph defined by at least one node and at least one edge.

Automated intelligence graph construction and countermeasure deployment

A system, method, and computer-readable medium for detecting malicious computer code are provided. A dataset may be accessed and converted to a binary dataset according to a predefined conversion algorithm. One or more cycles in the binary dataset may be identified. Statistical analysis may be performed on the identified one or more cycles. A determination that the set of dataset includes malicious software code may be made based on the performed statistical analysis.

Malicious code detection

Systems and methods are provided for malware scanning and detection in a computing system. In one exemplary embodiment, the method includes launching, in a computing device of the computing system, a virtual machine, and launching, in the virtual machine of the computing device, an internet browser. The method also includes requesting, by the internet browser, data from a web page, and performing, using one or more analysis tools, analysis on the web page. In the method, performing analysis on the web page includes performing monitoring and recording of system application programming interface (API) calls, and creating software objects associated with the web page. The method also includes performing antivirus scanning of the software objects, de-obfuscating JavaScript associated with the software objects, and correlating data associated with the performed analysis to determine if the web page is a malicious web page.

Techniques for providing computer security vulnerability intelligence are disclosed. The techniques include obtaining distributable vulnerability data that includes, for each of a plurality of software packages and associated vulnerabilities, threat mitigation information and a threat priority parameter, where the distributable vulnerability data was derived from an intelligence graph including a plurality of fundamental instance nodes, a plurality of document nodes, and a plurality of edges. The techniques also include identifying installed software packages on a computer system, correlating a plurality of the installed software packages with the distributable vulnerability data to obtain a plurality of installed software packages and associated vulnerabilities, ordering at least some of the plurality of installed software packages and associated vulnerabilities according to threat priority parameters, such that an ordered plurality of installed software packages and associated vulnerabilities is obtained, and providing mitigation information for the ordered plurality of installed software packages and associated vulnerabilities.

Automated vulnerability intelligence generation and application

The present invention generally relates to systems and methods for classifying executable files as likely malware or likely benign. The techniques utilize temporally-ordered network behavioral artifacts together with machine learning techniques to perform the classification. Because they rely on network behavioral artifacts, the disclosed techniques may be applied to executable files with obfuscated code.

Classifying malware by order of network behavior artifacts

Systems and methods are disclosed for identifying objects from a collection of objects of diverse types that match a pattern. In one implementation, a system includes a processor and a memory. The memory stores instructions that cause the processor to receive a pattern input text identifying the pattern to be matched. The pattern input text comprises one or more conditions and a match statement. The processor also receives a collection of objects of diverse types, where each object comprises at least an attribute and a value associated with the attribute. The processor analyzes each object to determine whether the object satisfies the match statement based on an application of the one or more conditions to the attributes and attribute values for the object. If the processor determines that the object satisfies the match statement, the processor creates an output comprising an indication of the object and the conditions that caused the match statement to be satisfied.

Growing community of inventors

McLean, VA, United States of America

Trevor Tonn