Mcafee, Inc.

Intel Corporation

Yonghong Huang

Micah James Sheller

Cory Cornelius

Celeste R Fralick

Jason Martin

Steven L Grobman

Jonathan B King

John Wagener

Amit Kumar

Joanna Negrete

Armando Rodriguez

Adam Wosotowsky

Eric Peterson

Narjala Prakash Bhasker

Raj Vardhan

Shih-Han Wang

Shih-han Wang

Sandeep Chandana

Manoj R Sastry

Liuyang L Yang

Dattatraya Kulkarni

Srikanth Nalluri

Xiruo Liu

Gabriel G Infante-Lopez

Steve Grobman

Sonam Bothra

Noor Abani

Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus includes at least one memory, instructions, and processor circuitry to execute the instructions. The processor circuitry executes the instructions to identify a test data distribution, generate a first visualization of the identified test data distribution, select a visualization type for a machine learning model, generate a second visualization including an indication of features extracted from the test data by the machine learning model, and generate a third visualization of results of inference performed by the machine learning model, the inference performed on the test data.

Methods and apparatus to visualize machine learning based malware classification

Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus to categorize web content includes interface circuitry to receive first results data from a pre-trained model; model tuner circuitry to: determine, based on the first results data, an adjustment to a parameter of the pre-trained model; and provide, via the interface circuitry, the adjustment to the pre-trained model; and feature extractor circuitry to: receive, via the model tuner circuitry, second results data that satisfies a performance threshold; and identify, from the second results data, at least one application specific feature from a tuned version of the pre-trained model.

Methods and apparatus to classify web content

Methods, apparatus, systems, and articles of manufacture are disclosed to implement trusted transfer learning on transformer-based phishing detection. In some examples, an apparatus includes processor circuitry to perform instructions to instantiate circuitry. The instantiated circuitry provides a uniform resource locator (URL) matrix corresponding to at least a portion of a URL address to a first transformer model and provide a web content data matrix corresponding to web content data on a web page at the URL address to a second transformer model. The instantiated circuitry performs data fusion on a first output from the first transformer model and a second output from the second transformer model to create a combined result. The instantiated circuitry determines at least whether phishing is detected at the URL address based at least in part on the combined result.

Methods and apparatus to implement trusted transfer learning on transformer-based phishing detection

There is disclosed a computer-implemented system and method of analyzing a batch of objects, including bucketizing the batch of objects into a plurality of buckets according to a feature of the objects; for objects within a batch, performing malware analysis on the objects to assign a malware analysis score, and adjusting the malware analysis score based on the batch; and performing respective security actions on the objects within the batch, based on the adjusted malware analysis score.

Multi-dimensional malware analysis

There is disclosed in one example a computing apparatus, including: a hardware platform, including a processor, a memory, and a network interface; a bucketized reputation modifier table; and instructions encoded within the memory to instruct the processor to: perform a feature-based malware analysis of an object; assign the object a malware reputation according to the feature-based malware analysis; query and receive via the network interface a complementary score for a complementary property of the object; query the bucketized reputation modifier table according to the complementary score to receive a reputation modifier for the object; adjust the object's reputation according to the reputation modifier; and take a security action according to the adjusted reputation.

Methods, apparatus, systems and articles of manufacture for producing generic Internet Protocol (IP) reputation through cross-protocol analysis are disclosed. An example apparatus includes a data collector to gather a first data set representing IP telemetry data for a first protocol, the data collector to gather a second data set representing IP telemetry data for a second protocol different from the first protocol. A label generator is to generate a training data set based on records in the first data set and the second data set having matching IP addresses, the training data set to include combined label indicating whether each of the respective matching IP addresses is malicious. A model trainer is to train a machine learning model using the training data set. A model executor is to, responsive to a request from a client device, execute the machine learning model to determine whether a requested IP address is malicious.

Methods, systems, articles of manufacture and apparatus for producing generic IP reputation through cross protocol analysis

Methods, apparatus, systems and articles of manufacture are disclosed to analyze network traffic for malicious activity. An example apparatus includes a graph generator to, in response to obtaining one or more internet protocol addresses included within input data, generate a graph data structure based on one or more features of the one or more internet protocol addresses in the input data, a file generator to generate a first matrix using the graph data structure, the first matrix to represent nodes in the graph data structure and generate a second matrix using the graph data structure, the second matrix to represent edges in the graph data structure, and a classifier to, using the first matrix and the second matrix, classify at least one of the one or more internet protocol addresses to identify a reputation of the at least one of the one or more internet protocol addresses.

Methods and apparatus to analyze network traffic for malicious activity

Methods, apparatus, systems and articles of manufacture for federated training of a neural network using trusted edge devices are disclosed. An example system includes an aggregator device to aggregate model updates provided by one or more edge devices. The one or more edge devices to implement respective neural networks, and provide the model updates to the aggregator device. At least one of the edge devices to implement the neural network within a trusted execution environment.

Methods and apparatus for federated training of a neural network using trusted edge devices

Embodiments discussed herein may be generally directed to systems and techniques to generate a quality score based on an observation and an action caused by an actor agent during a testing phase. Embodiments also include determining a temporal difference between the quality score and a previous quality score based on a previous observation and a previous action, determining whether the temporal difference exceeds a threshold value, and generating an attack indication in response to determining the temporal difference exceeds the threshold value.

Techniques to detect perturbation attacks with an actor-critic framework

Methods, apparatus, systems and articles of manufacture are disclosed to perform malware detection using a generative adversarial network. An example apparatus includes a first encoder network to encode an input sample into a first encoded sample, the first encoder network implemented using a multilayer perception (MLP) network, a generator network to reconstruct the first encoded sample to generate a reconstructed sample, a discriminator network to, in response to obtaining the first encoded sample and the reconstructed sample, generate a loss function based on the reconstructed sample and the input sample, and an optimization processor to, when the loss function satisfies a threshold loss value, classify the input sample as malicious.

Methods and apparatus to perform malware detection using a generative adversarial network

Methods and apparatus to detect adversarial malware are disclosed. An example adversarial malware detector includes a machine learning engine to classify a first feature representation representing features of a program as benign or malware, a feature perturber to, when the first feature representation is classified as benign, remove a first one of the features to form a second feature representation, and a decider to classify the program as adversarial malware when the machine learning engine classifies the second feature representation as malware.

Methods and apparatus to detect adversarial malware

An embodiment of a semiconductor package apparatus may include technology to acquire location related information, acquire local area characteristic information, and verify the location related information based on the local area characteristic information. Other embodiments are disclosed and claimed.

Growing community of inventors

Portland, OR, United States of America

Yonghong Huang