公开(公告)号：US20230205884A1

公开(公告)日：2023-06-29

申请号：US18087290

申请日：2022-12-22

Applicant: Qatar Foundation for Education, Science and Community Development

Inventor： Mohamed Nabeel ,  Saravanan Thirumuruganathan ,  Euijin Choo ,  Issa M. Khalil ,  Ting Yu

IPC: G06F21/56

CPC classification number: G06F21/566 ,  G06F2221/034

Abstract: Generating high-quality threat intelligence from aggregated threat reports is provided via developing a generative model that identifies relationships between a plurality of threat assessment scanners; pre-training a plurality of individual encoders based on a corresponding plurality of pretext tasks and the generative model; combining the individual encoders into a pre-trained encoder; fine-tuning the pre-trained encoder using threat data; and marking a candidate threat, as evaluated via the pre-trained encoder as fine-tuned, as one of benign or malicious.

公开(公告)号：US20220116782A1

公开(公告)日：2022-04-14

申请号：US17495391

申请日：2021-10-06

Applicant: Qatar Foundation for Education, Science and Community Development

Inventor： Mashael Al Sabah ,  Mohamed Nabeel ,  Euijin Choo ,  Issa M Khalil ,  Ting Yu ,  Wei Wang

IPC: H04W12/121 ,  G06F16/901 ,  H04W12/30

Abstract: A system is provided for identifying compromised mobile devices from a network administrator's point of view. The provided system utilizes a graph-based inference approach that leverages an assumed correlation that devices sharing a similar set of installed applications will have a similar probability of being compromised. Stated differently, the provided system determines whether a given unknown device is compromised or not by analyzing its connections to known devices. Such connections are generated from a small set of known compromised mobile devices and the network traffic data of mobile devices collected by a service provider or network administrator. The proposed system is accordingly able to reliably detect unknown compromised devices without relying on device-specific features.

公开(公告)号：US11206275B2

公开(公告)日：2021-12-21

申请号：US16426477

申请日：2019-05-30

Applicant: Qatar Foundation for Education, Science and Community Development

Inventor： Mohamed Nabeel ,  Issa M. Khalil ,  Ting Yu ,  Euijin Choo

IPC: H04L29/06 ,  G06N20/00 ,  H04L29/12 ,  H04L12/26 ,  G06N20/20 ,  G06N5/02 ,  H04L12/24 ,  G06N5/00 ,  G06N20/10

Abstract: The presently disclosed method and system exploits information and traces contained in DNS data to determine the maliciousness of a domain based on the relationship it has with other domains. A method may comprise providing data to a machine learning module that was previously trained on domain and IP address attributes or classifiers. The method then may comprise classifying apex domains and IP addresses based on the IP address and domain attributes or classifiers. Additionally, the method may comprise associated each of the domains and IP addresses based on the corresponding classification. The method may further comprise building a weighted domain graph at real-time utilizing the DNS data based on the aforementioned associations among domains. The method may then comprise assessing the maliciousness of a domain based on the weighted domain graph that was built.