Nec Corporation

Thomson Licensing

Future Wei Technologies, Inc.

Siemens Corporate Research, Inc.

Nec Laboratories America, Inc.

Nec C Orporation

Interdigital Ce Patent Holdings

Thomson Licensing Dtv

Zhenyu Wu

Zhichun Li

Guofei Jiang

Kangkook Jee

Junghwan Rhee

Jianzhong Qian

Jill MacDonald Boyce

Hong Heather Yu

Zhengzhang Chen

LuAn Tang

John Wus

Jumpei Kamimura

Lauri Korts-Parn

Haifeng Chen

Yuseok Jeon

Zhiyun Qian

Yao Rong Wang

Wei Jiang

Purvin Bibhas Pandit

Carol L Novak

John H Li

Ding Li

Mu Zhang

Jungwhan Rhee

Xiuping Lu

Sreerama K Murthy

Ping Hua

Omid Setayeshfar

Peng Yin

Hui Joyce Zhang

Guo-Qing Wei

Lihua Zhu

Dong Tian

Guillaume Bichot

Ming Fang

Dong-Qing Zhang

Jun Xu

Hongbing Li

Yueping Zhang

Chad Andrew Lefevre

Dekai Li

Alan Jay Stein

Wang Lin Lai

Xia Ning

Manfred Bromba

Vasileios Kemerlis

Chung Hwan Kim

Xusheng Xiao

Dongqing Zhang

Zhengye Liu

Jun Wang

Yangchun Fu

Long Lu

Frederic Landais

Helmut Schramm

Yixin Sun

Yue Li

Zichun Li

Muhammad Twaha Naqash Ibrahim

Jianjun Huang

Masoud Akhoondi

Markus Kusano

Hongyu Li

Stéphane Gouache

Yi Ding

Shuai Hao

Kangjie Lu

Saurav Kumar Bandyopadhyay

Boyce Jill MacDonald

Hui Zhang

John Qiang Li

A method for ransomware detection and prevention includes receiving an event stream associated with one or more computer system events, generating user-added-value knowledge data for one or more digital assets by modeling digital asset interactions based on the event stream, including accumulating user-added-values of each of the one or more digital assets, and detecting ransomware behavior based at least in part on the user-added-value knowledge, including analyzing destruction of the user-added values for the one or more digital assets.

User-added-value-based ransomware detection and prevention

Systems and methods for mining and compressing commercial data including a network of point of sale devices to log commercial activity data including independent commercial events and corresponding dependent features. A middleware system is in communication with the network of point of sale devices to continuously collect and compress a stream of the commercial activity data and concurrently store the compressed commercial activity data. Compressing the stream includes a file access table corresponding to the commercial activity data, producing compressible file access templates (CFATs) according to frequent patterns of commercial activity data using the file access table, and replacing dependent feature sequences with a matching compressible file access template. A database is in communication with the middleware system to store the compressed commercial data. A commercial pattern analysis system is in communication with the database to determine patterns in commercial activities across the network of point of sale devices.

Template based data reduction for commercial data mining

Systems and methods are disclosed for enhancing cybersecurity in a computer system by detecting safeness levels of executables. An installation lineage of an executable is identified in which entities forming the installation lineage include at least an installer of the monitored executable, and a network address from which the executable is retrieved. Each entity of the entities forming the installation lineage is individually analyzed using at least one safeness analysis. Results of the at least one safeness analysis of each entity are inherited by other entities in the lineage of the executable. A backtrace result for the executable is determined based on the inherited safeness evaluation of the executable. A total safeness of the executable, based on at least the backtrace result, is evaluated against a set of thresholds to detect a safeness level of the executable. The safeness level of the executable is output on a display screen.

Automated software safeness categorization with installation lineage and hybrid information sources

Systems and methods for an automotive security gateway include an in-gateway security system that monitors local host behaviors in vehicle devices to identify anomalous local host behaviors using a blueprint model trained to recognize secure local host behaviors. An out-of-gateway security system monitors network traffic across remote hosts, local devices, hotspot network, and in-car network to identify anomalous behaviors using deep packet inspection to inspect packets of the network. A threat mitigation system issues threat mitigation instructions corresponding to the identified anomalous local host behaviors and the anomalous remote host behaviors to secure the vehicle devices by removing the identified anomalous local host behaviors and the anomalous remote host behaviors. Automotive security gateway services and vehicle electronic control units operate the vehicle devices according to the threat mitigation instructions.

Host behavior and network analytics based automotive secure gateway

A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, and employing an alert interpretation module to interpret the alerts in real-time, the alert interpretation module including a process-star graph constructor for retrieving relationships from the streaming data to construct process-star graph models and an alert cause detector for analyzing the alerts based on the process-star graph models to determine an entity that causes an alert.

Graph model for alert interpretation in enterprise security system

A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, employing an alert interpretation module to interpret the alerts in real-time, matching problematic entities to the streaming data, retrieving following events, and generating an aftermath graph on a visualization component.

A computer-implemented method for implementing alert interpretation in enterprise security systems is presented. The computer-implemented method includes employing a plurality of sensors to monitor streaming data from a plurality of computing devices, generating alerts based on the monitored streaming data, automatically analyzing the alerts, in real-time, by using a graph-based alert interpretation engine employing process-star graph models, retrieving a cause of the alerts, an aftermath of the alerts, and baselines for the alert interpretation, and integrating the cause of the alerts, the aftermath of the alerts, and the baselines to output an alert interpretation graph to a user interface of a user device.

Systems and methods are disclosed for securing an enterprise environment by detecting suspicious software. A global program lineage graph is constructed. Construction of the global program lineage graph includes creating a node for each version of a program having been installed on a set of user machines. Additionally, at least two nodes are linked with a directional edge. For each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed is determined; and the prevalence number is recorded to the metadata associated with the respective node. Anomalous behavior is identified based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph. An alarm is displayed on a graphical user interface for each suspicious software based on the identified anomalous behavior.

Path-based program lineage inference analysis

Systems and methods for data reduction including organizing data of an event stream into a file access table concurrently with receiving the event stream, the data including independent features and dependent features. A frequent pattern tree (FP-Tree) is built including nodes corresponding to the dependent features according to a frequency of occurrence of the dependent features relative to the independent features. Each single path in the FP-Tree is merged into a special node corresponding to segments of dependent features to produce a reduced FP-Tree. All path combinations in the reduced FP-Tree are identified. A compressible file access template (CFAT) is generated corresponding to each of the path combinations. The data of the event stream is compressed with the CFATs to reduce the dependent features to special events representing the dependent features.

Template based data reduction for security related information flow data

Methods and systems for security analysis include determining whether a process has an origin internal to a system or external to the system using a processor based on monitored behavior events associated with the process. A security analysis is performed on only processes that have an external origin to determine if any of the processes having an external origin represent a security threat. A security action is performed if a process having an external origin is determined to represent a security threat.

Automated blackbox inference of external origin user behavior

A system and computer-implemented method are provided for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts. The system includes a set of DNS resolver agents configured to (i) gather DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries, and (ii) associate the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries. The system further includes a backend server configured to detect one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs.

Host level detect mechanism for malicious DNS activities

A computer-implemented method for performing privilege flow analysis is presented. The computer-implemented method includes monitoring at least one program operating system (OS) event handled by a program, generating a privilege flow graph, determining an inferred program behavior context, and generating, based on a combination of the privilege flow graph and the inferred program behavior context, an inferred behavior context-aware privilege flow graph to distinguish different roles of processes and/or threads within the program.

Blackbox program privilege flow analysis with inferred program behavior context

A computer-implemented method for analyzing operations of privilege changes is presented. The computer-implemented method includes inputting a program and performing source code analysis on the program by generating a privilege control flow graph (PCFG), generating a privilege data flow graph (PDFG), and generating a privilege call context graph (PCCG). The computer-implemented method further includes, based on the source code analysis results, instrumenting the program to perform inspections on execution states at privilege change operations, and performing runtime inspection and anomaly prevention.

Fine-grained analysis and prevention of invalid privilege transitions

A method of stabilizing a video in real time using a single pass including receiving consecutive video frames, where the consecutive video frames include a current video frame and previous video frames, storing the consecutive video frames in a buffer, estimating a global motion for the current video frame by describing a camera's relative motion between the current video frame and one of the previous video frames adjacent to the current video frame, estimating a long-term camera motion for the current video frame by determining a geometric mean of an accumulation of the estimate of the global motion for the current video frame and an estimate of global motion for each of the previous video frames, and displaying the current video frame on a display of an electronic device, the current video frame stabilized based on the estimate of the long-term camera motion.

One-pass video stabilization

Systems and methods for identifying similarities in program binaries, including extracting program binary features from one or more input program binaries to generate corresponding hybrid features. The hybrid features include a reference feature, a resource feature, an abstract control flow feature, and a structural feature. Combinations of a plurality of pairs of binaries are generated from the extracted hybrid features, and a similarity score is determined for each of the pairs of binaries. A hybrid difference score is generated based on the similarity score for each of the binaries combined with input hybrid feature parameters. A likelihood of malware in the input program is identified based on the hybrid difference score.

Extraction and comparison of hybrid program binary features

Growing community of inventors

Plainsboro, NJ, United States of America

Zhenyu Wu