1285 results about "Malware" patented technology

The invention discloses a substation network security defense system based on artificial intelligence. The system comprises a data collection module for collecting transformer substation network data; the anomaly detection module is used for identifying an abnormal mode and an intrusion behavior; the threat intelligence analysis module is used for identifying potential threat and vulnerability information; the intelligent security monitoring and response module is used for evaluating the network security state; the malicious code detection module is used for detecting, analyzing and isolating malicious software; the intelligent security prediction module is used for predicting a network security event and carrying out early warning prompt; the self-adaptive security policy module is used for automatically adjusting or updating an optimal security policy; the system updating and maintaining module is used for updating and maintaining system modules and functions; the user interface and alarm module is used for providing safety state display and alarm for a user; the data backup and recovery module is used for backing up and recovering key data; and a compliance auditing module which makes operation and configuration accord with security standards. According to the invention, hierarchical, intelligent and active protection of the transformer substation network is realized.

Systems and methods for detecting a phishing attack in an email message. The method includes intercepting and evaluating an email, and generating a reputation score based on the evaluation of the email message. If the malicious component is detected, the email is blocked, if not, a trust score is generated. A determination is made whether the email is generated by AI, based on LLM. A certainty score is generated which is indicative of intentions and context of the email message being malicious. When the certainty score is higher than a threshold, a combined score by combining the reputation score, the trust score, and the certainty score. When the combined reputation score is higher than a threshold, the email is blocked, and if lower, a summary is generated by a summary AI engine. Based on a comparison with known malware summaries, the email is flagged or blocked.

Embodiments of the disclosure provide systems and methods for detecting malicious software packages. Detecting malicious software packages can include collecting information identifying one or more known malicious software component classifiers, collecting information identifying one or more known suspicious community behavior classifiers associated with the one or more known malicious software component classifiers and receiving a software package including software components. The method also includes identifying one or more software components of the software package as malicious based on a comparison between the software components of the software package and each of the collected one or more known malicious software component classifiers and the collected one or more known suspicious community behavior classifiers, generating a malicious probability for each of the identified one or more software components and evaluating whether the software package is malicious based on the generated malicious probability for each of the identified one or more software components.

Techniques for identifying malware based on system API function pointers are disclosed. In some embodiments, a system / process / computer program product for identifying malware based on system API function pointers includes monitoring changes in memory during execution of a malware sample in a computing environment; detecting a dynamic evasion behavior using an Application Programming Interface (API) vector comprising a plurality of system API function pointers identified in the memory during execution of the malware sample in the computing environment; and generating a signature based on the API vector for automatically detecting the malware during execution in the memory, wherein the malware sample was determined to be malicious.

Various techniques for LLM powered detection reasoning solutions are disclosed. In some embodiments, a system, a process, and / or a computer program product for an LLM powered detection reasoning solution includes monitoring network traffic at a security platform, wherein the security platform generates a sample based on the monitored network traffic; sending the sample to a security service to generate a Large Language Model (LLM) powered detection and reason, wherein the LLM is prompted to automatically generate a malware or benign verdict and a reason for explaining the verdict; and reporting the LLM powered detection and reason.

Aspects of the subject disclosure may include, for example, obtaining a group of threat research reports, obtaining a group of indicators of compromise (IOCs), and monitoring a network of Internet of Things (IoT) devices. Further embodiments can include determining a group of possible malware on the network based on the monitoring of the network, and generating a network security recommendation based on the group of threat research reports based on the group of threat research reports, the group of IOCs, and the group of possible malware. Other embodiments are disclosed.

Methods and apparatus to determine machine learning (ML) configurations for classifying malware are disclosed. An example server comprises interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to determine a computing parameter associated with a computing device, the computing device communicatively coupled to the server, select a ML model to deploy on the computing device based on the computing parameter, determine a configuration of the ML model based on the computing parameter, deploy the ML model to the computing device, and cause the deployed ML model to classify a sample as clean or malicious, the sample received at the computing device.

A method for mitigating the effects of malware is provided. The method includes determining a compressibility of a portion of data, determining a data corruption condition is satisfied based on the determined compressibility, and modifying a retention policy for retention of stored snapshots associated with the portion of data based on the satisfaction of the data corruption condition. The modifying of the retention policy includes generating a first snapshot associated with the portion of the data, prior to writing cached data associated with the portion of the data, writing the cached data associated with the portion of the data, and generating a second snapshot associated with the portion of the data, responsive to the deletion.

Disclosed herein are devices, systems, and methods for detecting, understanding, and classifying malicious actions and / or behaviors in software (e.g., malware), including hidden malicious actions. Specifically, disclosed embodiments use natural language approaches to understand malicious software and provide explanations for classification results. At least one embodiment constructs a knowledge graph that includes textual explanations from source materials (e.g., articles), collecting one or more sets of dynamic program traces from one or more instances of malware, and constructing and training a model (also referred to herein as Trace-BERT) using the one or more sets of dynamic program traces. Forced execution of sample segments of computer code can also be used to identify hidden or novel malicious actions.

The invention belongs to the technical field of virtual machine mirror image static scanning, and particularly relates to a virtual machine mirror image static scanning method and system based on a hyper-fusion platform, and the method comprises the steps: creating a to-be-scanned mirror image storage snapshot, employing an index and retrieval algorithm, obtaining a static virtual machine mirror image file, extracting and recording metadata information of the static virtual machine mirror image file, and then carrying out integrity verification; collecting all-around resource data of the hyper-fusion platform in real time, and distributing corresponding resource quotas for scanning tasks by using a preset algorithm; multi-stage deep scanning is carried out, file fingerprints and feature matching are firstly used for preliminary screening, then misjudgment is eliminated through version intelligent comparison, potential high-risk vulnerabilities are deeply excavated for key complex components by adopting static code analysis, and configuration files in mirror images are comprehensively examined through rapid screening and positioning of known malicious software; and a preset algorithm is used for carrying out deep classification arrangement, correlation analysis and summary statistics on various types of result data, so that virtual machine mirror image scanning in a large-scale hyper-fusion cluster is completed in a relatively short time.

The present disclosure provides an approach of providing, to an artificial intelligence (AI) model, a malicious script that includes a malicious behavior. The AI model is configured to modify software code of the malicious script to produce modified software code that obfuscates the malicious behavior. The approach produces, by a processing device using the AI model, an adversarial script that includes the modified software code that obfuscates the malicious behavior. In turn, the approach initiates a malware detector to test the adversarial script.

A cloud-based network security system (NSS) is described. The NSS uses a sandbox to safely detonate and extract information about a document and uses machine learning algorithms to analyze the information to predict whether the document contains malicious software. Specifically, during the detonation, static and dynamic information about the document is captured in the sandbox as well as character strings from images in the document. The dynamic information (and sometimes the static information) is input to an AI or machine learning model trained to provide an output indicating a prediction of whether the document contains malware. The character strings are compared with a batch of phishing keywords to generate a heuristic score. A validation engine combines the output from the AI or machine learning model and the heuristic score to classify the document as malicious or clean. Security policies can then be applied based on the classification.

Techniques for detecting anomalous network behavior in operational technology (OT) protocols are disclosed. A system, process, and / or computer program product for detecting anomalous network behavior in OT protocols include monitoring network traffic to perform automated OT malware detection analysis of OT related network traffic, extracting one or more features from the OT related network traffic, inputting the one or more extracted features into a model for malware detection analysis, and performing an action based on a result of the model.

A data protection system uses machine learning to detect the cyber-attacks on a data protection system in advance to notify the user of possible attacks and also instigate any counter attacks to the best possible extent. The system trains a support vector machine model (SVM) to recognize a malware, or other type of attack before it comes into action against the system. This model learns the parameters of hazardous files or code to prepare the best model of attributes of such files to help block the malware proactively. It uses several independent variables as features to gain more accuracy to the threat detection. Some of the parameters include: rate of data change (Drastic / High / Low), attack vulnerability history, resource usage history, performance metrics, application hit ratio, and the like.

A machine learning ensemble receives input data from static analysis and dynamic analysis of binary files to output malicious / benign verdicts for the binary files. The machine learning ensemble comprises a structure aware dynamic compressor (“compressor”). The compressor receives a tree data structure generated based on Application Programming Interface calls of the binary files in various sandbox environments as input. The compressor performs various compression, tokenization, embedding, and reshaping operations to the tree data structure to generate a compressed tensor that preserves structural context from the tree data structure. The machine learning ensemble uses the compressed tensor to generate malicious / benign verdicts for the binary files.

A computer implemented malware protection method to mitigate malware spread within a set of communicating computer systems from an infected computer system is disclosed.

Techniques for machine learning for prioritizing traffic in multi-purpose inline cloud analysis (MICA) to enhance malware detection are disclosed. In some embodiments, a system, a process, and / or a computer program product for machine learning for prioritizing traffic in multi-purpose inline cloud analysis (MICA) to enhance malware detection includes processing a set of data for network security analysis to extract a file; determining that the file is to be offloaded to a cloud security entity for security processing based at least in part on a prefilter model that is implemented as a machine learning model; forwarding the file to the cloud security entity using a multi-purpose inline cloud analysis (MICA) channel; and performing an action in response to receiving a verdict from the cloud security entity.

A system for real-time detection and mitigation of morphing malware in high-density edge networks, consisting of: a data acquisition unit configured to receive, normalize, and encode multimodal telemetry data streams originating from at least one of the following domains: network traffic, process behavior, system call sequences, binary instruction traces, and control flow graphs; the data acquisition unit is further configured to compute feature embeddings over sliding time windows and apply privacy-preserving redactions prior to storage; a generative neural processor that is operationally coupled to the data acquisition unit and configured to generate synthetic morphing malware variants by learning probabilistic transformations of previously observed malicious data representations, maintaining semantic functionality while varying structural and behavioral features; a discriminative neural processor trained adversarially with the generative neural processor, wherein the discriminative neural processor is configured to detect morphing malware by evaluating a probability distribution over multimodal telemetry embeddings and classifying anomalous process and flow behaviors in real time; a coordination processor that is communicatively connected to both the generative neural processor and the discriminative neural processor and is configured to orchestrate adversarial co-training, regulate detection thresholds, calculate reinforcement-based penalties for false negative results, and trigger countermeasures as soon as a detection confidence level exceeds a predefined adaptive threshold; a secure, system-integrated inference and enforcement unit configured to perform low-latency countermeasures at the network edge, including selective packet filtering, flow isolation, process interruption, or system microsegmentation, based on instructions from the coordinating processor; and a hardware-embedded security enclave that is embedded in the system and configured to store cryptographic keys, neural model parameters, and integrity affirmation data to ensure the confidentiality, authenticity, and immutability of model artifacts and policy configurations.

A system and method for detecting anomalies and malicious processes by analyzing current consumption profiles is disclosed. The technique involves generating current consumption profiles that characterize the expected power draw for known software applications operating in various modes on a target device. At runtime, the current being consumed by actively running applications is measured and compared to the total expected current draw determined from the individual profiles. Deviations between the observed and expected consumption indicate potential interference from malware or other unwanted processes. Additionally, current fluctuation profiles are generated to model the characteristic transient current behavior when applications transition between operational modes. By comparing runtime current measurements during state changes to these expected transitional profiles, the system can identify aberrations indicative of background malware triggering during the transitions. The current monitoring approach provides an efficient way to detect anomalous behavior from unwanted processes with minimal overhead.

The invention relates to the technical field of network security, and discloses a malicious software response system and system based on artificial intelligence, and the system comprises a data sensing module, an intelligent analysis module, a risk quantification module and a dynamic defense module. The method corresponds to the system. According to the application, an efficient, intelligent and flexible malicious software response system is constructed by integrating key technologies such as distributed sensing, intelligent analysis, dynamic quantification and adaptive defense, the limitations in the aspects of data acquisition, threat identification, risk assessment and defense strategies are overcome, and the system also has strong self-learning ability and wide applicability; and a new direction and a new solution are provided for technical innovation in the field of network security.

A method and an electronic device for traffic tunneling in a distributed network for detecting malicious content are provided. The method comprises: transmitting, to a central server, a request for receiving a gateway data from a given gateway; in response to receiving the gateway data, adding the given gateway as a peer to a WireGuard interface of an electronic device; transmitting, to the central server, an Address Resolution Protocol (ARP) probe which is indicative of whether the electronic device is ready to establish a p2p connection with the given gateway; in response to receiving a response to the ARP probe, updating the gateway data in a neighbor table hosted on the given emitter; transmitting an outgoing traffic packet to the given gateway for natting; in response to receiving, from the given gateway, an incoming traffic packet, analyzing a content of the incoming traffic packet for maliciousness.

The invention provides a vulnerability assessment system, method and device based on malicious software behavior analysis, and relates to the technical field of network security. The system comprises a behavior capturing module which is used for operating malicious software through a virtual sandbox, collecting behavior logs generated in the operation process of the malicious software and generating a behavior data set; the feature extraction module is used for extracting behavior features from the behavior data set and generating a standardized feature set; the feature matching module is used for performing multi-dimensional mapping matching on the standardized feature set and the vulnerability features in the vulnerability feature database to obtain a matching result and a vulnerability identifier; the behavior modeling module is used for generating a behavior chain model through a time sequence modeling method based on the matching result and the standardized feature set; and the vulnerability evaluation module is used for generating an evaluation result. According to the technical scheme provided by the invention, the analysis capability and the quantification precision of the system on the vulnerability characteristics and the associated behaviors thereof can be improved, so that more accurate vulnerability evaluation is realized.

The invention discloses a network information security defense detection method and system, and relates to the technical field of network information security, and the system comprises a website security check module, a downloading security check module, an access security check module and a display execution module. In daily Internet surfing, net friends often encounter network security problems, for example, users may receive phishing mails disguised as banks or download malicious software in untrusted websites, resulting in data stealing. Identity embezzlement and data leakage increase privacy and financial risks, and man-in-the-middle attack may intercept sensitive information through an unencrypted Wi-Fi network. According to the method, security detection including domain name check, certificate verification, content scanning, integrity verification and the like is carried out on websites, downloading programs and external access equipment, so that security risks are found and processed in time; and meanwhile, by adopting a virtual machine isolation technology and behavior monitoring, the protection on malicious programs is enhanced, the security risk of external equipment is evaluated, and the security of a network environment and data is ensured.

Disclosed are systems and methods that monitor for malicious and unauthorized behaviors, determine categories for detected malicious behaviors, determine why a domain is determined to be malicious, and provide information to users that identifies the categories and reasons as to why a domain is determined to be malicious. In some implementations, the disclosed systems and methods may be utilized to provide monitoring security to customers of a cloud service. For example, customers of a cloud service may maintain an account with the cloud service and the disclosed implementations may be utilized to protect those accounts from malicious attacks and cybercrimes such as, but not limited to, spam, phishing, malware, botnets, etc.

The invention discloses a network attack perception induction method, and relates to the technical field of network security attacks, and the method comprises the steps: obtaining an APT malicious software gene model, obtaining behaviors generated during the operation of malicious software, carrying out the analysis, and constructing an APT family gene pool; obtaining an APT family gene bank, and performing classification extraction on the APT family gene bank to obtain an APT malicious behavior gene bank; acquiring an APT malicious behavior gene bank, identifying APT attack behaviors, establishing an attack path prediction model, determining an APT attack path and predicting a next APT activity; identifying the predicted bait most similar to the next attack target through a target similarity detection method, guiding the attack to migrate to the bait, and attracting an attacker to attack the bait; according to the method, the attack behavior can be induced, the attack can be actively carried out, the attack information can be more comprehensively captured, the defense capability of the network attack is greatly improved, and the network security is maintained.

Methods and systems for detecting anomalous software behavior by monitoring frequency spectrums emanating from an electronic device are provided. A method includes storing frequency spectrum profiles for software applications and operational modes on the device. During execution of a software application, the real-time emanating frequency spectrum is measured and compared to the stored spectrum profile for that application and operational mode. Deviations between the real-time and reference spectrums indicate anomalous behavior from unknown software executing. The device determines a deviation exists and performs remedial actions like alerting the user, disconnecting from the network, shutting down, or switching application execution to another device. Frequency profiles are measured for new applications installed and stored to keep the data updated. Monitoring real-time frequency spectrums emanating from a device provides a computationally lightweight technique for detecting malicious software behavior without requiring complex analysis of application code.

The invention relates to the technical field of security detection and situation analysis, discloses a security detection and situation analysis system for a software supply chain, and solves the problems that vulnerabilities in the software supply chain may be maliciously utilized, a security detection system of the system has certain limitation in the aspect of vulnerability detection, early warning and alarm mechanisms are not timely and accurate enough, and the security of the software supply chain is influenced. In order to solve the problems in the prior art that high requirements for software supply chain security are difficult to meet, an early warning and alarm module monitors output results of modules for vulnerability detection, malicious software detection, supply chain relation analysis and the like in real time, when security risks or abnormal conditions are detected, graded evaluation is performed according to preset rules and severity, and the security risk or abnormal conditions are detected. The early-warning and alarming module can quickly send out early-warning and alarming information, so that related personnel can timely know the early-warning and alarming module, the information can be timely and accurately transmitted by establishing interfaces of various notification channels, and an automatic analysis algorithm is adopted to quickly judge the safety condition and determine the early-warning level.

Various techniques for providing deep learning for inline detection of malicious command and control (C2) traffic from unstructured payloads are disclosed. In some embodiments, a system / process / computer program product for providing deep learning for inline detection of malicious C2 traffic from unstructured payloads includes monitoring a session at a security platform, wherein the session includes network traffic; executing a local deep learning model on the network traffic, wherein the local deep learning model is a machine learning implemented C2 (MLC2) model executed on the security platform; and performing an action in response to determining that the monitored session is associated with malware based at least in part on a verdict from the deep learning model.

An artificial intelligence (AI)-based system for detecting malware in endpoint devices using a multi-source data fusion and method thereof are disclosed. The AI-based system collects at least one of: endpoint visibility data, publicly available information, and sandbox analysis data using the multi-source data fusion. By using the collected data, the AI-based system generates one or more numerical embeddings for at least one of: one or more files and one or more applications of each endpoint device using one or more AI models. The AI-based system is configured with the one or more AI models to generate one or more dynamic directed graphs based on the generated one or more numerical embeddings to compute a maliciousness risk score. The maliciousness risk score of at least one of the: one or more files and one or more applications is used for detecting the malware in the one or more endpoint devices.

The technology disclosed relates to a method, system, and non-transitory computer-readable media that detects malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host, using a network security system. The network security system reroutes the cloud traffic to the network security system. The incoming requests of the cloud traffic are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources. The network security system analyzes the incoming requests, determines that the incoming requests are targeted at one or more malicious resources in the plurality of resources. Also, the network security system prevents transmission of the incoming requests to the malicious resources, by making the malicious resources unavailable for receiving future incoming requests, while keeping other resources in the plurality of resources available for receiving the future incoming requests.