Systems and methods for detecting online fraud

    公开(公告)号:US11388193B2

    公开(公告)日:2022-07-12

    申请号:US16233750

    申请日:2018-12-27

    发明人: Alin O. Damian

    摘要: Described systems and methods enable a swift and efficient detection of fraudulent Internet domains, i.e., domains used to host or distribute fraudulent electronic documents such as fraudulent webpages and electronic messages. Some embodiments use a reverse IP analysis to select a set of fraud candidates from among a set of domains hosted at the same IP address as a known fraudulent domain. The candidate set is further filtered according to domain registration data. Online content hosted at each filtered candidate domain is further analyzed to identify truly fraudulent domains. A security module may then prevent users from accessing a content of such domains.

    Dynamic reputation indicator for optimizing computer security operations

    公开(公告)号:US10237293B2

    公开(公告)日:2019-03-19

    申请号:US15336387

    申请日:2016-10-27

    IPC分类号: H04L29/06 G06F21/56

    摘要: Described systems and methods allow protecting a computer system from malware such as viruses, worms, and spyware. A reputation manager executes on the computer system concurrently with an anti-malware engine. The reputation manager associates a dynamic reputation indicator to each executable entity seen as a unique combination of individual components (e.g., a main executable and a set of loaded libraries). The reputation indicator indicates a probability that the respective entity is malicious. The reputation of benign entities may increase in time. When an entity performs certain actions which may be indicative of malicious activity, the reputation of the respective entity may drop. The anti-malware engine uses an entity-specific protocol to scan and/or monitor each target entity for malice, the protocol varying according to the entity's reputation. Entities trusted to be non-malicious may be analyzed using a more relaxed protocol than unknown or untrusted entities.

    Systems and methods for detecting online fraud

    公开(公告)号:US10171497B2

    公开(公告)日:2019-01-01

    申请号:US15206761

    申请日:2016-07-11

    发明人: Alin O. Damian

    摘要: Described systems and methods enable a swift and efficient detection of fraudulent Internet domains, i.e., domains used to host or distribute fraudulent electronic documents such as fraudulent webpages and electronic messages. Some embodiments use a reverse IP analysis to select a set of fraud candidates from among a set of domains hosted at the same IP address as a known fraudulent domain. The candidate set is further filtered according to domain registration data. Online content hosted at each filtered candidate domain is further analyzed to identify truly fraudulent domains. A security module may then prevent users from accessing a content of such domains.

    Systems and methods of asynchronous analysis of event notifications for computer security applications

    公开(公告)号:US10140448B2

    公开(公告)日:2018-11-27

    申请号:US15201035

    申请日:2016-07-01

    发明人: Sandor Lukacs

    摘要: Described systems and methods enable an efficient detection and analysis of software events, especially in hardware virtualization configurations. In some embodiments, certain types of events are analyzed asynchronously, in the sense that the triggering entity is allowed to continue execution while the respective event is added to a queue for later processing. Some embodiments modify the instruction set architecture of the processor by adding a processor instruction dedicated to delivering event notifications. Such notification instructions allow for complex and flexible event detection without some of the disadvantages of conventional methods such as hooking.

    Systems and methods for decrypting network traffic in a virtualized environment

    公开(公告)号:US10116630B2

    公开(公告)日:2018-10-30

    申请号:US15471981

    申请日:2017-03-28

    发明人: Radu Caragea

    摘要: Described systems and methods enable a decryption of encrypted communication between a client system and a remote party, for applications such as detection and analysis of malicious software, intrusion detection, and surveillance, among others. The client system executes a virtual machine and an introspection engine outside the virtual machine. The introspection engine is configured to identify memory pages whose contents have changed between a first session event (e.g., a ServerHello message) and a second session event (e.g., a ClientFinished message). The respective memory pages are likely to contain encryption key material for the respective communication session. A decryption engine may then attempt to decrypt an encrypted payload of the respective communication session using information derived from the content of the identified memory pages.