Trend Micro Inc.

Zhengbao Zhang

Lili Diao

Zhijie Li

Hua Ye

Zhentao Huang

Bin Yin

Zhihe Zhang

Longping Wu

Zhihua Zhou

Qiang Zhuo

System and method for taking actions to mitigate security risks in a computer network are disclosed. The costs of security events and taking actions to block permissions granted to users are defined. For each of the users, prediction models are created, one for each of the security events. Using prediction models of a selected user, predictions on whether the security events will occur and/or predictions of severity if the security events actually occur are generated. For the selected user, an action list that indicates whether or not to take actions to block particular permissions granted to the selected user is generated based at least on the predictions, costs of the events, and costs of the permissions.

Adaptive actions for responding to security risks in computer networks

A risk knowledge graph is created from information on risk events involving network entities of a private computer network. Each of the risk events is represented as a node in the risk knowledge graph. The nodes are connected by edges that represent the risk events. The nodes are grouped into communities of related nodes. A response action is performed against a community to mitigate a cybersecurity risk posed by the community.

Detecting network entities that pose a cybersecurity risk to a private computer network

A mobile app is in a form of a package file. A structural feature digest is generated from contents of a manifest part, bytecode part, and resource part of the package file. A mobile device receives an unknown mobile app, generates a structural feature digest of the unknown mobile app, and sends the structural feature digests to a backend system over a computer network. In the backend system, the structural feature digest of the unknown mobile app is compared to structural feature digests of known malicious mobile apps. The unknown mobile app is detected to be malicious when its structural feature digest is similar to that of a known malicious mobile app.

Detection of malicious mobile apps

A computer network includes endpoint computers and a file history server with a file history database. An endpoint agent in an endpoint computer detects file access events in the endpoint computer and generates file activity data for storage in the file history database. The file activity data may include file access event information of file access events and file information of files involved in the file access events. The endpoint agent may consult the file history database to locate a duplicate of a damaged file in another endpoint computer, and restore the damaged file using the duplicate. A backup and restore program may also consult the file history database to determine whether or not to make a backup copy of a file involved in a file access event.

Growing community of inventors

Nanjing, China

Zhengbao Zhang