Emc IP Holding Company LLC

Emc Corporation

Rsa Security Inc.

Vishnu Chaitanya Pedasingu

Anadi Madhukar

Phaneendra Mouli Ksl

Renjith Damodara Pisharady

Daniel Vernon Bailey

John Philip Bell, Ii

Gaurav Bansal

Siddharth Navare

Rishi Pidva

Methods, apparatus, and processor-readable storage media for automated detection of user device security risks related to process threads and corresponding activity are provided herein. An example computer-implemented method includes obtaining information pertaining to processes running on a user device; obtaining information pertaining to images loaded into at least one memory associated with at least one of the processes running on the user device; obtaining information pertaining to threads created in connection with at least one of the processes running on the user device; automatically identifying at least one of the threads as a security risk by processing the information pertaining to the images and the information pertaining to the threads; and performing at least one automated action based on the identification of at least one of the one or more threads as a security risk.

Automated detection of user device security risks related to process threads and corresponding activity

Methods, apparatus, and processor-readable storage media for generating unique virtual process identifiers are provided herein. An example computer-implemented method includes generating a virtual process identifier for a process within a given network, wherein the virtual process identifier is based at least in part on multiple items of process-related information; associating the virtual process identifier with one or more types of events to be carried out within the given network in connection with the process; filtering repetitive events from a set of processed events carried out in connection with the process, wherein filtering the repetitive events comprises identifying multiple instances of the virtual process identifier associated with multiple instances of the same type of event; and reporting, to at least one server, the processed events remaining subsequent to the filtering step.

Generating unique virtual process identifiers for use in network security mechanisms

Assessing compromises of data security is achieved by establishing access control policies for data files in storage devices across an enterprise. A list is compiled of the data files that were accessed by processes executing on processors of the enterprise. A suspicion score is assigned to each of the processes based on deviations of in-memory behaviors of the processes from established criteria. In response to the suspicion score meeting a suspicious process criterion, the file system operations performed by the suspicious process are analyzed against the access control policies and the suspicion score is modified based on a degree to which the file system operations performed by the suspicious process violate the access control policies.

Context-aware compromise assessment

A method is used in managing data loss prevention policies. A device having data loss prevention (DLP) logic based on policies is provided. An attempt to perform an action that is prohibited by the DLP logic is performed at the device. An override code to allow performance of the action is determined at the device.

Managing data loss prevention policies

Growing community of inventors

Bengaluru, India

Vishnu Chaitanya Pedasingu