Emc IP Holding Company LLC

The Charles Stark Draper Laboratory, Inc.

Zhou Li

Alina Oprea

Kevin Bowers

Martin Rosa

Ahmet Buyukkayhan

Ronald L Rivest

Alex Zaslavsky

Zohar Duchin

Ting-Fang Yen

Sang H Chin

Todd S Leetham

Ke Tian

Robin Norris

Sumayah Alrwais

Raymond Carney

Techniques are provided for selecting attributes to cluster users for a user application entitlement evaluation. An exemplary method comprises obtaining enterprise reference data indicating a plurality of attributes for a plurality of enterprise users; obtaining enterprise entitlement data indicating user application entitlements for the plurality of enterprise users; selecting at least one of the plurality of attributes as a cluster attribute using predefined information content rules applied on the enterprise entitlement data; determining a probability of a user application entitlement for the one or more user application entitlements based on a number of users for a plurality of values of the cluster attribute and a number of users for a plurality of pairs of the cluster attribute and a value of the one or more user application entitlements; and identifying anomalies in the enterprise entitlement data based on the probability of the user application entitlement for at least one user application entitlement and at least one predefined anomaly threshold.

Data-driven attribute selection for user application entitlement analysis

A method includes obtaining a given web page, parsing the given web page to identify one or more frame tags for one or more inline frames of the given web page, and extracting a set of features of a given inline frame from a given one of the identified frame tags in the given web page, the extracted set of features comprising one or more style features, one or more destination features and one or more context features of the given identified frame tag. The method also includes classifying the given inline frame as one of a malicious frame type and a benign frame type utilizing at least one model and at least a portion of the extracted set of features, and controlling access by one or more client devices associated with an enterprise to the given web page responsive to classifying the given inline frame as the malicious frame type.

Detecting frame injection through web page analysis

A method includes preparing a representation of data associated with a plurality of software modules, the representation comprising similarity-based hashing of signatures constructed from a first subset of features of the plurality of software modules. The method also includes performing a similarity-based query utilizing the similarity-based hashing of signatures to identify one or more of the plurality of software modules as candidate software modules matching a received seed software module. The method further includes computing distances between the candidate software modules and the seed software module utilizing a second subset of features of the plurality of software modules, classifying one or more of the candidate software modules as a designated type based on the computed distances, generating a notification comprising a list of the classified candidate software modules, and controlling access by one or more client devices associated with an enterprise to the candidate software modules in the list.

Classifying software modules utilizing similarity-based queries

A processing device comprises a processor coupled to a memory and is configured to identify a plurality of mobile application market sites accessible over a network, and to extract features from each of the mobile application market sites. Health scores are computed for respective ones of the mobile application market sites based on the corresponding features extracted from those mobile application market sites. One or more proactive measures are initiated to prevent one or more mobile devices from downloading mobile applications from any of the mobile application market sites having computed health scores below a specified threshold. The mobile application market sites may be identified as respective alternative mobile application market sites relative to a known primary mobile application market site. The alternative mobile application market sites may comprise respective alternative mobile application stores. The processing device may be implemented in a computer network or an associated network security system.

Network security system incorporating assessment of alternative mobile application market sites

A processing device in one embodiment comprises a processor coupled to a memory and is configured to direct one or more web crawlers to obtain textual information from a plurality of data sources accessible over at least one network, to extract terms likely to be associated with indicators of compromise from the obtained textual information, to filter the extracted terms to identify terms corresponding to respective valid indicators of compromise, to generate links between the terms corresponding to the respective valid indicators of compromise, and to convert the links and the corresponding terms into an output document in a specified indicator of compromise format. Feedback from an analyst device receiving the output document may be used to adjust a filter parameter of the extracted term filtering. Additionally or alternatively, one or more parameters of a network security system may be adjusted based at least in part on the output document.

Automatic extraction of indicators of compromise from multiple data sources accessible over a network

A method comprises obtaining at least a first software module not classified as benign or potentially malicious, extracting a set of features associated with the first software module, the set of features comprising static features, behavior features and context features, identifying a first cluster comprising one or more known software modules previously classified as benign, computing distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster, classifying the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric based on distances between feature sets of the known software modules in the first cluster, and modifying access by a given client device to the first software module responsive to classifying the first software module as potentially malicious.

Classifying software modules based on comparisons using a neighborhood distance metric

A method comprises obtaining at least a first software module not classified as benign or potentially malicious, extracting a set of features associated with the first software module including static, behavior and context features, computing distance metrics between the extracted feature set and feature sets of a plurality of clusters including one or more clusters of software modules previously classified as benign and exhibiting a first threshold level of similarity relative to one another and one or more clusters of software modules previously classified as potentially malicious and exhibiting a second threshold level of similarity relative to one another, classifying the first software module as belonging to a given cluster based at least in part on the computed distance metrics, and modifying access by a given client device to the first software module responsive to the given cluster being a cluster of software modules previously classified as potentially malicious.

Classifying potentially malicious and benign software modules through similarity analysis

A processing device in one embodiment comprises a processor coupled to a memory and is configured to obtain internal log data of a computer network of an enterprise, to extract values of a plurality of designated internal features from the log data, to obtain additional data from one or more external data sources, and to extract values of a plurality of designated external features from the additional data. The extracted values are applied to a regression model based on the internal and external features to generate malicious activity risk scores for respective ones of a plurality of domains, illustratively external domains having fully-qualified domain names (FQDNs). A subset of the domains are identified based on their respective malicious activity risk scores, and one or more proactive security measures are taken against the identified subset of domains. The processing device may be implemented in the computer network or an associated network security system.

Detection of malicious web activity in enterprise computer networks

A processing device comprises a processor coupled to a memory and is configured to obtain data relating to communications initiated by host devices of a computer network of an enterprise, and to process the data to identify external domains contacted by the host devices. A graph inference algorithm is applied to analyze contacts of the host devices with the external domains in order to characterize one or more of the external domains as suspicious domains. The host devices are configured to counteract malware infection from the suspicious domains. The graph inference algorithm in some embodiments comprises a belief propagation algorithm, which may be initiated with one or more seeds corresponding to respective known suspicious domains or to respective ones of the external domains determined to be associated with command and control behavior. The processing device may be implemented in the computer network or an associated network security system.

Detection of suspicious domains through graph inference algorithm processing of host-domain contacts

There are disclosed techniques for use in detecting malicious websites. In at least one embodiment, there is disclosed a technique for generating a profile in connection with a website. The profile comprising at least one attribute associated with the website. The technique also comprises collecting information relating to the website during a visit to the website. The technique further comprises detecting a change in connection with the website. The detection of the change comprises identifying a variation between the generated profile and the collected information.

Growing community of inventors

Malden, MA, United States of America

Zhou Li