Methods and systems for identifying malware through differences in cloud vs. client behavior

    公开(公告)号:US09787695B2

    公开(公告)日:2017-10-10

    申请号:US14667461

    申请日:2015-03-24

    Abstract: A computing device may be configured to work in conjunction with another component (e.g., a server) to better determine whether a software application is benign or non-benign. This may be accomplished via the server performing static and/or dynamic analysis operations, generating a behavior information structure that describes or characterizes the range of correct or expected behaviors of the software application, and sending the behavior information structure to a computing device. The computing device may compare the received behavior information structure to a locally generated behavior information structure to determining whether the observed behavior of the software application differs or deviates from the expected behavior of the software application or whether the observed behavior is within the range of expected behaviors. The computing device may increase its level of security/scrutiny when the behavior information structure does not match the local behavior information structure.

    Detecting Software Attacks on Processes in Computing Devices

    公开(公告)号:US20170083702A1

    公开(公告)日:2017-03-23

    申请号:US15057336

    申请日:2016-03-01

    CPC classification number: G06F21/554 G06F21/52 G06F21/552 G06F21/566

    Abstract: Various embodiments include methods for detecting software attacks on a process executing on a computing device. Various embodiment methods may include monitoring structural attributes of a plurality of virtual memory regions utilized by the process, and comparing the monitored structural attributes to the expected structural attributes of the plurality of VMRs. Various embodiment methods may further include determining whether the monitored structural attributes represent anomalous behavior of the process based on the comparison between the monitored structural attributes and the expected structural attributes.

    Image-based indoor position determination
    48.
    发明授权
    Image-based indoor position determination 有权
    基于图像的室内位置确定

    公开(公告)号:US09582720B2

    公开(公告)日:2017-02-28

    申请号:US14673147

    申请日:2015-03-30

    CPC classification number: G06K9/00664 G06K9/6202 G06T7/75

    Abstract: In one implementation, a method may comprise: determining a topological representation of an indoor portion of a building based, at least in part, on positions or number of lines in an image of the indoor portion of the building; and comparing the topological representation to one or more stored topological representations, for example in a digital map of the building, to determine a potential position of the indoor portion of the building.

    Abstract translation: 在一个实现中,方法可以包括:至少部分地基于建筑物的室内部分的图像中的线的位置或数量来确定建筑物的室内部分的拓扑表示; 以及将拓扑表示与一个或多个存储的拓扑表示(例如在建筑物的数字地图中)进行比较,以确定建筑物的室内部分的潜在位置。

    Methods and Systems for Using Causal Analysis for Boosted Decision Stumps to Identify and Respond to Non-Benign Behaviors
    49.
    发明申请
    Methods and Systems for Using Causal Analysis for Boosted Decision Stumps to Identify and Respond to Non-Benign Behaviors 有权
    使用推理决策树的因果分析来识别和应对非良性行为的方法和系统

    公开(公告)号:US20160330223A1

    公开(公告)日:2016-11-10

    申请号:US14706099

    申请日:2015-05-07

    CPC classification number: H04L63/1425 G06F21/566

    Abstract: A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding non-benign behaviors of the computing device. The processor may be configured to monitor device behaviors to collect behavior information, generate a behavior vector information structure based on the collected behavior information, apply the behavior vector information structure to a classifier model to generate analysis results, use the analysis results to classify a behavior of the device, use the analysis results to determine the features evaluated by the classifier model that contributed most to the classification of the behavior, and select the top “n” (e.g., 3) features that contributed most to the classification of the behavior. The computing device may display the selected features on an electronic display of the computing device.

    Abstract translation: 计算设备处理器可以配置有处理器可执行指令,以实现检测和响应计算设备的非良性行为的方法。 处理器可以被配置为监视设备行为以收集行为信息,基于收集的行为信息生成行为向量信息结构,将行为向量信息结构应用于分类器模型以生成分析结果,使用分析结果对行为进行分类 的设备,使用分析结果来确定由分类器模型评估的功能,对行为的分类最有贡献,并选择对行为分类最有贡献的顶部“n”(例如,3)特征。 计算设备可以在计算设备的电子显示器上显示所选择的特征。

    APIs for obtaining device-specific behavior classifier models from the cloud
    50.
    发明授权
    APIs for obtaining device-specific behavior classifier models from the cloud 有权
    用于从云获取特定于设备的行为分类器模型的API

    公开(公告)号:US09491187B2

    公开(公告)日:2016-11-08

    申请号:US14157606

    申请日:2014-01-17

    Abstract: The various aspects provide a system and methods implemented on the system for generating a behavior model on a server that includes features specific to a mobile computing device and the device's current state/configuration. In the various aspects, the mobile computing device may send information identifying itself, its features, and its current state to the server. In response, the server may generate a device-specific lean classifier model for the mobile computing device based on the device's information and state and may send the device-specific lean classifier model to the device for use in detecting malicious behavior. The various aspects may enhance overall security and performance on the mobile computing device by leveraging the superior computing power and resources of the server to generate a device-specific lean classifier model that enables the device to monitor features that are actually present on the device for malicious behavior.

    Abstract translation: 各个方面提供在系统上实现的系统和方法,用于在服务器上生成包括移动计算设备特有的功能和设备的当前状态/配置的行为模型。 在各个方面,移动计算设备可以向服务器发送标识自身,其特征及其当前状态的信息。 作为响应,服务器可以基于设备的信息和状态为移动计算设备生成针对设备的精简分类器模型,并且可以将设备特定的精简分类器模型发送到用于检测恶意行为的设备。 各个方面可以通过利用服务器的优越的计算能力和资源来增强移动计算设备的总体安全性和性能,以生成特定于设备的精益分类器模型,使得设备能够监视实际存在于设备上的恶意的特征 行为。

Patent Agency Ranking