Ao Kaspersky Lab

Kaspersky Lab, Zao

Kasperksy Lab, Zao

Vladislav V Martynenko

Mikhail A Pavlyushchik

Alexey V Monastyrsky

Yuri G Slobodyanuk

Alexey M Romanenko

Andrey V Sobko

Victor V Yablokov

Anton V Tikhomirov

Sergey Y Golovanov

Vyacheslav E Rusakov

Konstantin V Sapronov

Andrey Y Solodovnikov

Denis A Nazarov

Pavel N Yarykin

Ivan I Tatarinov

Alexander V Kalinin

Sergey V Dobrovolsky

Alexey A Polyakov

Roel Schouwenberg

Disclosed are systems and methods for countering a cyber-attack on computing devices by means of which users are interacting with services, which store personal data on the users. Data is collected about the services with which the users are interacting by means of the devices, as well as data about the devices themselves. The collected data is analyzed to detect when a cyber-attack on the devices is occurring as a result of a data breach of personal data on users from the online service. A cluster of the computing devices of different users of the online service experiencing the same cyber attack is identified. Attack vectors are identified based on the characteristics of the cyber attack experienced by the computing devices in the cluster. Actions are selected for countering the cyber-attack based on the identified attack vector and are sent to the devices of all users of the corresponding cluster.

System and method for determining actions to counter a cyber attack on computing devices based on attack vectors

Disclosed are systems and methods for adapting a pattern of dangerous behavior of programs. A teaching module may load into an activity monitor the pattern and establish a first usage mode for it, during which the activity monitor detects threats that correspond to that pattern, but does not perform actions for their removal. Later, in the course of a teaching period, the activity monitor detects threats based on the detection of events from the mentioned pattern. If the events have occurred as a result of user actions, and the events have a recurring nature or are regular in nature, the teaching module adds parameters to the pattern which exclude from subsequent detection those events or similar events. Upon expiration of the teaching period, the teaching module converts the pattern of dangerous behavior of programs to the second usage mode, during which threats are detected using the modified pattern and removed.

System and method for adapting patterns of malicious program behavior from groups of computer systems

Systems and methods for countering a cyber attack on computing devices used by users gather data about services with which users are interacting, as well as data about devices used by users for such interactions. The collected data is analyzed to detect when a cyber-attack on the devices is occurring as a result of a data breach of personal data on users from at least one service. Actions are selected for countering the cyber-attack and are sent to the devices of all users of the corresponding cluster in the event that a match is found in the characteristics of the attack vector for at least one device of another user whose devices belong to the corresponding cluster.

System and method of countering an attack on computing devices of users

System and method of adapting patterns of dangerous behavior of programs to the computer systems of users

Online transaction security is improved by detecting a start of an online financial transaction between a user-controlled online transaction application and a remote payment service. A protected data input module, a protected environment module, and a safe data transfer module each provides a corresponding set of protection operations. A risk level of conducting the financial transaction is assessed based on a vulnerability assessment and on present condition of the local computing system. An initial degree of protection for each of the modules is set, and subsequently adjusted based on the risk level.

System and method for ensuring safety of online transactions

Disclosed are systems and methods for protecting electronic money transactions from fraud and malware. An exemplary method include scanning a computer to detect software objects associated with electronic money that includes at least one of a wallet configured to store electronic money, an electronic money generating application, and data including an interaction history with an electronic exchange for electronic money; identifying and adjusting electronic money security modules configured to provide data security to the detected software objects associated with the electronic money; and executing, by the adjusted electronic money security modules, at least one electronic money transaction involving the electronic money. In one aspect, the electronic money security modules include a wallet protection module, a malware detection module, and a traffic control module.

System and method for protecting electronic money transactions

System for updating filtering rules for messages received by a plurality of users including a filtering rules database storing filtering rules for the users; means for distributing the filtering rules to the users; a user reputation database comprising a reputation weight for each user; and means for receiving and processing of user reports that indicate that a message belongs to a particular category. The means for receiving (i) calculates a message weight in its category based on a number of reports received from multiple users and a reputation weights of those users, (ii) decides whether the message belongs to the particular category if the message weight exceeds a predefined threshold, (iii) updates the filtering rules in the filtering rules database based on the deciding, and (iv) distributes the updated filtering rules from the filtering rules database to the users using the means for distributing.

System and method for filtering spam messages based on user reputation

Among a plurality of virtual machines running on a host system are a set of virtual machines that provide an operating system, a lightweight agent module, and user applications to be executed. Also, a special-purpose virtual machine executes a central security module. The central security module performs security-related tasks on behalf of individual ones of the other virtual machines, and includes a malware remediation module that generates malware remediation instructions to be executed by the respective virtual machines. The central security module also assesses a capability of a first instruction sequence execution module of a first lightweight agent module to effectively execute the malware remediation instructions, and provides an advanced security task execution component to be installed in a first virtual machine corresponding to the first lightweight agent module, in response to an assessment of capability of the first lightweight agent module being insufficient to execute the malware remediation instructions.

Security architecture for virtual machines

A method for asynchronous processing of system calls, including detecting a system call on a computer system; filtering the system call to determine when the system call call matches a filter parameter; making a copy of the system call and asynchronously asynchronously processing the system call copy, if the system call does not pass through at through at least one filter, and the filter parameter does not match the system call; placing placing the system call into a queue; releasing the system call after an anti-virus (AV) (AV) check of the system call copy and terminating an object that caused the system call call when the AV check reveals that the system call is malicious; and for an object associated with the system call that has behavior differences compared to a previous known known non-malicious version of the object but also similarities to the previous known non-known non-malicious object, classifying the object as non-malicious.

Asynchronous filtering and processing of events for malware detection

System and method for detecting ransomware. A current user behavior pattern is monitored based on user input via a user input device. The user behavior is compared against a reference set of behavior patterns associated with user frustration with non-responsiveness of the user interface module. A current status pattern of the operating system is also monitored. The current status pattern is compared against a reference set of operating system status patterns associated with predefined ransomware behavior. In response to indicia of current user frustration with non-responsiveness of the user interface, and further in response to indicia of the current status pattern having a correlation to the predefined ransomware behavior, an indication of a positive detection of ransomware executing on the computer system is provided.

System and method for detecting malware that interferes with the user interface

A system, method and computer program product for malware detection based on the behavior of applications running on a computer system, including: asynchronous processing of system events for malware threat analysis using application filters; analyzing events using heuristic and signature data; analyzing applications behavior and detecting abnormal behavior of 'clean' applications; automatically classifying applications (i.e., detecting new versions) based on behavior analysis; automatically analyzing the reliability of web sites based on behavior triggered by the web site accesses; in enterprise networks, detecting abnormalities in configuration of user computer systems; recognizing a user by his behavior profile and using the profile for an automatic configuration of user applications.

Asynchronous processing of events for malware detection

Disclosed are systems, methods and computer program products for protecting a computer from activities of malicious objects. The method comprises: monitoring events of execution of one or more processes on the computer; identifying auditable events among the monitored events, including events of creation, alteration or deletion of files, events of alteration of system registry, and events of network access by processes executed on the computer; recording the identified auditable events in separate file, registry and network event logs; performing a malware check of one or more software objects on the computer; if an object is determined to be malicious, identifying from the file, registry and network event logs the events associated with the malicious object; performing rollback of file events associated with the malicious object; performing rollback of registry events associated with the malicious object; terminating network connections associated with the malicious object.

System and method for protecting a computer system from the activity of malicious objects

Disclosed are systems, methods and computer program products for detection of malware with complex infection patterns. The system provides enhanced protection against malware by identifying potentially harmful software objects, monitoring execution of various processes and threads of potentially harmful objects, compiling contexts of events of execution of the monitored processes and threads, and merging contexts of related processes and threads. Based on the analysis of the individual and merged object contexts using malware behavior rules, the system allows detection of malicious objects that have simple and complex behavior patterns.

Growing community of inventors

Moscow, Russia

Vladislav V Martynenko