利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

180 条记录 (耗时 0.037 秒)

    INTRUSION DETECTION USING A HEARTBEAT
    2.
    发明申请
    INTRUSION DETECTION USING A HEARTBEAT 有权

    公开(公告)号：US20220191225A1

    公开(公告)日：2022-06-16

    申请号：US17687884

    申请日：2022-03-07

    申请人： Sophos Limited

    发明人： Kenneth D. Ray

    IPC分类号： H04L9/40

    摘要： A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection.

    Securing endpoints in a heterogenous enterprise network
    5.
    发明授权
    Securing endpoints in a heterogenous enterprise network 有权

    公开(公告)号：US11271950B2

    公开(公告)日：2022-03-08

    申请号：US15945166

    申请日：2018-04-04

    申请人： Sophos Limited

    发明人： Moritz Daniel Grimm ,  Daniel Stutz ,  Andrew J. Thomas ,  Kenneth D. Ray

    IPC分类号： H04L29/06

    摘要： Endpoints within a subnet of a heterogeneous network are configured to cooperatively respond to internal or external notifications of compromise in order to protect the endpoints within the subnet and throughout the enterprise network. For example, each endpoint may be configured to self-isolate when a local security agent detects a compromise, and to shun one of the other endpoints in response to a corresponding notification of compromise in order to prevent the other, compromised endpoint from communicating with other endpoints and further compromising other endpoints either within the subnet or throughout the enterprise network.

    Secure endpoint in a heterogenous enterprise network
    7.
    发明授权
    Secure endpoint in a heterogenous enterprise network 有权

    公开(公告)号：US11140195B2

    公开(公告)日：2021-10-05

    申请号：US15945226

    申请日：2018-04-04

    申请人： Sophos Limited

    发明人： Moritz Daniel Grimm ,  Daniel Stutz ,  Andrew J. Thomas ,  Kenneth D. Ray

    IPC分类号： H04L29/06 ,  G06F21/56

    摘要： An endpoint in an enterprise network is configured to respond to internal and external detections of compromise in a manner that permits the endpoint to cooperate with other endpoints to secure the enterprise network. For example, the endpoint may be configured to self-isolate when local monitoring detects a compromise on the endpoint, and to respond to an external notification of compromise of another endpoint by restricting communications with that other endpoint.

    Forensic analysis of computing activity
    9.
    发明授权
    Forensic analysis of computing activity 有权

    公开(公告)号：US10516682B2

    公开(公告)日：2019-12-24

    申请号：US15946026

    申请日：2018-04-05

    申请人： Sophos Limited

    发明人： Beata Ladnai ,  Mark David Harris ,  Andrew J. Thomas ,  Andrew G. P. Smith ,  Russell Humphries ,  Kenneth D. Ray

    IPC分类号： H04L29/06 ,  G06F16/901 ,  G06Q10/06 ,  G06Q50/26

    摘要： A data recorder stores endpoint activity on an ongoing basis as sequences of events that causally relate computer objects such as processes and files. When a security event is detected, an event graph may be generated based on these causal relationships among the computing objects. For a root cause analysis, the event graph may be traversed in a reverse order from the point of an identified security event (e.g., a malware detection event) to preceding computing objects, while applying one or more cause identification rules to identify a root cause of the security event. Once a root cause is identified, the event graph may be traversed forward from the root cause to identify other computing objects that are potentially compromised by the root cause.

    Key management for compromised enterprise endpoints
    10.
    发明授权
    Key management for compromised enterprise endpoints 有权

    公开(公告)号：US10516531B2

    公开(公告)日：2019-12-24

    申请号：US16111322

    申请日：2018-08-24

    申请人： Sophos Limited

    发明人： Harald Schütz ,  Andrew J. Thomas ,  Kenneth D. Ray ,  Daniel Salvatore Schiappa

    IPC分类号： G06F21/00 ,  H04L29/06 ,  H04L9/08 ,  G06F21/55

    摘要： Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.