Symantec Corporation

Nortonlifelock Inc.

Gen Digital Inc.

Ca, Inc.

Yufei Han

Yun Shen

Kevin Alejandro Roundy

Pierre-Antoine Vervier

Michael Andrew Hart

Christopher Gates

Leylya Yumer

Acar Tamersoy

Matteo Dell'Amico

Chris Gates

Xiaolin Wang

Petros Efstathopoulos

Daniel Kats

Wangyan Feng

Leyla Bilge

Joseph Lopilato

Shuning Wu

Leylya Bilge

Shang-Tse Chen

Lella Bilge

Arif Shaikh

Brandon Fetters

Anil Sharma

Yuzhe Ma

Oystein Fladby

The disclosed computer-implemented method for updating a machine-learning-based prediction model with preserved privacy may include receiving a plurality of training data sets for training a machine-learning-based global prediction model for predicting future incidents of a computing event. Each data set may include incidents of the computing event. The method may include creating, by training the global prediction model using the plurality of training data sets, an intermediate prediction model of the global prediction model. The intermediate prediction model may be a precursor state to a fully trained global prediction model. The method may further include providing the intermediate prediction model to a computing node to enable the computing node to fully train a local prediction model using both the intermediate prediction model and a local training data set. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for updating a machine-learning-based prediction model with preserved privacy

A method for protecting sensitive data from being exposed in graph embedding vectors. In some embodiments, a method may include generating first graph embedding vectors from an original graph and generating a proxy graph from the first graph embedding vectors. The proxy graph may include a plurality of proxy nodes and proxy edges connecting the proxy nodes. The proxy nodes may include one or more attributes of the original nodes that are included in the first graph embedding vectors. Second graph embedding vectors may then be generated by encoding the proxy graph and a reconstructed graph may be generated from the second graph embedding vectors. Finally, the reconstructed graph may be compared to the original graph and if a threshold level of similarity is met, a security action may be performed to protect sensitive data from being exposed.

Protecting sensitive data from being exposed in graph embedding vectors

A computer-implemented method for protecting data on devices may include (i) identifying a device that is operated by a user and that comprises private data pertaining to the user, (ii) determining that stalkerware on the device is sending the private data to an unauthorized device not operated by the user, (iii) requesting, in response to determining that the stalkerware is sending the private data to the unauthorized device, that the user select at least one safety plan step from a set of safety plan options, and (iv) modifying, at least in part based on the safety plan step selected by the user, outgoing data sent by the stalkerware to the unauthorized device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting data on devices

The disclosed computer-implemented method for utilizing user identity notifications to protect against potential privacy attacks on mobile devices may include (i) monitoring a mobile computing device to detect one or more user interactions by a current user, (ii) identifying the current user of the mobile computing device, (iii) determining that the current user is a potentially malicious user associated with one or more privacy-invasive applications installed on the mobile computing device, and (iv) performing a security action that protects a benign user of the mobile computing device against an attack initiated by the potentially malicious user associated with the privacy-invasive applications. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for utilizing user identity notifications to protect against potential privacy attacks on mobile devices

The disclosed computer-implemented method for utilizing federated machine-learning to protect against potentially malicious data may include (i) arranging a set of client devices into groups for applying a federated machine-learning model, (ii) determining model updates for each of the groups over a predetermined period, (iii) training one or more recurrent neural networks to derive a low-dimensional representation of the model updates, (iv) calculating a data quality score for each of the client devices based on the model updates, (v) applying the federated machine-learning model to classify data instances on each of the client devices as including clean data or potentially corrupt data, and (vi) performing a security action that protects against the potentially malicious data by tagging the data instances classified as the potentially corrupt data. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for utilizing federated machine-learning to protect against potentially malicious data

The disclosed computer-implemented method for detecting inter-personal attack applications may include (i) receiving application marketplace information describing application feature information, (ii) creating, by performing natural language processing on the feature information, a feature vector identifying a potentially malicious functionality of the application, (iii) creating a profiling vector that is a categorical feature representation of installation information from an application installation file, and (iv) performing a security action including (A) mapping, using a machine learning model, the feature vector and the profiling vector to a multi-dimensional output vector having element corresponding to a malware category and (B) determining a malicious extent of the application by combining the categories identified by the multi-dimensional output vector with bi-partite graph information identifying (I) relations between a plurality of applications and (II) relations between a plurality of computing devices hosting the plurality of applications. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting inter-personal attack applications

The disclosed computer-implemented method for detecting potentially malicious content in decentralized machine-learning model updates may include (i) receiving messages communicated within a group of client devices for performing an update of a shared machine-learning model, (ii) determining a bias of a target message in the messages communicated from a target client device in the group with respect to a remaining number of the messages in the messages communicated from the other client devices in the group, (iii) assigning a confidence score to each of the other client devices based on the bias determined for the target message, the confidence score representing a likelihood of potentially malicious content in the target message, and (iv) performing, based on the confidence score, a security action that prevents the potentially malicious content from compromising the update of the shared machine-learning model. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting potentially malicious content in decentralized machine-learning model updates

The disclosed computer-implemented method for verifying decentralized federated data using influence evaluation may include (i) calculate an influence score for each of a group of data instances, (ii) rank the data instances based on the influence scores, (iii) determine an anomaly score for each of the ranked data instances, (iv) select the ranked data instances with the highest anomaly scores as containing potentially malicious data, and (v) perform a security action that protects against the potentially malicious data. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for verifying decentralized federated data using influence evaluation

A method for detecting and protecting against abnormal user behavior is described. The method may include generating a tensor model based on a set of user information within a temporal period. The tensor model may include a behavioral profile associated with a user of a set of users. In some examples, the method may include determining that a behavior associated with the user of the set of users is abnormal based on the tensor model, adapting the tensor model based on feedback from an additional user of a set of additional users different from the set of users, and performing a security action on at least one computing device to protect against the abnormal user behavior based on the adapting.

Abnormal user behavior detection

The disclosed computer-implemented method for cross-product malware categorization may include accessing computer readable media storing an incomplete feature dataset and an incomplete label dataset, determining a correlation between the plurality of features and the plurality of malware labels, and constructing at least one of a complete feature dataset based on the incomplete feature dataset and the correlation and a complete label dataset based on the incomplete label dataset and the correlation. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for cross-product malware categorization

The disclosed computer-implemented method for malware classification may include receiving dynamic analysis traces that include event descriptions regarding malware programs, and labels regarding classes of malware programs; performing a first mapping of the event descriptions to a first set of vector representations, wherein order of the events is not taken into account by the first mapping; performing a second mapping of the event descriptions to a second set of vector representations, wherein order of the events is taken into account by the second mapping; combining the first set of vector representations and the second set of vector representations into a combined set of vector representations; inputting the combined set of vector representations, along with the labels, into an autoencoder; and training the autoencoder to generate a feature space representation that correlates identified features with classes of malware. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for malware classification

The disclosed computer-implemented method for preventing decentralized malware attacks may include (i) receiving, by a computing device, node data from a group of nodes over a network, (ii) training a machine learning model by shuffling the node data to generate a set of outputs utilized for predicting malicious data, (iii) calculating a statistical deviation for each output in the set of outputs from an aggregated output for the set of outputs, and (iv) identifying, based on the statistical deviation, an anomalous output in the set of outputs that is associated with one or more of the malicious nodes, the one or more malicious nodes hosting the malicious data. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing decentralized malware attacks

Detecting abnormal user behavior via temporally regularized tensor factorization. A method may include obtaining behavioral data of a plurality of users of cloud services to establish a first behavioral baseline; obtaining behavioral data for a particular user of the plurality of users to establish a second behavioral baseline; determining a first variation of behavior between the second and first behavioral baseline to determine an expected behavior; creating a tensor model for a succession of pre-determined time periods comprising multiple three-dimensional tensors; determining a temporal dependence between the multiple three-dimensional tensors; determining a temporal smoothness between the multiple three-dimensional tensors; predicting a future variation in behavior of the particular user based on a combination of the temporal dependence and the temporal smoothness, where the future variation in behavior indicates a potential security threat; and performing a remedial security action on a client device based on the predicted future variation in behavior.

Detecting abnormal user behavior via temporally regularized tensor factorization

Log text is encoded into a low dimensional feature vector. A temporal predictive model is constructed based on the low dimensional feature vector. The temporal predictive model is used to calculate probabilities of the occurrence of security incidents based on signature names from the log text encoded in the low dimensional feature vector. A preventative security action is automatically taken in response to the calculated probability of the occurrence of a specific security incident exceeding a given threshold.

Identifying evidence of attacks by analyzing log text

Securing network devices by forecasting future security incidents for a network based on past security incidents. In one embodiment, a method may include constructing past inside-in security features for a network, constructing past outside-in security features for the network, and employing dynamic time warping to generate a similarity score for each security feature pair in the past inside-in security features, in the past outside-in security features, and between the past inside-in security features and the past outside-in security features. The method may further include generating a Coupled Gaussian Latent Variable (CGLV) model based on the similarity scores, forecasting future inside-in security features for the network using the CGLV model, and performing a security action on one or more network devices of the network based on the forecasted future inside-in security features for the network.

Growing community of inventors

Antibes, France

Yufei Han