Mcafee, Inc.

Other

Networks Associates Technology, Inc.

Tenable, Inc.

Corekt Security Systems, Inc.

Yona Hollander

Oded Horovitz

Ophir Rachman

Shmuel Sagiv

Matan Hart

Itamar Yaakov Mizrahi

Ophir Rahman

Ury Segal

System, device, and method of determining cyber-attack vectors and mitigating cyber-attacks. A method includes: scanning and mapping a network, and collecting data about network elements; generating a Permissions Directed-Graph, which indicates permissions that each network element has; generating a Network Connectivity Directed-Graph, which indicates accessible direct-communication routes between network elements; obtaining a list of attack techniques; applying a Static Verification process on the list of attack techniques, to generate an initial version of an Attacks Directed-Graph which maps particular attacks to network elements that are represented in the Permissions Directed-Graph and in the Network Connectivity Directed-Graph; performing a Dynamic Verification process, and constructing an updated list of dynamically-verified Attack Vectors that were verified as available within a particular operational context; generating a ranking for each dynamically-verified Attack Vector; prioritizing the dynamically-verified Attack Vectors, and prioritizing threat mitigation resources; activating threat mitigation resources based on the prioritization outputs.

System, device, and method of determining cyber attack vectors and mitigating cyber attacks

A system, method, and computer program product are provided for virtual patching. Initially, information associated with at least one vulnerability of a computer application is collected. Further, at least one host interface is identified that is capable of being used to access the vulnerability. In use, data sent to the at least one host interface is analyzed to determine whether the data is unwanted, based on the information.

System, method and computer program product for virtual patching

A system, method and computer program product are provided which are capable of intercepting a call. Once intercepted, it is determined whether the call is associated with a previous sequence of calls in order to identify a correct sequence of calls associated with the intercepted call. Next, the call is associated with the correct sequence of calls. State information that is associated with the call is then gathered. Further, sequence state information is updated, and it is determined whether a process is unwanted based, at least in part, on such sequence state information. If it is determined that the process is unwanted, a reaction may be made to the unwanted process. If it is not determined that the process is unwanted, a next call may be intercepted, and so on.

System, method and computer program product for detection of unwanted processes

A method of intercepting application program interface, including dynamic installation of associated software, within the user portion of an operating system. An API interception control server in conjunction with a system call interception module loads into all active process spaces an API interception module. An initializer module within the API interception module hooks and patches all API modules in the active process address space. When called by the application programs, the API routines' flow of execution, by virtue of their patched code, is re-directed into a user-supplied code in a pre-entry routine of the API interception module. The API routine might be completely by-passed or its input parameters might be filtered and changed by the user code. During the operation, the API routine is double-patched by the API interception module to ensure that all simultaneous calls to the API routine will re-direct its flow of control into the API interception module. A user-supplied code in a post-entry module of the API interception module might filter or change the return values of the API.

Application program interface interception system and method

Method and system for intercepting an application program interface

A method for detecting and preventing unauthorized or illegal attempts to gain enhanced privileges within a computing environment by exploiting the buffer overflow-related weakness of the computer system.

Method for secure function execution by calling address validation

Method for detecting buffer overflow weakness exploitation, including the steps of determining a plurality of threshold parameters, each respective to a buffer overflow weakness exploitation event, analyzing a code to be executed, thereby producing a plurality of validation values, comparing said validation values to the respective ones of the threshold parameters, and determining a buffer overflow weakness exploitation attempt, when at least one of the validation values exceeds the respective one of the threshold parameters.

Growing community of inventors

Tel Aviv, Israel

Yona Hollander