Trend Micro Inc.

Wen-Kwang Tsao

Chia-Yen Chang

Jonathan James Oliver

Che-Fu Yeh

Fyodor Yarochkin

Federico Maggi

Ping Huan Wu

PingHuan Wu

Jiri Gogela

Hong-Che Lin

Leslie Zsohar

Paul Y Lin

Yun-Chian Cheng

Brandon Niemczyk

Ming-Tai Allen Chang

Chung-Tsai Su

Shih-Han Hsu

Jayson Pryde

Cheng-Hsin Hsu

Yu-Hsuan Chou

I-Ting Lien

Pei-Yin Wu

Chung-Chi Wu

Annie Bu

Mun-Hou Wong

Chien-Yi Chiu

Ping-Huan Wu

Ming-Lun Li

Allen Lai

Paul Christian D Pajares

Po-Yuan Teng

Maria Estella Manly Reyes

Liam Huang

Chin-En Yang

Jaime Yaneza, Jr

Yuan Jiun Tsui

Wei-Zhi Liu

Joseph Cepe

Shih-Yu Chou

Chiaming Chiang

Kuan-Ru Fu

Yi-De Wu

Li-Hsin Hsu

Yu-Kuang Lin

A computer system generates a hierarchical evolutionary tree of digests of sample files. The digests are generated using a locality sensitive hashing function. The digests are grouped into several clusters, and the clusters are grouped into several nodes. The nodes are connected in hierarchical order to generate the hierarchical evolutionary tree. A digest of a file being evaluated for malware is generated using the locality sensitive hashing function. The digest is put in a cluster of the hierarchical evolutionary tree having digests that are most similar to the digest relative to digests of other clusters of the hierarchical evolutionary tree. The digest is identified to be of the same malware family as the digests of the cluster.

Detection and identification of malware using a hierarchical evolutionary tree

A computer network includes a camera node, a network access node, a verification node, and a display node. Video content recorded by a camera at the camera node is transmitted to the display node and to the verification node for verification. The video content is verified at the display node and at the verification node. Recording metadata of the video content is stored in a distributed ledger and retrieved by the display node to verify the video content. The verification node receives, from the network access node, verification data for verifying the video content.

Secure video content transmission over a computer network

A system for stateful detection of cyberattacks includes an endpoint computer and a backend computer system. The endpoint computer monitors for cyberattacks and sends out queries for detected security events. The backend computer system stores observation data that are included in the queries. The backend computer system combines current observation data from a current query, relevant observation data from previous queries, and relevant cybersecurity data. The combined data are evaluated for cyberattacks.

Stateful detection of cyberattacks

Disclosed are a method and system for static behavior-predictive malware detection. The method and system use a transfer learning model from behavior prediction to malware detection based on static features. In accordance with an embodiment, machine learning is used to capture the relations between static features, behavior features, and other context information. For example, the machine learning may be implemented with a deep learning network model with multiple embedded layers pre-trained with metadata gathered from various resources, including sandbox logs, simulator logs and context information. Synthesized behavior-related static features are generated by projecting the original static features to the behavior features. A final static model may then be trained using the combination of the original static features and the synthesized features as the training data. The detection stage may be performed in real time with static analysis because only static features are needed. Other embodiments and features are disclosed.

Method and system for static behavior-predictive malware detection

A cybersecurity system includes sensors that detect and report computer security events. Collected reports of computer security events are formed into state sequences, which are used as training data to train and build a prediction model. A current computer security event is detected and used as an input to the prediction model, which provides a prediction of a next computer security event. A monitoring level of a cybersecurity sensor is adjusted in accordance with the predicted next computer security event.

Computer network monitoring with event prediction

A system for evaluating files for cyber threats includes a machine learning model and a locality sensitive hash (LSH) repository. When the machine learning model classifies a target file as normal, the system searches the LSH repository for a malicious locality sensitive hash that is similar to a target locality sensitive hash of the target file. When the machine learning model classifies the target file as malicious, the system checks if response actions are enabled for the target file. The system reevaluates files that have been declared as normal, and updates the LSH repository in the event of false negatives. The system disables response actions for files that have been reported as false positives.

Evaluation of files for cyber threats using a machine learning model

A global locality sensitive hash (LSH) database stores global locality sensitive hashes of files of different private computer networks. Each of the private computer networks has a corresponding local LSH database that stores local locality sensitive hashes of files of the private computer network. A target locality sensitive hash is generated for a target file of a private computer network. The global and local LSH databases are searched for a locality sensitive hash that is similar to the target locality sensitive hash. The target file is marked for further evaluation for malware or other cybersecurity threats when the target locality sensitive hash is not similar to any of the global and local locality sensitive hashes.

Evaluation of files for cybersecurity threats using global and local file information

An email attempting to perpetrate a business email compromise (BEC) attack is detected based on similarity of the email to a known BEC email and on similarity of the email to a user email that would have been sent by the purported sender of the email. Metadata of the email is extracted and input to a BEC machine learning model to find the known BEC email among BEC email samples. The extracted metadata are also input to a personal user machine learning model of the purported sender to generate the user email.

Detection of business email compromise attacks

A training data set for training a machine learning module is prepared by dividing normal files and malicious files into sections. Each section of a normal file is labeled as normal. Each section of a malicious file is labeled as malicious regardless of whether or not the section is malicious. The sections of the normal files and malicious files are used to train the machine learning module. The trained machine learning module is packaged as a machine learning model, which is provided to an endpoint computer. In the endpoint computer, an unknown file is divided into sections, which are input to the machine learning model to identify a malicious section of the unknown file, if any is present in the unknown file.

Detecting malicious code in sections of computer files

A login page of an online service is received in a user computer. False credentials, such as a false user identifier (ID) and a false password, are entered into the login page to login to the online service. The login page is classified as phishing when the online service does not serve a legitimate login-fail page in response to the entry of the false credentials in the login page.

Login failure sequence for detecting phishing

A system for detecting phishing includes a phishing detection system that generates census of login pages received in different computers of different end users. An end user computer receives a login page and retrieves census information of the login page, such as from the phishing detection system. The census information indicates a number of different end users who employed the login page to log into their respective online accounts. The end user computer reports the census information to the end user of the end user computer. The end user computer reports the census information in numerical, graphical, or other format. The census information of the login page allows the end user to make an informed decision on whether or not to use the login page.

Phishing detection by login page census

A signal processing transformation (wavelet, Fourier, discrete cosine) is applied to a digital image on a mobile device in order to produce a low-level information image and at least one high-level information image. The low-level image is recognizable as the digital image and is kept on the device; all other related images are deleted. The high-level information images are uploaded. The transformation is applied recursively and is dictated by a default setting, calculated from data of the mobile device, or input. To regenerate the original image the device connects to the server and downloads a set of high-level information images or all sets. The low resolution image is combined with the high-level information images using the reverse of the transformation originally applied to produce a higher resolution version of the low resolution image. Successive sets of high-level information images may be recursively applied to generate successively higher resolution images.

Distributed image storage using cloud

A system for locally detecting computer security threats in a computer network includes a processing engine, a fingerprint engine, and a detection engine. Data samples are received in the computer network and grouped by the processing engine into clusters. Clusters that do not have high false alarm rates are passed to the fingerprint engine, which generates fingerprints for the clusters. The detection engine scans incoming data for computer security threats using the fingerprints.

Automatic local detection of computer security threats

Growing community of inventors

Taipei, Taiwan

Wen-Kwang Tsao