874 results about "Malware" patented technology

Various techniques for LLM powered detection reasoning solutions are disclosed. In some embodiments, a system, a process, and / or a computer program product for an LLM powered detection reasoning solution includes monitoring network traffic at a security platform, wherein the security platform generates a sample based on the monitored network traffic; sending the sample to a security service to generate a Large Language Model (LLM) powered detection and reason, wherein the LLM is prompted to automatically generate a malware or benign verdict and a reason for explaining the verdict; and reporting the LLM powered detection and reason.

Aspects of the subject disclosure may include, for example, obtaining a group of threat research reports, obtaining a group of indicators of compromise (IOCs), and monitoring a network of Internet of Things (IoT) devices. Further embodiments can include determining a group of possible malware on the network based on the monitoring of the network, and generating a network security recommendation based on the group of threat research reports based on the group of threat research reports, the group of IOCs, and the group of possible malware. Other embodiments are disclosed.

Methods and apparatus to determine machine learning (ML) configurations for classifying malware are disclosed. An example server comprises interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to determine a computing parameter associated with a computing device, the computing device communicatively coupled to the server, select a ML model to deploy on the computing device based on the computing parameter, determine a configuration of the ML model based on the computing parameter, deploy the ML model to the computing device, and cause the deployed ML model to classify a sample as clean or malicious, the sample received at the computing device.

Disclosed herein are devices, systems, and methods for detecting, understanding, and classifying malicious actions and / or behaviors in software (e.g., malware), including hidden malicious actions. Specifically, disclosed embodiments use natural language approaches to understand malicious software and provide explanations for classification results. At least one embodiment constructs a knowledge graph that includes textual explanations from source materials (e.g., articles), collecting one or more sets of dynamic program traces from one or more instances of malware, and constructing and training a model (also referred to herein as Trace-BERT) using the one or more sets of dynamic program traces. Forced execution of sample segments of computer code can also be used to identify hidden or novel malicious actions.

The invention belongs to the technical field of virtual machine mirror image static scanning, and particularly relates to a virtual machine mirror image static scanning method and system based on a hyper-fusion platform, and the method comprises the steps: creating a to-be-scanned mirror image storage snapshot, employing an index and retrieval algorithm, obtaining a static virtual machine mirror image file, extracting and recording metadata information of the static virtual machine mirror image file, and then carrying out integrity verification; collecting all-around resource data of the hyper-fusion platform in real time, and distributing corresponding resource quotas for scanning tasks by using a preset algorithm; multi-stage deep scanning is carried out, file fingerprints and feature matching are firstly used for preliminary screening, then misjudgment is eliminated through version intelligent comparison, potential high-risk vulnerabilities are deeply excavated for key complex components by adopting static code analysis, and configuration files in mirror images are comprehensively examined through rapid screening and positioning of known malicious software; and a preset algorithm is used for carrying out deep classification arrangement, correlation analysis and summary statistics on various types of result data, so that virtual machine mirror image scanning in a large-scale hyper-fusion cluster is completed in a relatively short time.

A computer implemented malware protection method to mitigate malware spread within a set of communicating computer systems from an infected computer system is disclosed.

Techniques for machine learning for prioritizing traffic in multi-purpose inline cloud analysis (MICA) to enhance malware detection are disclosed. In some embodiments, a system, a process, and / or a computer program product for machine learning for prioritizing traffic in multi-purpose inline cloud analysis (MICA) to enhance malware detection includes processing a set of data for network security analysis to extract a file; determining that the file is to be offloaded to a cloud security entity for security processing based at least in part on a prefilter model that is implemented as a machine learning model; forwarding the file to the cloud security entity using a multi-purpose inline cloud analysis (MICA) channel; and performing an action in response to receiving a verdict from the cloud security entity.

A system for real-time detection and mitigation of morphing malware in high-density edge networks, consisting of: a data acquisition unit configured to receive, normalize, and encode multimodal telemetry data streams originating from at least one of the following domains: network traffic, process behavior, system call sequences, binary instruction traces, and control flow graphs; the data acquisition unit is further configured to compute feature embeddings over sliding time windows and apply privacy-preserving redactions prior to storage; a generative neural processor that is operationally coupled to the data acquisition unit and configured to generate synthetic morphing malware variants by learning probabilistic transformations of previously observed malicious data representations, maintaining semantic functionality while varying structural and behavioral features; a discriminative neural processor trained adversarially with the generative neural processor, wherein the discriminative neural processor is configured to detect morphing malware by evaluating a probability distribution over multimodal telemetry embeddings and classifying anomalous process and flow behaviors in real time; a coordination processor that is communicatively connected to both the generative neural processor and the discriminative neural processor and is configured to orchestrate adversarial co-training, regulate detection thresholds, calculate reinforcement-based penalties for false negative results, and trigger countermeasures as soon as a detection confidence level exceeds a predefined adaptive threshold; a secure, system-integrated inference and enforcement unit configured to perform low-latency countermeasures at the network edge, including selective packet filtering, flow isolation, process interruption, or system microsegmentation, based on instructions from the coordinating processor; and a hardware-embedded security enclave that is embedded in the system and configured to store cryptographic keys, neural model parameters, and integrity affirmation data to ensure the confidentiality, authenticity, and immutability of model artifacts and policy configurations.

A system and method for detecting anomalies and malicious processes by analyzing current consumption profiles is disclosed. The technique involves generating current consumption profiles that characterize the expected power draw for known software applications operating in various modes on a target device. At runtime, the current being consumed by actively running applications is measured and compared to the total expected current draw determined from the individual profiles. Deviations between the observed and expected consumption indicate potential interference from malware or other unwanted processes. Additionally, current fluctuation profiles are generated to model the characteristic transient current behavior when applications transition between operational modes. By comparing runtime current measurements during state changes to these expected transitional profiles, the system can identify aberrations indicative of background malware triggering during the transitions. The current monitoring approach provides an efficient way to detect anomalous behavior from unwanted processes with minimal overhead.

The invention relates to the technical field of network security, and discloses a malicious software response system and system based on artificial intelligence, and the system comprises a data sensing module, an intelligent analysis module, a risk quantification module and a dynamic defense module. The method corresponds to the system. According to the application, an efficient, intelligent and flexible malicious software response system is constructed by integrating key technologies such as distributed sensing, intelligent analysis, dynamic quantification and adaptive defense, the limitations in the aspects of data acquisition, threat identification, risk assessment and defense strategies are overcome, and the system also has strong self-learning ability and wide applicability; and a new direction and a new solution are provided for technical innovation in the field of network security.

The invention provides a vulnerability assessment system, method and device based on malicious software behavior analysis, and relates to the technical field of network security. The system comprises a behavior capturing module which is used for operating malicious software through a virtual sandbox, collecting behavior logs generated in the operation process of the malicious software and generating a behavior data set; the feature extraction module is used for extracting behavior features from the behavior data set and generating a standardized feature set; the feature matching module is used for performing multi-dimensional mapping matching on the standardized feature set and the vulnerability features in the vulnerability feature database to obtain a matching result and a vulnerability identifier; the behavior modeling module is used for generating a behavior chain model through a time sequence modeling method based on the matching result and the standardized feature set; and the vulnerability evaluation module is used for generating an evaluation result. According to the technical scheme provided by the invention, the analysis capability and the quantification precision of the system on the vulnerability characteristics and the associated behaviors thereof can be improved, so that more accurate vulnerability evaluation is realized.

The invention discloses a network information security defense detection method and system, and relates to the technical field of network information security, and the system comprises a website security check module, a downloading security check module, an access security check module and a display execution module. In daily Internet surfing, net friends often encounter network security problems, for example, users may receive phishing mails disguised as banks or download malicious software in untrusted websites, resulting in data stealing. Identity embezzlement and data leakage increase privacy and financial risks, and man-in-the-middle attack may intercept sensitive information through an unencrypted Wi-Fi network. According to the method, security detection including domain name check, certificate verification, content scanning, integrity verification and the like is carried out on websites, downloading programs and external access equipment, so that security risks are found and processed in time; and meanwhile, by adopting a virtual machine isolation technology and behavior monitoring, the protection on malicious programs is enhanced, the security risk of external equipment is evaluated, and the security of a network environment and data is ensured.

Disclosed are systems and methods that monitor for malicious and unauthorized behaviors, determine categories for detected malicious behaviors, determine why a domain is determined to be malicious, and provide information to users that identifies the categories and reasons as to why a domain is determined to be malicious. In some implementations, the disclosed systems and methods may be utilized to provide monitoring security to customers of a cloud service. For example, customers of a cloud service may maintain an account with the cloud service and the disclosed implementations may be utilized to protect those accounts from malicious attacks and cybercrimes such as, but not limited to, spam, phishing, malware, botnets, etc.

The invention discloses a network attack perception induction method, and relates to the technical field of network security attacks, and the method comprises the steps: obtaining an APT malicious software gene model, obtaining behaviors generated during the operation of malicious software, carrying out the analysis, and constructing an APT family gene pool; obtaining an APT family gene bank, and performing classification extraction on the APT family gene bank to obtain an APT malicious behavior gene bank; acquiring an APT malicious behavior gene bank, identifying APT attack behaviors, establishing an attack path prediction model, determining an APT attack path and predicting a next APT activity; identifying the predicted bait most similar to the next attack target through a target similarity detection method, guiding the attack to migrate to the bait, and attracting an attacker to attack the bait; according to the method, the attack behavior can be induced, the attack can be actively carried out, the attack information can be more comprehensively captured, the defense capability of the network attack is greatly improved, and the network security is maintained.

Methods and systems for detecting anomalous software behavior by monitoring frequency spectrums emanating from an electronic device are provided. A method includes storing frequency spectrum profiles for software applications and operational modes on the device. During execution of a software application, the real-time emanating frequency spectrum is measured and compared to the stored spectrum profile for that application and operational mode. Deviations between the real-time and reference spectrums indicate anomalous behavior from unknown software executing. The device determines a deviation exists and performs remedial actions like alerting the user, disconnecting from the network, shutting down, or switching application execution to another device. Frequency profiles are measured for new applications installed and stored to keep the data updated. Monitoring real-time frequency spectrums emanating from a device provides a computationally lightweight technique for detecting malicious software behavior without requiring complex analysis of application code.

Various techniques for providing deep learning for inline detection of malicious command and control (C2) traffic from unstructured payloads are disclosed. In some embodiments, a system / process / computer program product for providing deep learning for inline detection of malicious C2 traffic from unstructured payloads includes monitoring a session at a security platform, wherein the session includes network traffic; executing a local deep learning model on the network traffic, wherein the local deep learning model is a machine learning implemented C2 (MLC2) model executed on the security platform; and performing an action in response to determining that the monitored session is associated with malware based at least in part on a verdict from the deep learning model.

An artificial intelligence (AI)-based system for detecting malware in endpoint devices using a multi-source data fusion and method thereof are disclosed. The AI-based system collects at least one of: endpoint visibility data, publicly available information, and sandbox analysis data using the multi-source data fusion. By using the collected data, the AI-based system generates one or more numerical embeddings for at least one of: one or more files and one or more applications of each endpoint device using one or more AI models. The AI-based system is configured with the one or more AI models to generate one or more dynamic directed graphs based on the generated one or more numerical embeddings to compute a maliciousness risk score. The maliciousness risk score of at least one of the: one or more files and one or more applications is used for detecting the malware in the one or more endpoint devices.

The technology disclosed relates to a method, system, and non-transitory computer-readable media that detects malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host, using a network security system. The network security system reroutes the cloud traffic to the network security system. The incoming requests of the cloud traffic are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources. The network security system analyzes the incoming requests, determines that the incoming requests are targeted at one or more malicious resources in the plurality of resources. Also, the network security system prevents transmission of the incoming requests to the malicious resources, by making the malicious resources unavailable for receiving future incoming requests, while keeping other resources in the plurality of resources available for receiving the future incoming requests.

The present application discloses a method, system, and computer system for providing real-time detection of malicious URLs based on a machine-learning powered domain risk scoring. The method includes (i) identifying a subset of higher risk websites, wherein the higher risk websites are at risk for potential malware injection or modification, and (ii) in response to identifying the subset of higher risk websites, performing an active measure based at least in part on the identified subset of higher risk websites.

The invention discloses a lightweight malicious software visual classification method based on multi-scale characteristics. The method comprises the following steps: converting a binary file of malicious software into a grayscale image through Markov transfer matrix modeling; image features are extracted through a multi-scale cavity convolution fusion attention module MDFA; a SimMobileNetV2 network is utilized to carry out classification; according to the method, the classification performance is remarkably improved, and the method has high practical application value.

Various techniques for deep learning in a data plane are disclosed. In some embodiments, a system / process / computer program product for deep learning in a data plane includes monitoring a session at a security platform, wherein the session includes network traffic; executing a local deep learning model on the network traffic, wherein the local deep learning model is executed on the security platform; and performing an action in response to determining that the monitored session is associated with malware based at least in part on a verdict from the deep learning model.

Source code for a type of malware is received. For example, the source code may be source code from a type of computer virus. An Artificial Intelligence (AI) algorithm is identified. For example, the AI algorithm may be ChatGPT. The source code of the type of malware is run through the AI algorithm to produce mutated source code for the type of malware. A prediction algorithm is used to predict a signature of the mutated source code for the type of malware. For example, the prediction algorithm is trained using existing source code of different types of malware to generate a prediction model. The signature of the mutated source code for the type of malware is then compared to a signature of a potentially new type of malware to determine if the signatures are similar.

Example methods and apparatus are disclosed herein to mitigate firmware malware, an example apparatus comprising at least one memory; instructions; and at least one processor to execute the instructions to cause the at least one processor to at least: detect presence of firmware malware, the firmware malware to be executed prior to booting of an operating system of a computing device; attempt remediation of the firmware malware; and in response to a failure to remediate the firmware malware, cause display of a notification of the presence of the firmware malware.

Subject matter related to data management is discussed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A graphical user interface showing individual snapshots in the snapshot change and indicating whether the snapshot is infected with malware may be displayed. The graphical user interface may provide a recover function for non-infected snapshots and may not enable the recover function for infected snapshots. A command to recover a non-infected snapshot in the snapshot chain may be received. Based on receiving the command, the non-infected snapshot may be recovered.

A set of features including a first feature and a second feature is received at a server. A subset of the set of features is determined for use in generating a model usable by a device to locally make a malware classification decision. The device has reduced computing resources as compared to computing resources of the server. The subset of the set of features is used to generate the model. The generated model includes the first feature and does not include the second feature. A determination is made, at a time subsequent to the generation of the model, that an updated model should be deployed to the device. An updated model is generated.

A method for detecting password spray attacks. The method includes obtaining information from an on-machine malware detection application for a particular machine indicating that a password spray tool is detected on the particular machine. Information is obtained indicating that the particular machine has performed failed sign in attempts. As a result, a determination is made that the particular machine is performing password spray attacks.

The invention discloses a security assessment method and device for a malicious code detection system. The method specifically comprises the following steps: extracting a static feature vector from malicious software; according to a static feature vector obtained through static analysis, a static strategy neural network and a dynamic strategy neural network are utilized to generate an executable countermeasure sample after static confusion and dynamic confusion; and after static obfuscation and dynamic obfuscation, an adversarial sample can be executed to evaluate the security of the malicious code detection system. Through the method, more real and higher-quality antagonistic samples can be generated, and the generated antagonistic samples can be further used for evaluating the security protection security of a malicious software detection system and a software supply chain.

A method for secure detection of online fraud. The method includes generating an encrypted profile representing browser activity, sending the encrypted profile to a secure multiparty computation system, receiving a trust token from the secure multiparty computation system, based on a determination that the web browser is not engaged in online fraud, sending a request to redeem the trust token with the secure multiparty computation system, receiving an encrypted record of redemption from the secure multiparty computation system based on a determination that a web site associated with the web content is not blocked, and sending a request, containing the encrypted record of redemption, for third-party content, wherein the third-party content is associated with the web content.

In some embodiments, a method receives a file. The file is packed using a packing method. An entropy profile is generated for the file. The entropy profile describes an entropy of data over positions in the file. The method generates a rule to detect the entropy profile of the file by analyzing entropy values from the entropy profile in slices in the file. The rule is output. The rule is usable to detect in other files that use the packing method based on analyzing entropy in slices of the other files.

The embodiment of the invention provides a trusted IoT (Internet of Things) access method and equipment based on a block chain. The method is applied to the technical field of communication, and comprises the following steps: firstly, generating a key for the Internet of Things in a TEE environment of an intelligent gateway, encrypting a resource address of an Internet of Things device, preventing the key from being acquired by malicious software, preventing the key from being counterfeited, and ensuring the security of the Internet of Things device accessing a block chain network, and a block chain stores a key index instead of the key, so that the security of the Internet of Things device accessing a block chain network is ensured. The risk of key leakage is further reduced; by setting a device management contract and a policy authority contract, the authority of a user for accessing the Internet of Things device is inquired and managed, fine control of the access authority is realized, and only the user having the authority can obtain a corresponding secret key from an intelligent gateway to decrypt an encrypted resource address provided in a block chain. According to the arrangement, leakage of the resource address is effectively prevented, and sensitive information is prevented from being leaked.