Symantec Corporation

Google Inc.

Yin Liu

Kevin Alejandro Roundy

Sandeep B Bhatkar

Christopher Gates

Anand Kashyap

Leylya Yumer

Aleatha Parker-Wood

Michael Andrew Hart

Jason Franklin

Systems, devices, methods and other techniques for assessing data leakage risks in a computing environment. A computing system receives interaction data and query data for a party. The system determines dimension combinations represented in the interaction data and identifies, for each query described in the query data, each dimension combination that appears in a result to the query. The system generates, for each dimension combination, a query membership tag that identifies each query for which the dimension combination appears in a result to the query. The system determines, for each unique query membership tag, a count of a number of entities that are associated in the interaction data with any interaction having a dimension combination that corresponds to the query membership tag. The system assesses a data leakage risk for the party based on the counts for one or more unique query membership tags.

Assessing data leakage risks

The disclosed computer-implemented method for identifying non-malicious files on computing devices within organizations may include (1) identifying a file on at least one computing device within multiple computing devices managed by an organization, (2) identifying a source of the file based on examining a relationship between the file and the organization, (3) determining that the source of the file is trusted within the organization, and then (4) concluding, based on the source of the file being trusted within the organization, that the file is not malicious. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying non-malicious files on computing devices within organizations

The disclosed computer-implemented method for determining the trustworthiness of files within organizations may include (1) identifying a file on a computing device within multiple computing devices managed by an organization, (2) in response to identifying the file, identifying at least one additional computing device within the multiple computing devices that is potentially associated with the file, (3) distributing at least a portion of the file to a user of the additional computing device with a request to receive an indication of the trustworthiness of the file, and then (4) receiving, from the additional computing device, a response that indicates the trustworthiness of the file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for determining the trustworthiness of files within organizations

Techniques are disclosed for dynamically managing hardening policies in a client computer (e.g., of an enterprise network). A hardening management application monitors activity on the client computer that is associated with a first hardening policy. The monitored activity is evaluated based on one or more metrics. Upon determining that at least one of the metrics is outside of a tolerance specified in the first hardening policy, the client computer is associated with a second hardening policy. The client computer is reconfigured based on the second hardening policy.

Practical and dynamic approach to enterprise hardening

The disclosed computer-implemented method for dynamic access control over shared resources may include (1) detecting an attempt by a user to access a resource via a computing environment, (2) identifying a risk level of the user attempting to access the resource, (3) identifying a sensitivity level of the resource, (4) identifying a risk level of the computing environment through which the user is attempting to access the resource, (5) determining an overall risk level for the attempt to access the resource based at least in part on (A) the risk level of the user, (B) the sensitivity level of the resource, and (C) the risk level of the computing environment, and then (6) determining, based at least in part on the overall risk level, whether to grant the user access to the resource via the computing environment. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for dynamic access control over shared resources

A computer-implemented method for creating security profiles may include (1) identifying, within a computing environment, a new actor as a target for creating a new security behavior profile that defines expected behavior for the new actor, (2) identifying a weighted graph that connects the new actor as a node to other actors, (3) creating, by analyzing the weighted graph, the new security behavior profile based on the new actor's specific position within the weighted graph, (4) detecting a security anomaly by comparing actual behavior of the new actor within the computing environment with the new security behavior profile that defines expected behavior for the new actor, and (5) performing, by a computer security system, a remedial action in response to detecting the security anomaly. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for creating security profiles

The disclosed computer-implemented method for threat detection using a software program update profile may include (1) building an update behavioral model that identifies legitimate update behavior for a software application by (a) monitoring client devices for update events associated with the software application and (b) analyzing the update events to identify the legitimate update behavior of the software application, (2) using the update behavioral model to identify suspicious behavior on a computing system by (a) detecting an update instance on the computing system, (b) comparing the update instance with the legitimate update behavior identified in the update behavioral model, and (c) determining, based on the comparison of the update instance with the legitimate update behavior, that the update instance is suspicious, and (3) in response to determining that the update instance is suspicious, performing a security action. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for threat detection using a software program update profile

A computer-implemented method for profiling a web application. A web page containing JavaScript (JS) is crawled. At least a portion of the JS is extracted from the crawled web page. An automated simulation of the extracted JS is executed.

Systems and methods for profiling web applications

A method and apparatus for automatic anomaly detection based on profile history and peer history are described. An anomaly detection system collects file-activity data pertaining to file accesses activities in a network share. The system computes file access patterns for the individual users and compares the individual user's file access pattern against a profile history to find a first deviation. The system also identifies a cluster of users from the group based on at least one of user collaborations of individual users of the group or a reporting structure of the group of users. When the first deviation is found, the system compares the user's file access pattern against a peer history of the other individual users in the cluster to find a second deviation. The system reports an anomaly in the file access patterns by the individual user when the first deviation and the second deviation are found.

Anomaly detection based on profile history and peer history

A computer-implemented method for managing access-control groups. The method may include (1) tracking users' access patterns to one or more shared resources, (2) analyzing the users' access patterns to identify a cluster of users who exhibit similar access patterns to the one or more shared resources, (3) identifying a preexisting access-control group to which one or more of the users is assigned, (4) comparing the preexisting access-control group to the cluster of users, and (5) organizing, based on the comparison, one or more of the users into one or more access-control groups. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing access-control groups

Techniques for web application vulnerability scanning are disclosed. In one particular embodiment, the techniques may be realized as a method for web application vulnerability scanning comprising crawling a web application for content associated with the web application, generating a client security policy based on the content associated with the web application, and scanning the web application for vulnerabilities based on the client security policy.

Techniques for web application vulnerability scanning

A computer-implemented method for analyzing client-side storage security for Internet applications may include 1) identifying an interactive Internet resource, 2) identifying at least one input field for entering sensitive data within the interactive Internet resource, 3) identifying at least one instance of local client-side storage performed by the interactive Internet resource by simulating at least one interaction with the interactive Internet resource, and 4) comparing the instance of local client-side storage with a content of the input field to determine that the interactive Internet resource performs local client-side storage of sensitive data. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Sunnyvale, CA, United States of America

Yin Liu