A method, a system, and a computer program product for performing analysis of data to detect presence of malicious code are disclosed. Reduced dimensionality vectors are generated from a plurality of original dimensionality vectors representing features in a plurality of samples. The reduced dimensionality vectors have a lower dimensionality than an original dimensionality of the plurality of original dimensionality vectors. A first plurality of clusters is determined by applying a first clustering algorithm to the reduced dimensionality vectors. A second plurality of clusters is determined by applying a second clustering algorithm to one or more clusters in the first plurality of clusters using the original dimensionality. An exemplar for a cluster in the second plurality of clusters is added to a training set, which is used to train a machine learning model for identifying a file containing malicious code.
G06F 21/56 - Détection ou gestion de programmes malveillants, p.ex. dispositions anti-virus
G05B 13/02 - Systèmes de commande adaptatifs, c. à d. systèmes se réglant eux-mêmes automatiquement pour obtenir un rendement optimal suivant un critère prédéterminé électriques
Methods and systems for fingerprinting a malicious behavior. In a first stage of training, a coarse machine learning one-class classifier is trained to detect a first dataset of events, the first dataset of events including a dataset of events representing a malicious behavior and a dataset of events representing non-malicious behavior and a benign machine learning one-class classifier is trained to detect a second dataset of events, the second dataset of events excluding the dataset of events representing malicious activity. An ensemble of models including the benign and coarse machine learning one-class classifiers is applied to the first dataset of events to create a third training set representing the malicious behavior for a second stage of training. A final machine learning one-class classifier is trained in the second stage of training using the third training set. The final machine learning one-class classifier represents a fingerprint of the malicious behavior.
Methods and systems for training a neural network. In a first stage of training, a coarse machine learning one-class classifier is trained using a first training set including a signal and noise and a noise machine learning one-class classifier is trained using a second training set excluding the signal. An assembly of models including the noise machine learning one-class classifier and the coarse machine learning one-class classifier is applied to the first training set to create a third training set representing the signal for a second stage of training. A final machine learning one-class classifier is trained in the second stage of training using the third training set representing the signal.
Systems, methods, and software can be used for securing in-tunnel messages. One example of a method includes obtaining a parsed file that comprises two or more sub-feature trees, and each of the two or more sub-feature trees comprise at least one feature layer that comprises features. The method further includes generating a feature vector that identifies the features in the at least one feature layer for each of the two or more sub-feature trees. The method yet further includes mapping the features in the at least one feature layer for each of the one or more sub-feature trees to a corresponding position in the feature vector. By converting features in the parsed file into a feature vector, the method provides an applicable format of the feature vector in wide applications for the parsed file.
G06K 9/62 - Méthodes ou dispositions pour la reconnaissance utilisant des moyens électroniques
G06F 16/28 - Bases de données caractérisées par leurs modèles, p.ex. des modèles relationnels ou objet
G06F 16/901 - Indexation; Structures de données à cet effet; Structures de stockage
H04L 9/32 - Dispositions pour les communications secrètes ou protégées; Protocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
An artifact is received and features are extracted therefrom to form a feature vector. Thereafter, a determination is made to alter a malware processing workflow based on a distance of one or more features in the feature vector relative to one or more indicator centroids. Each indicator centroid specifying a threshold distance to trigger an action. Based on such a determination, the malware processing workflow is altered.
Systems, methods, and software can be used to cluster software codes in a scalable manner. In some aspects, a computer-implemented method comprises: obtaining a plurality of software samples; computing one or more first hash results for each of the plurality of software samples; computing one or more second hash results for each of the plurality of software samples based on the one or more first hash results, wherein an amount of the one or more second hash results is less than an amount of the one or more first hash results; determining a similarity output based on the one or more second hash results of two of the plurality of software samples; and clustering the plurality of software samples based on the similarity output to generate one or more software sample clusters.
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Recorded and downloadable computer software for providing
cyber-security, endpoint security and data protection and
privacy; recorded and downloadable computer software for
measuring, assessing, identifying, detecting, analyzing,
preventing, and responding to cybersecurity threats,
attacks, risks, and vulnerabilities; recorded and
downloadable computer software for endpoint security,
malware analysis, vulnerability testing, penetration
testing, and vulnerability assessment; recorded and
downloadable computer software that enable software
developers to design, test, deploy, manage, and monitor
internet of things (IoT) and machine-to-machine (m2m)
devices. Technology consultation in the field of cybersecurity;
design and development of computer software; software as a
service (SaaS) and platform as a service (PaaS) services
featuring software for providing cyber-security, data
protection and privacy; providing temporary use of
non-downloadable computer software for measuring, assessing,
identifying, detecting, analyzing, preventing, and
responding to cybersecurity threats, attacks, risks, and
vulnerabilities; providing temporary use of on-line
non-downloadable computer software for endpoint security,
malware analysis, vulnerability testing, penetration
testing, and vulnerability assessment; computer software
services, namely, development, maintenance, repair,
installation, troubleshooting of problems, support in the
nature of diagnosing problems, upgrade and updating,
authoring, provision of information, consultation, design
and customization of computer software and middleware;
computer security consultancy; providing temporary use of
non-downloadable software for artificial intelligence,
analytics based machine learning, and non-downloadable deep
learning software, all for the purpose of the design,
development, installation, deployment, analysis, monitoring
of and maintenance of computer software; platform as a
service (PaaS) services featuring computer development
platforms that enable software developers to design, test,
deploy, manage, and monitor internet of things (IoT) and
machine-to-machine (m2m) devices.
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Recorded and downloadable computer software for providing
cyber-security, endpoint security and data protection and
privacy; recorded and downloadable computer software for
measuring, assessing, identifying, detecting, analyzing,
preventing, and responding to cybersecurity threats,
attacks, risks, and vulnerabilities; recorded and
downloadable computer software for endpoint security,
malware analysis, vulnerability testing, penetration
testing, and vulnerability assessment; recorded and
downloadable computer software that enable software
developers to design, test, deploy, manage, and monitor
internet of things (IoT) and machine-to-machine (m2m)
devices. Technology consultation in the field of cybersecurity;
design and development of computer software; software as a
service (SaaS) and platform as a service (PaaS) services
featuring software for providing cyber-security, data
protection and privacy; providing temporary use of
non-downloadable computer software for measuring, assessing,
identifying, detecting, analyzing, preventing, and
responding to cybersecurity threats, attacks, risks, and
vulnerabilities; providing temporary use of on-line
non-downloadable computer software for endpoint security,
malware analysis, vulnerability testing, penetration
testing, and vulnerability assessment; computer software
services, namely, development, maintenance, repair,
installation, troubleshooting of problems, support in the
nature of diagnosing problems, upgrade and updating,
authoring, provision of information, consultation, design
and customization of computer software and middleware;
computer security consultancy; providing temporary use of
non-downloadable software for artificial intelligence,
analytics based machine learning, and non-downloadable deep
learning software, all for the purpose of the design,
development, installation, deployment, analysis, monitoring
of and maintenance of computer software; platform as a
service (PaaS) services featuring computer development
platforms that enable software developers to design, test,
deploy, manage, and monitor internet of things (IoT) and
machine-to-machine (m2m) devices.
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Recorded and downloadable computer software for providing
cyber-security, endpoint security and data protection and
privacy; recorded and downloadable computer software for
measuring, assessing, identifying, detecting, analyzing,
preventing, and responding to cybersecurity threats,
attacks, risks, and vulnerabilities; recorded and
downloadable computer software for endpoint security,
malware analysis, vulnerability testing, penetration
testing, and vulnerability assessment; recorded and
downloadable computer software that enable software
developers to design, test, deploy, manage, and monitor
internet of things (IoT) and machine-to-machine (m2m)
devices. Technology consultation in the field of cybersecurity;
design and development of computer software; software as a
service (SaaS) and platform as a service (PaaS) services
featuring software for providing cyber-security, data
protection and privacy; providing temporary use of
non-downloadable computer software for measuring, assessing,
identifying, detecting, analyzing, preventing, and
responding to cybersecurity threats, attacks, risks, and
vulnerabilities; providing temporary use of on-line
non-downloadable computer software for endpoint security,
malware analysis, vulnerability testing, penetration
testing, and vulnerability assessment; computer software
services, namely, development, maintenance, repair,
installation, troubleshooting of problems, support in the
nature of diagnosing problems, upgrade and updating,
authoring, provision of information, consultation, design
and customization of computer software and middleware;
computer security consultancy; providing temporary use of
non-downloadable software for artificial intelligence,
analytics based machine learning, and non-downloadable deep
learning software, all for the purpose of the design,
development, installation, deployment, analysis, monitoring
of and maintenance of computer software; platform as a
service (PaaS) services featuring computer development
platforms that enable software developers to design, test,
deploy, manage, and monitor internet of things (IoT) and
machine-to-machine (m2m) devices.
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Providing online non-downloadable software for use in
preventing unauthorized access to computer and electronics
systems; providing online non-downloadable internet security
software; consulting services in the field of downloadable
and non-downloadable Internet security software; consulting
services in the fields of the design, development, and
implementation of computer hardware and software for
preventing unauthorized access to computers and electronics
systems; consulting services in the field of internet
security software.
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
(1) Recorded and downloadable computer software for providing cyber-security, endpoint security and data protection and privacy; recorded and downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; recorded and downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; recorded and downloadable computer software that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices. (1) Technology consultation in the field of cybersecurity; design and development of computer software; software as a service (SaaS) and platform as a service (PaaS) services featuring software for providing cyber-security, data protection and privacy; providing temporary use of non-downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; providing temporary use of on-line non-downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; computer software services, namely, development, maintenance, repair, installation, troubleshooting of problems, support in the nature of diagnosing problems, upgrade and updating, authoring, provision of information, consultation, design and customization of computer software and middleware; computer security consultancy; providing temporary use of non-downloadable software for artificial intelligence, analytics based machine learning, and non-downloadable deep learning software, all for the purpose of the design, development, installation, deployment, analysis, monitoring of and maintenance of computer software; platform as a service (PaaS) services featuring computer development platforms that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices.
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
(1) Recorded and downloadable computer software for providing cyber-security, endpoint security and data protection and privacy; recorded and downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; recorded and downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; recorded and downloadable computer software that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices. (1) Technology consultation in the field of cybersecurity; design and development of computer software; software as a service (SaaS) and platform as a service (PaaS) services featuring software for providing cyber-security, data protection and privacy; providing temporary use of non-downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; providing temporary use of on-line non-downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; computer software services, namely, development, maintenance, repair, installation, troubleshooting of problems, support in the nature of diagnosing problems, upgrade and updating, authoring, provision of information, consultation, design and customization of computer software and middleware; computer security consultancy; providing temporary use of non-downloadable software for artificial intelligence, analytics based machine learning, and non-downloadable deep learning software, all for the purpose of the design, development, installation, deployment, analysis, monitoring of and maintenance of computer software; platform as a service (PaaS) services featuring computer development platforms that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices.
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
(1) Recorded and downloadable computer software for providing cyber-security, endpoint security and data protection and privacy; recorded and downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; recorded and downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; recorded and downloadable computer software that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices. (1) Technology consultation in the field of cybersecurity; design and development of computer software; software as a service (SaaS) and platform as a service (PaaS) services featuring software for providing cyber-security, data protection and privacy; providing temporary use of non-downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; providing temporary use of on-line non-downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; computer software services, namely, development, maintenance, repair, installation, troubleshooting of problems, support in the nature of diagnosing problems, upgrade and updating, authoring, provision of information, consultation, design and customization of computer software and middleware; computer security consultancy; providing temporary use of non-downloadable software for artificial intelligence, analytics based machine learning, and non-downloadable deep learning software, all for the purpose of the design, development, installation, deployment, analysis, monitoring of and maintenance of computer software; platform as a service (PaaS) services featuring computer development platforms that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices.
09 - Appareils et instruments scientifiques et électriques
Produits et services
Recorded and downloadable computer software for providing cyber-security, endpoint security and data protection and privacy; recorded and downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; recorded and downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; recorded and downloadable computer software that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices
09 - Appareils et instruments scientifiques et électriques
Produits et services
Recorded and downloadable computer software for providing cyber-security, endpoint security and data protection and privacy; recorded and downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; recorded and downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; recorded and downloadable computer software that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices
09 - Appareils et instruments scientifiques et électriques
Produits et services
Recorded and downloadable computer software for providing cyber-security, endpoint security and data protection and privacy; recorded and downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; recorded and downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; recorded and downloadable computer software that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices
18.
Statistical data fingerprinting and tracing data similarity of documents
A method and computing device for statistical data fingerprinting and tracing data similarity of documents. The method comprises applying a statistical function to a subset of text in a first document thereby generating a first fingerprint; applying the statistical function to a subset of text in a second document thereby generating a second fingerprint; comparing the first fingerprint to the second fingerprint; and determining that the subset of text in the first document matches the subset of text in the second document based on the first fingerprint threshold matching the second fingerprint, wherein the statistical function is a measure of randomness of a count of each character in a subset of text against an expected distribution of said characters.
G06V 10/75 - Appariement de motifs d’image ou de vidéo; Mesures de proximité dans les espaces de caractéristiques utilisant l’analyse de contexte; Sélection des dictionnaires
G06F 17/00 - TRAITEMENT ÉLECTRIQUE DE DONNÉES NUMÉRIQUES Équipement ou méthodes de traitement de données ou de calcul numérique, spécialement adaptés à des fonctions spécifiques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Technology consultation in the field of cybersecurity; Design and development of computer software; Software as a service (SaaS) and Platform as a service (PaaS) services featuring software for providing cyber-security, data protection and privacy; Providing temporary use of non-downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; Providing temporary use of on-line non-downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; computer software services, namely, development, maintenance, repair, installation, troubleshooting of problems, support in the nature of diagnosing problems, upgrade and updating, authoring, provision of information, consultation, design and customization of computer software and middleware; computer security consultancy; providing temporary use of non-downloadable software for artificial intelligence, analytics based machine learning, and non-downloadable deep learning software, all for the purpose of the design, development, installation, deployment, analysis, monitoring of and maintenance of computer software; Platform as a service (PAAS) services featuring computer development platforms that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
(1) Providing online non-downloadable software for use in preventing unauthorized access to computer and electronics systems; providing online non-downloadable internet security software; consulting services in the field of downloadable and non-downloadable Internet security software; consulting services in the fields of the design, development, and implementation of computer hardware and software for preventing unauthorized access to computers and electronics systems; consulting services in the field of internet security software.
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Technology consultation in the field of cybersecurity; Design and development of computer software; Software as a service (SaaS) and Platform as a service (PaaS) services featuring software for providing cyber-security, data protection and privacy; Providing temporary use of non-downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; Providing temporary use of on-line non-downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; computer software services, namely, development, maintenance, repair, installation, troubleshooting of problems, support in the nature of diagnosing problems, upgrade and updating, authoring, provision of information, consultation, design and customization of computer software and middleware; computer security consultancy; providing temporary use of non-downloadable software for artificial intelligence, analytics based machine learning, and non-downloadable deep learning software, all for the purpose of the design, development, installation, deployment, analysis, monitoring of and maintenance of computer software; Platform as a service (PAAS) services featuring computer development platforms that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Technology consultation in the field of cybersecurity; Design and development of computer software; Software as a service (SaaS) and Platform as a service (PaaS) services featuring software for providing cyber-security, data protection and privacy; Providing temporary use of non-downloadable computer software for measuring, assessing, identifying, detecting, analyzing, preventing, and responding to cybersecurity threats, attacks, risks, and vulnerabilities; Providing temporary use of on-line non-downloadable computer software for endpoint security, malware analysis, vulnerability testing, penetration testing, and vulnerability assessment; computer software services, namely, development, maintenance, repair, installation, troubleshooting of problems, support in the nature of diagnosing problems, upgrade and updating, authoring, provision of information, consultation, design and customization of computer software and middleware; computer security consultancy; providing temporary use of non-downloadable software for artificial intelligence, analytics based machine learning, and non-downloadable deep learning software, all for the purpose of the design, development, installation, deployment, analysis, monitoring of and maintenance of computer software; Platform as a service (PAAS) services featuring computer development platforms that enable software developers to design, test, deploy, manage, and monitor internet of things (IoT) and machine-to-machine (m2m) devices
Bayesian continuous user authentication can be obtained by receiving observed behavior data that collectively characterizes interaction of an active user with at least one computing device or software application. A sequence of events within the observed behavior data can be identified and scored using a universal background model that generates first scores that characterize an extent to which each event or history of events is anomalous for a particular population of users. Further, the events are scored using a user model that generates second scores that characterizes an extent to which each event or history of events is anomalous for the particular user who owns the account. The first scores and the second scores are smoothed using a smoothing function. A probability that the active user is the account owner associated with the user model is determined based on the smoothed first scores and the smoothed second scores.
Systems and methods are described herein for computer user authentication using machine learning. Authentication for a user is initiated based on an identification confidence score of the user. The identification confidence score is based on one or more characteristics of the user. Using a machine learning model for the user, user activity of the user is monitored for anomalous activity to generate first data. Based on the monitoring, differences between the first data and historical utilization data for the user determine whether the user's utilization of the one or more resources is anomalous. When the user's utilization of the one or more resource is anomalous, the user's access to the one or more resource is removed.
Features are extracted from an artifact so that a vector can be populated. The vector is then inputted into an anomaly detection model comprising a deep generative model to generate a first score. The first score can characterize the artifact as being malicious or benign to access, execute, or continue to execute. In addition, the vector is inputted into a machine learning-based classification model to generate a second score. The second score can also characterize the artifact as being malicious or benign to access, execute, or continue to execute. The second score is then modified based on the first score to result in a final score. The final score can then be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
G06N 7/00 - Agencements informatiques fondés sur des modèles mathématiques spécifiques
H04L 9/06 - Dispositions pour les communications secrètes ou protégées; Protocoles réseaux de sécurité l'appareil de chiffrement utilisant des registres à décalage ou des mémoires pour le codage par blocs, p.ex. système DES
27.
Projected vector modification as mitigation for machine learning model string stuffing
An artifact is received from which features are extracted so as to populate a vector. The features in the vector can be reduced using a feature reduction operations to result in a modified vector having a plurality of buckets. A presence of predetermined types of features are identified within buckets of the modified vector influencing a score above a pre-determined threshold. A contribution of the identified features within the high influence buckets of the modified vector is then attenuated. The modified vector is input into a classification model to generate a score which can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
G06F 21/52 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p.ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
An artifact is received from which features are extracted and used to populate a vector. The features in the vector are then reduced using a feature reduction operation to result in a modified vector having a plurality of buckets. Features within the buckets of the modified vector above a pre-determined projected bucket clipping threshold are then identified. Using the identified features, and overflow vector is then generated. The modified vector is then input into a classification model to generate a score. This score is adjusted based on the overflow vector and can then be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
G06F 21/00 - Dispositions de sécurité pour protéger les calculateurs, leurs composants, les programmes ou les données contre une activité non autorisée
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
A system is provided for classifying an instruction sequence with a machine learning model. The system may include at least one processor and at least one memory. The memory may include program code that provides operations when executed by the at least one processor. The operations may include: processing an instruction sequence with a trained machine learning model configured to detect one or more interdependencies amongst a plurality of tokens in the instruction sequence and determine a classification for the instruction sequence based on the one or more interdependencies amongst the plurality of tokens; and providing, as an output, the classification of the instruction sequence. Related methods and articles of manufacture, including computer program products, are also provided.
An artefact is received. Features are extracted from this artefact which are, in turn, used to populate a vector. The vector is then input into a classification model to generate a score. The score is then modified using a step function so that the true score is not obfuscated. Thereafter, the modified score can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
Hash-based application programming interface (API) importing can be prevented by allocating a name page and a guard page in memory. The name page and the guard page being associated with (i) an address of names array, (ii) an address of name ordinal array, and (iii) an address of functions array that are all generated by an operating system upon initiation of an application. The name page can then be filled with valid non-zero characters. Thereafter, protections on the guard page can be changed to no access. An entry is inserted into the address of names array pointing to a relative virtual address corresponding to anywhere within the name page. Access to the guard page causes the requesting application to terminate. Related apparatus, systems, techniques and articles are also described.
G06F 12/00 - Accès à, adressage ou affectation dans des systèmes ou des architectures de mémoires
G06F 12/1018 - Traduction d'adresses avec tables de pages, p.ex. structures de table de page impliquant des techniques de hachage, p.ex. tables de page inversée
G06F 9/30 - Dispositions pour exécuter des instructions machines, p.ex. décodage d'instructions
Hash-based application programming interface (API) importing can be prevented by allocating a name page and a guard page in memory. The name page and the guard page being associated with (i) an address of names array, (ii) an address of name ordinal array, and (iii) an address of functions array that are all generated by an operating system upon initiation of an application. The name page can then be filled with valid non-zero characters. Thereafter, protections on the guard page can be changed to no access. An entry is inserted into the address of names array pointing to a relative virtual address corresponding to anywhere within the name page. Access to the guard page causes the requesting application to terminate. Related apparatus, systems, techniques and articles are also described.
G06F 12/00 - Accès à, adressage ou affectation dans des systèmes ou des architectures de mémoires
G06F 12/1018 - Traduction d'adresses avec tables de pages, p.ex. structures de table de page impliquant des techniques de hachage, p.ex. tables de page inversée
G06F 9/50 - Allocation de ressources, p.ex. de l'unité centrale de traitement [UCT]
G06F 9/30 - Dispositions pour exécuter des instructions machines, p.ex. décodage d'instructions
Executable memory space is protected by receiving, from a process, a request to configure a portion of memory with a memory protection attribute that allows the process to perform at least one memory operation on the portion of the memory. Thereafter, the request is responded to with a grant, configuring the portion of memory with a different memory protection attribute than the requested memory protection attribute. The different memory protection attribute restricting the at least one memory operation from being performed by the process on the portion of the memory. In addition, it is detected when the process attempts, in accordance with the grant, the at least one memory operation at the configured portion of memory. Related systems and articles of manufacture, including computer program products, are also disclosed.
G06F 12/14 - Protection contre l'utilisation non autorisée de mémoire
G06F 21/79 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du stockage de données dans les supports de stockage à semi-conducteurs, p.ex. les mémoires adressables directement
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p.ex. par clés ou règles de contrôle de l’accès
34.
Centroid for improving machine learning classification and info retrieval
Centroids are used for improving machine learning classification and information retrieval. A plurality of files are classified as malicious or not malicious based on a function dividing a coordinate space into at least a first portion and a second portion such that the first portion includes a first subset of the plurality of files classified as malicious. One or more first centroids are defined in the first portion that classify files from the first subset as not malicious. A file is determined to be malicious based on whether the file is located within the one or more first centroids.
Each of a plurality of endpoint computer systems monitors data relating to a plurality of events occurring within an operating environment of the corresponding endpoint computer system. The monitoring can include receiving and/or inferring the data using one or more sensors executing on the endpoint computer systems Thereafter, for each endpoint computer system, artifacts used in connection with the events are stored in a vault maintained on such endpoint computer system. A query is later received by at least a subset of the plurality of endpoint computer systems from a server. Such endpoint computer systems, in response, identify and retrieve artifacts within the corresponding vaults response to the query. Results responsive to the query including or characterizing the identified artifacts is then provided by the endpoint computer systems receiving the query to the server.
An artefact is received. Thereafter, features are extracted from the artefact and a vector is populated. Later, one of a plurality of available classification models is selected. The classification models use different scoring paradigms while providing the same or substantially similar classifications. The vector is input into the selected classification model to generate a score. The score is later provided to a consuming application or process. The classification model can characterize the artefact as being malicious or benign to access, execute, or continue to execute so that appropriate remedial action can be taken or initiated by the consuming application or process. Related apparatus, systems, techniques and articles are also described.
An artefact is received. Features are extracted from this artefact which are, in turn, used to populate a vector. The vector is then input into a classification model to generate a score. The score is then modified using a step function so that the true score is not obfuscated. Thereafter, the modified score can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
An artefact is received. Features are later extracted from the artefact and are used to populate a vector. The vector is input into a classification model to generate a score. This score is then modified using a time-based oscillation function and is provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
An artefact is received. Features are extracted from this artefact which are, in turn, used to populate a vector. The vector is then input into a classification model to generate a score. The score is then modified to result in a modified score by interleaving the generated score or a mapping thereof into digits of a pseudo-score. Thereafter, the modified score can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
An artefact is received. Features are extracted from this artefact which are, in turn, used to populate a vector. The vector is then input into a classification model to generate a score. The score is then modified using a step function so that the true score is not obfuscated. Thereafter, the modified score can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
Systems, methods, and devices are described herein for detecting abnormalities within a system based on signal fingerprinting. A plurality of electrical signals are concurrently received from a transceiver over a time period. The time period is partitioned into a plurality of sampling windows. An electrical signal of the plurality of electrical signals is sequentially selected. For the sequentially selected electrical signal, a temporal snapshot of said electrical signal is iteratively captured over a sampling window of the plurality of sampling windows. This iterative capturing is repeated for remaining sampling windows of the plurality of sampling windows. Each captured temporal snapshot is temporally concatenated over the time period according to its respective temporal position of the time period to generate the signal fingerprint.
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06F 21/85 - Protection des dispositifs de saisie, d’affichage de données ou d’interconnexion dispositifs d’interconnexion, p.ex. les dispositifs connectés à un bus ou les dispositifs en ligne
H04L 29/06 - Commande de la communication; Traitement de la communication caractérisés par un protocole
Systems are provided herein for communications bus signal fingerprinting. A security module monitors a plurality of voltage lines of at least one electronic control unit (ECU) electrically coupled to a communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. The voltage differential is compared to a plurality of predetermined signal fingerprints associated with the at least one ECU. A variance in the compared voltage differential is identified relative to one or more of the plurality of predetermined signal fingerprints. Data characterizing the identified variance is provided.
An artefact is received. Features from such artefact are extracted and then populated in a vector. Subsequently, one of a plurality of available dimension reduction techniques are selected. Using the selected dimension reduction technique, the features in the vector are reduced. The vector is then input into a classification model and the score can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
Systems, methods, and devices are described herein for detecting abnormalities within a system based on signal fingerprinting. A plurality of electrical signals are concurrently received from a transceiver over a time period. The time period is partitioned into a plurality of sampling windows. An electrical signal of the plurality of electrical signals is sequentially selected. For the sequentially selected electrical signal, a temporal snapshot of said electrical signal is iteratively captured over a sampling window of the plurality of sampling windows. This iterative capturing is repeated for remaining sampling windows of the plurality of sampling windows. Each captured temporal snapshot is temporally concatenated over the time period according to its respective temporal position of the time period to generate the signal fingerprint.
A plurality of events associated with each of a plurality of computing nodes that form part of a network topology are monitored. The network topology includes antivirus tools to detect malicious software prior to it accessing one of the computing nodes. Thereafter, it is determined that, using at least one machine learning model, at least one of the events is indicative of malicious activity that has circumvented or bypassed the antivirus tools. Data is then provided that characterizes the determination. Related apparatus, systems, techniques and articles are also described.
G06F 21/53 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p.ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par exécution dans un environnement restreint, p.ex. "boîte à sable" ou machine virtuelle sécurisée
G06N 3/00 - Agencements informatiques fondés sur des modèles biologiques
46.
Machine learning model for malware dynamic analysis
In some implementations there may be provided a system. The system may include a processor and a memory. The memory may include program code which causes operations when executed by the processor. The operations may include analyzing a series of events contained in received data. The series of events may include events that occur during the execution of a data object. The series of events may be analyzed to at least extract, from the series of events, subsequences of events. A machine learning model may determine a classification for the received data. The machine learning model may classify the received data based at least on whether the subsequences of events are malicious. The classification indicative of whether the received data is malicious may be provided. Related methods and articles of manufacture, including computer program products, are also disclosed.
Data is received as part of an authentication procedure to identify a user. Such data characterizes a user-generated biometric sequence that is generated by the user interacting with at least one input device according to a desired biometric sequence. Thereafter, using the received data and at least one machine learning model trained using empirically derived historical data generated by a plurality of user-generated biometric sequences (e.g., historical user-generated biometric sequences according to the desired biometric sequence, etc.), the user is authenticated if an output of the at least one machine learning model is above a threshold. Data can be provided that characterizes the authenticating. Related apparatus, systems, techniques and articles are also described.
H04L 9/32 - Dispositions pour les communications secrètes ou protégées; Protocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
G06N 5/022 - Ingénierie de la connaissance; Acquisition de la connaissance
G06F 21/40 - Authentification de l’utilisateur sous réserve d’un quorum, c. à d. avec l’intervention nécessaire d’au moins deux responsables de la sécurité
G06K 9/62 - Méthodes ou dispositions pour la reconnaissance utilisant des moyens électroniques
G06F 21/32 - Authentification de l’utilisateur par données biométriques, p.ex. empreintes digitales, balayages de l’iris ou empreintes vocales
A system is provided for training a machine learning model to detect malicious container files. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one processor provides operations including: processing a container file with a trained machine learning model, wherein the trained machine learning is trained to determine a classification for the container file indicative of whether the container file includes at least one file rendering the container file malicious; and providing, as an output by the trained machine learning model, an indication of whether the container file includes the at least one file rendering the container file malicious. Related methods and articles of manufacture, including computer program products, are also disclosed.
In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.
A mismatch between model-based classifications produced by a first version of a machine learning threat discernment model and a second version of a machine learning threat discernment model for a file is detected. The mismatch is analyzed to determine appropriate handling for the file, and taking an action based on the analyzing. The analyzing includes comparing a human-generated classification status for a file, a first model version status that reflects classification by the first version of the machine learning threat discernment model, and a second model version status that reflects classification by the second version of the machine learning threat discernment model. The analyzing can also include allowing the human-generated classification status to dominate when it is available.
G06F 21/51 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade du chargement de l’application, p.ex. en acceptant, en rejetant, en démarrant ou en inhibant un logiciel exécutable en fonction de l’intégrité ou de la fiabilité de la source
H04L 29/06 - Commande de la communication; Traitement de la communication caractérisés par un protocole
G06F 3/048 - Techniques d’interaction fondées sur les interfaces utilisateur graphiques [GUI]
51.
Machine learning classification using Markov modeling
Systems, methods, and articles of manufacture, including computer program products, are provided for classification systems and methods using modeling. In some example embodiments, there is provided a system that includes at least one processor and at least one memory including program code which when executed by the at least one memory provides operations. The operations can include generating a representation of a sequence of sections of a file and/or determining, from a model including conditional probabilities, a probability for each transition between at least two sequential sections in the representation. The operations can further include classifying the file based on the probabilities for each transition.
Data is analyzed using feature hashing to detect malware. A plurality of features in a feature set is hashed. The feature set is generated from a sample. The sample includes at least a portion of a file. Based on the hashing, one or more hashed features are indexed to generate an index vector. Each hashed feature corresponds to an index in the index vector. Using the index vector, a training dataset is generated. Using the training dataset, a machine learning model for identifying at least one file having a malicious code is trained.
An artefact is received and parsed into a plurality of observations. A first subset of the observations are inputted into a machine learning model trained using historical data to classify the artefact. In addition, a second subset of the observations are inputted into a xenospace centroid configured to classify the artefact. Thereafter, the artefact is classified based on a combination of an output of the machine learning model and an output of xenospace centroid. Related apparatus, systems, techniques and articles are also described.
An artefact is received and parsed into a plurality of observations. A first subset of the observations are inputted into a machine learning model trained using historical data to classify the artefact. In addition, a second subset of the observations are inputted into a xenospace centroid configured to classify the artefact. Thereafter, the artefact is classified based on a combination of an output of the machine learning model and an output of xenospace centroid. Related apparatus, systems, techniques and articles are also described.
An identity of a user on a first computing node of a plurality of nodes within a computing environment is authenticated. A first authentication score for the user is calculated at the first computing node using at least one machine learning model. The first authentication score characterize interactions of the user with the first computing node. Subsequent to such authentication, traversal of the user from the first computing node to other computing nodes among the plurality of computing nodes are monitored. An authentication score characterizing interactions of the user with the corresponding computing node are calculated at each of the nodes using respective machine learning models executing on such nodes The respective machine learning models use, as an attribute, an authentication score calculated at a previously traversed computing node. Thereafter, an action is initiated at one of the computing nodes based on the calculated authentication scores.
In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code that provides operations when executed by the at least one processor. The operations may include: reducing a dimensionality of a plurality of features representative of a file set; determining, based at least on a reduced dimensional representation of the file set, a distance between a file and the file set; and determining, based at least on the distance between the file and the file set, a classification for the file. Related methods and articles of manufacture, including computer program products, are also provided.
In one respect, there is provided a system for training a machine learning model to detect malicious container files. The system may include at least one processor and at least one memory. The at least one memory may include program code that provides operations when executed by the at least one processor. The operations may include: training, based on a training data, a machine learning model to enable the machine learning model to determine whether at least one container file includes at least one file rendering the at least one container file malicious; and providing the trained machine learning model to enable the determination of whether the at least one container file includes at least one file rendering the at least one container file malicious. Related methods and articles of manufacture, including computer program products, are also disclosed.
G06F 21/56 - Détection ou gestion de programmes malveillants, p.ex. dispositions anti-virus
G06F 21/50 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation
G06N 20/20 - Techniques d’ensemble en apprentissage automatique
G06N 20/10 - Apprentissage automatique utilisant des méthodes à noyaux, p.ex. séparateurs à vaste marge [SVM]
Centroids are used for improving machine learning classification and information retrieval. A plurality of files are classified as malicious or not malicious based on a function dividing a coordinate space into at least a first portion and a second portion such that the first portion includes a first subset of the plurality of files classified as malicious. One or more first centroids are defined in the first portion that classify files from the first subset as not malicious. A file is determined to be malicious based on whether the file is located within the one or more first centroids.
Identifying shellcode in a sequence of instructions by identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions, identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions, and generating a distribution for the sequence of instructions, bounded by the first instruction and the second instructions, the distribution indicative of whether the sequence of instructions is likely to include shellcode.
A nested file having a primary file and at least one secondary file embedded therein is parsed using at least one parser of a cell. The cell assigns a maliciousness score to each of the parsed primary file and each of the parsed at least one secondary file. Thereafter, the cell generates an overall maliciousness score for the nested file that indicates a level of confidence that the nested file contains malicious content. The overall maliciousness score is provided to a data consumer indicating whether to proceed with consuming the data contained within the nested file.
H04L 9/00 - Dispositions pour les communications secrètes ou protégées; Protocoles réseaux de sécurité
G06F 21/57 - Certification ou préservation de plates-formes informatiques fiables, p.ex. démarrages ou arrêts sécurisés, suivis de version, contrôles de logiciel système, mises à jour sécurisées ou évaluation de vulnérabilité
An endpoint computer system can harvest data relating to a plurality of events occurring within an operating environment of the endpoint computer system and can add the harvested data to a local data store maintained on the endpoint computer system. A query response can be generated, for example by identifying and retrieving responsive data from the local data store. The responsive data are related to an artifact on the endpoint computer system and/or to an event of the plurality of events. In some examples, the local data store can be an audit log and/or can include one or more tamper resistant features. Systems, methods, and computer program products are described.
G06F 21/00 - Dispositions de sécurité pour protéger les calculateurs, leurs composants, les programmes ou les données contre une activité non autorisée
G06F 21/56 - Détection ou gestion de programmes malveillants, p.ex. dispositions anti-virus
G06F 21/64 - Protection de l’intégrité des données, p.ex. par sommes de contrôle, certificats ou signatures
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06N 5/04 - Modèles d’inférence ou de raisonnement
H04L 9/30 - Clé publique, c. à d. l'algorithme de chiffrement étant impossible à inverser par ordinateur et les clés de chiffrement des utilisateurs n'exigeant pas le secret
62.
Deployment of machine learning models for discernment of threats
A mismatch between model-based classifications produced by a first version of a machine learning threat discernment model and a second version of a machine learning threat discernment model for a file is detected. The mismatch is analyzed to determine appropriate handling for the file, and taking an action based on the analyzing. The analyzing includes comparing a human-generated classification status for a file, a first model version status that reflects classification by the first version of the machine learning threat discernment model, and a second model version status that reflects classification by the second version of the machine learning threat discernment model. The analyzing can also include allowing the human-generated classification status to dominate when it is available.
G06F 21/51 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade du chargement de l’application, p.ex. en acceptant, en rejetant, en démarrant ou en inhibant un logiciel exécutable en fonction de l’intégrité ou de la fiabilité de la source
H04L 29/06 - Commande de la communication; Traitement de la communication caractérisés par un protocole
G06F 3/048 - Techniques d’interaction fondées sur les interfaces utilisateur graphiques [GUI]
63.
Retention and accessibility of data characterizing events on an endpoint computer
An endpoint computer system can harvest data relating to a plurality of events occurring within an operating environment of the endpoint computer system and can add the harvested data to a local data store maintained on the endpoint computer system. In some examples, the local data store can be an audit log and/or can include one or more tamper resistant features. Systems, methods, and computer program products are described.
G06F 21/00 - Dispositions de sécurité pour protéger les calculateurs, leurs composants, les programmes ou les données contre une activité non autorisée
G06F 21/56 - Détection ou gestion de programmes malveillants, p.ex. dispositions anti-virus
G06F 21/64 - Protection de l’intégrité des données, p.ex. par sommes de contrôle, certificats ou signatures
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06N 5/04 - Modèles d’inférence ou de raisonnement
H04L 9/30 - Clé publique, c. à d. l'algorithme de chiffrement étant impossible à inverser par ordinateur et les clés de chiffrement des utilisateurs n'exigeant pas le secret
G08B 13/14 - Déclenchement mécanique par l'enlèvement ou les essais de déplacement d'articles portatifs
In one respect, there is provided a system for classifying malware. The system may include a data processor and a memory. The memory may include program code that provides operations when executed by the processor. The operations may include: providing, to a display, contextual information associated with a file to at least enable a classification of the file, when a malware classifier is unable to classify the file; receiving, in response to the providing of the contextual information, the classification of the file; and updating, based at least on the received classification of the file, the malware classifier to enable the malware classifier to classify the file. Methods and articles of manufacture, including computer program products, are also provided.
In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code that provides operations when executed by the at least one memory. The operations may include: extracting, from an icon associated with a file, one or more features; assigning, based at least on the one or more features, the icon to one of a plurality of clusters; and generating, based at least on the cluster to which the icon is assigned, a classification for the file associated with the icon. Related methods and articles of manufacture, including computer program products, are also provided.
G06K 9/66 - Méthodes ou dispositions pour la reconnaissance utilisant des moyens électroniques utilisant des comparaisons ou corrélations simultanées de signaux images avec une pluralité de références, p.ex. matrice de résistances avec des références réglables par une méthode adaptative, p.ex. en s'instruisant
G06K 9/46 - Extraction d'éléments ou de caractéristiques de l'image
Data is received or accessed that includes a structured file encapsulating data required by an execution environment to manage executable code wrapped within the structured file. Thereafter, code and data regions are iteratively identified in the structured file. Such identification is analyzed so that at least one feature can be extracted from the structured file. Related apparatus, systems, techniques and articles are also described.
37 - Services de construction; extraction minière; installation et réparation
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Consulting services in the field of implementation of computer hardware for preventing unauthorized access to computers and electronics systems. Providing online non-downloadable software for use in preventing unauthorized access to computer and electronics systems; providing online non-downloadable internet security software; consulting services in the field of downloadable and non-downloadable internet security software; consulting services in the fields of the design and development of computer hardware and software for preventing unauthorized access to computers and electronics systems; consulting services in the fields of the design, development, and implementation of computer software for preventing unauthorized access to computers and electronics systems; consulting services in the field of internet security software.
68.
Machine learning model for malware dynamic analysis
In some implementations there may be provided a system. The system may include a processor and a memory. The memory may include program code which causes operations when executed by the processor. The operations may include analyzing a series of events contained in received data. The series of events may include events that occur during the execution of a data object. The series of events may be analyzed to at least extract, from the series of events, subsequences of events. A machine learning model may determine a classification for the received data. The machine learning model may classify the received data based at least on whether the subsequences of events are malicious. The classification indicative of whether the received data is malicious may be provided. Related methods and articles of manufacture, including computer program products, are also disclosed.
Described are techniques to enable computers to efficiently determine if they should run a program based on an immediate (i.e., real-time, etc.) analysis of the program. Such an approach leverages highly trained ensemble machine learning algorithms to create a real-time discernment on a combination of static and dynamic features collected from the program, the computer's current environment, and external factors. Related apparatus, systems, techniques and articles are also described.
G06F 21/51 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade du chargement de l’application, p.ex. en acceptant, en rejetant, en démarrant ou en inhibant un logiciel exécutable en fonction de l’intégrité ou de la fiabilité de la source
G06F 21/56 - Détection ou gestion de programmes malveillants, p.ex. dispositions anti-virus
H04L 29/06 - Commande de la communication; Traitement de la communication caractérisés par un protocole
G06F 21/52 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p.ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données
70.
Communications bus data transmission using relative ground shifting
Methods are described herein for communications bus data transmission using relative ground shifting. A plurality of voltage lines of at least one electronic control unit (ECU) are monitored. The at least one ECU electrically coupled to a communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. A pulse or data stream is injected into the communications bus via one or two voltage lines based on the measured voltage differential having an amplitude lower than a predetermined voltage threshold.
G06F 21/00 - Dispositions de sécurité pour protéger les calculateurs, leurs composants, les programmes ou les données contre une activité non autorisée
G06F 21/81 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur en agissant sur l’alimentation, p.ex. en branchant ou en débranchant l’alimentation, les fonctions de mise en veille ou de reprise
G06F 21/75 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du calcul ou du traitement de l’information par inhibition de l’analyse de circuit ou du fonctionnement, p.ex. pour empêcher l'ingénierie inverse
H04L 5/16 - Systèmes semi-duplex; Commutation duplex-simplex; Transmission de signaux de rupture
In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.
Data is received as part of an authentication procedure to identify a user. Such data characterizes a user-generated biometric sequence that is generated by the user interacting with at least one input device according to a desired biometric sequence. Thereafter, using the received data and at least one machine learning model trained using empirically derived historical data generated by a plurality of user-generated biometric sequences (e.g., historical user-generated biometric sequences according to the desired biometric sequence, etc.), the user is authenticated if an output of the at least one machine learning model is above a threshold. Data can be provided that characterizes the authenticating. Related apparatus, systems, techniques and articles are also described.
Data is received as part of an authentication procedure to identify a user. Such data characterizes a user-generated biometric sequence that is generated by the user interacting with at least one input device according to a desired biometric sequence. Thereafter, using the received data and at least one machine learning model trained using empirically derived historical data generated by a plurality of user-generated biometric sequences (e.g., historical user-generated biometric sequences according to the desired biometric sequence, etc.), the user is authenticated if an output of the at least one machine learning model is above a threshold. Data can be provided that characterizes the authenticating. Related apparatus, systems, techniques and articles are also described.
G06F 21/00 - Dispositions de sécurité pour protéger les calculateurs, leurs composants, les programmes ou les données contre une activité non autorisée
H04L 9/32 - Dispositions pour les communications secrètes ou protégées; Protocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
G06N 5/02 - Représentation de la connaissance; Représentation symbolique
G06F 21/40 - Authentification de l’utilisateur sous réserve d’un quorum, c. à d. avec l’intervention nécessaire d’au moins deux responsables de la sécurité
G06K 9/62 - Méthodes ou dispositions pour la reconnaissance utilisant des moyens électroniques
G06F 21/32 - Authentification de l’utilisateur par données biométriques, p.ex. empreintes digitales, balayages de l’iris ou empreintes vocales
H04L 29/06 - Commande de la communication; Traitement de la communication caractérisés par un protocole
G06F 21/36 - Authentification de l’utilisateur par représentation graphique ou iconique
H04W 12/00 - Dispositions de sécurité; Authentification; Protection de la confidentialité ou de l'anonymat
In one aspect, a computer-implemented method is disclosed. The computer-implemented method may include determining a sketch matrix that approximates a matrix representative of a reference dataset. The reference dataset may include at least one computer program having a predetermined classification. A reduced dimension representation of the reference dataset may be generated based at least on the sketch matrix. The reduced dimension representation may have a fewer quantity of features than the reference dataset. A target computer program may be classified based on the reduced dimension representation. The target computer program may be classified to determine whether the target computer program is malicious. Related systems and articles of manufacture, including computer program products, are also disclosed.
G06F 21/51 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade du chargement de l’application, p.ex. en acceptant, en rejetant, en démarrant ou en inhibant un logiciel exécutable en fonction de l’intégrité ou de la fiabilité de la source
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06K 9/62 - Méthodes ou dispositions pour la reconnaissance utilisant des moyens électroniques
An agent inserts one or more hooks into a sub-execution runtime environment that is configured to include a script and/or targeted to include the script. The agent including the one or more hooks monitors a behavior of the sub-execution runtime environment and/or the script. The agent subsequently obtains context information regarding the sub-execution runtime environment and/or the script so that it can control the runtime of at least the sub-execution runtime environment. Related systems, methods, and articles of manufacture are also disclosed.
G06F 11/34 - Enregistrement ou évaluation statistique de l'activité du calculateur, p.ex. des interruptions ou des opérations d'entrée–sortie
G06F 21/54 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p.ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par ajout de routines ou d’objets de sécurité aux programmes
G06F 9/448 - Paradigmes d’exécution, p.ex. implémentation de paradigmes de programmation
G06F 9/46 - Dispositions pour la multiprogrammation
G06F 21/56 - Détection ou gestion de programmes malveillants, p.ex. dispositions anti-virus
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
providing online non-downloadable software for use in preventing unauthorized access to computer and electronics systems; providing online non-downloadable internet security software; consulting services in the field of downloadable and non-downloadable Internet security software; consulting services in the fields of the design, development, and implementation of computer hardware and software for preventing unauthorized access to computers and electronics systems; consulting services in the field of internet security software
77.
COMMUNICATIONS BUS DATA TRANSMISSION USING RELATIVE GROUND SHIFTING
Methods are described herein for communications bus data transmission using relative ground shifting. A plurality of voltage lines of at least one electronic control unit (ECU) are monitored. The at least one ECU electrically coupled to a communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. A pulse or data stream is injected into the communications bus via one or two voltage lines based on the measured voltage differential having an amplitude lower than a predetermined voltage threshold.
G06F 21/00 - Dispositions de sécurité pour protéger les calculateurs, leurs composants, les programmes ou les données contre une activité non autorisée
78.
Endpoint detection and response system with endpoint-based artifact storage
Each of a plurality of endpoint computer systems monitors data relating to a plurality of events occurring within an operating environment of the corresponding endpoint computer system. The monitoring can include receiving and/or inferring the data using one or more sensors executing on the endpoint computer systems Thereafter, for each endpoint computer system, artifacts used in connection with the events are stored in a vault maintained on such endpoint computer system. A query is later received by at least a subset of the plurality of endpoint computer systems from a server. Such endpoint computer systems, in response, identify and retrieve artifacts within the corresponding vaults response to the query. Results responsive to the query including or characterizing the identified artifacts is then provided by the endpoint computer systems receiving the query to the server.
An endpoint computer system monitors data relating to a plurality of events occurring within an operating environment of the endpoint computer system. The monitoring can include receiving and/or inferring the data using one or more sensors executing on the endpoint computer system. The endpoint computer system can store artifacts used in connection with the plurality of events in a vault maintained on such endpoint computer system. The endpoint computer system, in response to a trigger, identifies and retrieves metadata characterizing artifacts associated with the trigger from the vault. Such identified and retrieved metadata is then provided by the endpoint computer system to a remote server.
Each of a plurality of endpoint computer systems monitors data relating to a plurality of events occurring within an operating environment of the corresponding endpoint computer system. The monitoring can include receiving and/or inferring the data using one or more sensors executing on the endpoint computer systems Thereafter, for each endpoint computer system, artifacts used in connection with the events are stored in a vault maintained on such endpoint computer system. A query is later received by at least a subset of the plurality of endpoint computer systems from a server. Such endpoint computer systems, in response, identify and retrieve artifacts within the corresponding vaults response to the query. Results responsive to the query including or characterizing the identified artifacts is then provided by the endpoint computer systems receiving the query to the server.
An endpoint computer system monitors data relating to a plurality of events occurring within an operating environment of the endpoint computer system. The monitoring can include receiving and/or inferring the data using one or more sensors executing on the endpoint computer system. The endpoint computer system can store artifacts used in connection with the plurality of events in a vault maintained on such endpoint computer system. The endpoint computer system, in response to a trigger, identifies and retrieves metadata characterizing artifacts associated with the trigger from the vault. Such identified and retrieved metadata is then provided by the endpoint computer system to a remote server.
Under one aspect, a method is provided for protecting a device from a malicious file. The method can be implemented by one or more data processors forming part of at least one computing device and can include extracting from the file, by at least one data processor, sequential data comprising discrete tokens. The method also can include generating, by at least one data processor, n-grams of the discrete tokens. The method also can include generating, by at least one data processor, a vector of weights based on respective frequencies of the n-grams. The method also can include determining, by at least one data processor and based on a statistical analysis of the vector of weights, that the file is likely to be malicious. The method also can include initiating, by at least one data processor and responsive to determining that the file is likely to be malicious, a corrective action.
Systems are provided herein for a hardware protection framework. A security module monitors a plurality of voltage lines of at least one electronic control unit (ECU) electrically coupled to a communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. The voltage differential is compared to a plurality of predetermined signal fingerprints associated with the at least one ECU. A variance in the compared voltage differential is identified relative to one or more of the plurality of predetermined signal fingerprints. Data characterizing the identified variance is provided. In some aspects, a pulse or a data stream is injected based on the voltage differential having an amplitude lower than a predetermined voltage threshold.
Methods are provided herein for communications bus signal fingerprinting. A security module monitors a plurality of voltage lines of at least one electronic control unit (ECU) electrically coupled to a communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. The voltage differential is compared to a plurality of predetermined signal fingerprints associated with the at least one ECU. A variance in the compared voltage differential is identified relative to one or more of the plurality of predetermined signal fingerprints. Data characterizing the identified variance is provided.
Methods are described herein for communications bus data transmission using relative ground shifting. A plurality of voltage lines of at least one electronic control unit (ECU) are monitored. The at least one ECU electrically coupled to a communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. A pulse or data stream is injected into the communications bus via one or two voltage lines based on the measured voltage differential having an amplitude lower than a predetermined voltage threshold.
G06F 21/00 - Dispositions de sécurité pour protéger les calculateurs, leurs composants, les programmes ou les données contre une activité non autorisée
G06F 21/81 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur en agissant sur l’alimentation, p.ex. en branchant ou en débranchant l’alimentation, les fonctions de mise en veille ou de reprise
G06F 21/75 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du calcul ou du traitement de l’information par inhibition de l’analyse de circuit ou du fonctionnement, p.ex. pour empêcher l'ingénierie inverse
H04L 5/16 - Systèmes semi-duplex; Commutation duplex-simplex; Transmission de signaux de rupture
86.
ELECTRONIC CONTROL UNIT PROTECTION FRAMEWORK USING SECURITY ZONES
Systems are provided herein for a hardware protection framework. A security module monitors a plurality of voltage lines of at least one electronic control unit (ECU) electrically coupled to a communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. The voltage differential is compared to a plurality of predetermined signal fingerprints associated with the at least one ECU. A variance in the compared voltage differential is identified relative to one or more of the plurality of predetermined signal fingerprints. Data characterizing the identified variance is provided. In some aspects, a pulse or a data stream is injected based on the voltage differential having an amplitude lower than a predetermined voltage threshold.
Methods are provided herein for communications bus signal fingerprinting. A security module monitors a plurality of voltage lines of at least one electronic control unit (ECU) electrically coupled to a communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. The voltage differential is compared to a plurality of predetermined signal fingerprints associated with the at least one ECU. A variance in the compared voltage differential is identified relative to one or more of the plurality of predetermined signal fingerprints. Data characterizing the identified variance is provided.
G06F 21/85 - Protection des dispositifs de saisie, d’affichage de données ou d’interconnexion dispositifs d’interconnexion, p.ex. les dispositifs connectés à un bus ou les dispositifs en ligne
88.
Redaction of artificial intelligence training documents
Systems and methods are provided herein for redaction of artificial intelligence (AI) training documents. Data comprising an unredacted document is received. The unredacted document comprises a plurality of objects arranged according to a first topology. The unredacted document is parsed to identify objects either directly or relationally containing user sensitive information using a predetermined rule set based on the first topology. The user sensitive information within the unredacted document is substituted with placeholder information to generate a redacted document having a second topology. The second topology is substantially identical to the first topology. In some variations, the redacted document is provided to an AI model for training.
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Internet security software; software for identifying and authenticating users; downloadable software for use in preventing unauthorized access to computers and electronics systems. Providing temporary use of non-downloadable internet security software; providing temporary use of non-downloadable software for identifying and authenticating users; providing temporary use of non-downloadable software for preventing unauthorized access to computers and electronics systems.
90.
Dictionary based deduplication of training set samples for machine learning based computer threat analysis
Presence of malicious code can be identified in one or more data samples. A feature set extracted from a sample is vectorized to generate a sparse vector. A reduced dimension vector representing the sparse vector can be generated. A binary representation vector of reduced dimension vector can be created by converting each value of a plurality of values in the reduced dimension vector to a binary representation. The binary representation vector can be added as a new element in a dictionary structure if the binary representation is not equal to an existing element in the dictionary structure. A training set for use in training a machine learning model can be created to include one vector whose binary representation corresponds to each of a plurality of elements in the dictionary structure.
Data is analyzed using feature hashing to detect malware. A plurality of features in a feature set is hashed. The feature set is generated from a sample. The sample includes at least a portion of a file. Based on the hashing, one or more hashed features are indexed to generate an index vector. Each hashed feature corresponds to an index in the index vector. Using the index vector, a training dataset is generated. Using the training dataset, a machine learning model for identifying at least one file having a malicious code is trained.
Contextual information associated with a file is provided to at least enable a classification of the file when a malware classifier is unable to classify the file. In response to the providing of the contextual information, the classification of the file is received. Based at least on the received classification of the file, the malware classifier is updated to enable the malware classifier to classify the file.
In one respect, there is provided a system for classifying malware. The system may include a data processor and a memory. The memory may include program code that provides operations when executed by the processor. The operations may include: providing, to a display, contextual information associated with a file to at least enable a classification of the file, when a malware classifier is unable to classify the file; receiving, in response to the providing of the contextual information, the classification of the file; and updating, based at least on the received classification of the file, the malware classifier to enable the malware classifier to classify the file. Methods and articles of manufacture, including computer program products, are also provided.
A plurality of events associated with each of a plurality of computing nodes that form part of a network topology are monitored. The network topology includes antivirus tools to detect malicious software prior to it accessing one of the computing nodes. Thereafter, it is determined that, using at least one machine learning model, at least one of the events is indicative of malicious activity that has circumvented or bypassed the antivirus tools. Data is then provided that characterizes the determination. Related apparatus, systems, techniques and articles are also described.
A plurality of events associated with each of a plurality of computing nodes that form part of a network topology are monitored. The network topology includes antivirus tools to detect malicious software prior to it accessing one of the computing nodes. Thereafter, it is determined that, using at least one machine learning model, at least one of the events is indicative of malicious activity that has circumvented or bypassed the antivirus tools. Data is then provided that characterizes the determination. Related apparatus, systems, techniques and articles are also described.
H04L 29/06 - Commande de la communication; Traitement de la communication caractérisés par un protocole
G06F 21/53 - Contrôle des usagers, programmes ou dispositifs de préservation de l’intégrité des plates-formes, p.ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p.ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par exécution dans un environnement restreint, p.ex. "boîte à sable" ou machine virtuelle sécurisée
G06N 3/00 - Agencements informatiques fondés sur des modèles biologiques
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Internet security software; software for preventing unauthorized access to computers and electronics systems; software for facilitating communications between a cloud and a local computing infrastructure providing online non-downloadable Internet security software; providing online non-downloadable software for preventing unauthorized access to computers and electronics systems; providing online non-downloadable software for facilitating communications between a cloud and a local computing infrastructure
09 - Appareils et instruments scientifiques et électriques
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
Internet security software; software for preventing unauthorized access to computers and electronics systems; software for updating and managing software agents on endpoints providing online non-downloadable Internet security software; providing online non-downloadable software for preventing unauthorized access to computers and electronics systems; providing online non-downloadable software for updating and managing software agents on endpoints
42 - Services scientifiques, technologiques et industriels, recherche et conception
Produits et services
consulting services in the field of downloadable and non-downloadable Internet security software; consulting services in the fields of the design, development, and implementation of computer hardware and software for preventing unauthorized access to computers and electronics systems; consulting services in the field of internet security software
09 - Appareils et instruments scientifiques et électriques
Produits et services
downloadable software accessible via a web interface for preventing unauthorized access to computers and electronics systems; downloadable internet security software
09 - Appareils et instruments scientifiques et électriques
Produits et services
Downloadable software accessible via a web interface for preventing unauthorized access to computers and electronics systems; downloadable internet security software
