利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

185 条记录 (耗时 0.027 秒)

    DETECTION OF CONTENT GENERATED FROM PHISHING ATTACKS
    3.
    发明公开
    DETECTION OF CONTENT GENERATED FROM PHISHING ATTACKS 审中-公开

    公开(公告)号：US20240056480A1

    公开(公告)日：2024-02-15

    申请号：US18496568

    申请日：2023-10-27

    申请人： CrowdStrike, Inc.

    发明人： IOSIF ONUT ,  Qian Cui ,  Guy-Vincent Jourdan

    IPC分类号： H04L9/40 ,  G06N20/00

    CPC分类号： H04L63/1483 ,  G06N20/00 ,  H04L63/1416

    摘要： Mechanisms are provided to detect content generated from phishing attacks. The mechanisms process an electronic communication, received from a data network, to produce a structure token. The structure token represents a content structure of the electronic communication. The structure token is processed by a machine learning model, which is trained to identify content that is generated in response to one or more phishing attacks. The machine learning model produces a classification output that indicates whether the electronic communication includes content that was generated in response to the one or more phishing attacks.

    MACHINE LEARNING-BASED MALWARE DETECTION IN PROCESS MEMORY
    4.
    发明公开
    MACHINE LEARNING-BASED MALWARE DETECTION IN PROCESS MEMORY 审中-公开

    公开(公告)号：US20230394145A1

    公开(公告)日：2023-12-07

    申请号：US17862623

    申请日：2022-07-12

    申请人： CrowdStrike, Inc.

    发明人： Felix Schwyzer

    IPC分类号： G06F21/56 ,  G06F21/53

    CPC分类号： G06F21/564 ,  G06F21/53 ,  G06N20/00

    摘要： A plurality of memory image data is obtained. Respective ones of the memory image data may include captured memory contents from an executing process. Training data including feature vectors and classification values are provided to a machine learning (ML) training model executing on a processing device. The feature vectors may include indications of patterns within the memory image data. The ML training model is trained based on the training data to generate an ML production model. The training may include computing a plurality of model parameters that relate the feature vectors of the training data to the classification values of the training data.

    Validation-based determination of computational models
    6.
    发明授权
    Validation-based determination of computational models 有权

    公开(公告)号：US11811821B2

    公开(公告)日：2023-11-07

    申请号：US17087194

    申请日：2020-11-02

    申请人： CrowdStrike, Inc.

    发明人： Sven Krasser ,  David Elkind ,  Brett Meyer ,  Patrick Crenshaw

    IPC分类号： H04L9/40 ,  G06N20/00 ,  G06F21/56

    CPC分类号： H04L63/145 ,  G06F21/56 ,  G06N20/00 ,  H04L63/1416

    摘要： Example techniques described herein determine a validation dataset, determine a computational model using the validation dataset, or determine a signature or classification of a data stream such as a file. The classification can indicate whether the data stream is associated with malware. A processing unit can determine signatures of individual training data streams. The processing unit can determine, based at least in part on the signatures and a predetermined difference criterion, a training set and a validation set of the training data streams. The processing unit can determine a computational model based at least in part on the training set. The processing unit can then operate the computational model based at least in part on a trial data stream to provide a trial model output. Some examples include determining the validation set based at least in part on the training set and the predetermined criterion for difference between data streams.

    Securely and efficiently providing user notifications about security actions
    7.
    发明授权
    Securely and efficiently providing user notifications about security actions 有权

    公开(公告)号：US11687649B2

    公开(公告)日：2023-06-27

    申请号：US17008038

    申请日：2020-08-31

    申请人： Crowdstrike, Inc.

    发明人： Ion-Alexandru Ionescu

    IPC分类号： G06F21/00 ,  G06F21/55 ,  G06F9/54 ,  G06F21/33 ,  G06F21/56

    CPC分类号： G06F21/554 ,  G06F9/545 ,  G06F9/547 ,  G06F21/33 ,  G06F21/566

    摘要： A security agent executing in kernel mode may receive a request from the anti-malware component executing with low privileges in user mode, and, in response, the security agent may perform a security action with respect to a malicious file detected on the computing device. The security agent may then assist the anti-malware component in providing a user notification about the security action by obtaining, on behalf of the anti-malware component, a user token associated with the user session in which the malicious file was detected. The anti-malware component can use the obtained user token to request a pointer to a Component Object Model (COM) interface for outputting the notification in context of the appropriate user session, which allows for securely and efficiently providing the user notification.

    MALICIOUS INCIDENT VISUALIZATION
    8.
    发明公开
    MALICIOUS INCIDENT VISUALIZATION 审中-公开

    公开(公告)号：US20230164152A1

    公开(公告)日：2023-05-25

    申请号：US18094580

    申请日：2023-01-09

    申请人： CrowdStrike, Inc.

    发明人： Daniel W. Brown ,  Thomas R. Hobson ,  Hyacinth D. Diehl ,  Alexander J. Graul

    IPC分类号： H04L9/40

    CPC分类号： H04L63/1416 ,  H04L63/1425 ,  H04L63/1441

    摘要： Techniques to provide visualizations of possible malicious incidents associated with an event on a host device may include causing presentation of graphics of a process or thread in a user interface. Information about detected events may be transmitted to a computing device that generates the visualizations for presentation to an analyst to verify the malicious incidents. Based on patterns and information conveyed in the visualizations, the computer device or host device may take action to protect operation of the host device caused by the event.

    Firmware retrieval and analysis
    10.
    发明授权
    Firmware retrieval and analysis 有权

    公开(公告)号：US11599641B2

    公开(公告)日：2023-03-07

    申请号：US16855585

    申请日：2020-04-22

    申请人： CrowdStrike, Inc.

    发明人： Timo Kreuzer ,  Ion-Alexandru Ionescu ,  Aaron LeMasters

    IPC分类号： H04L29/06 ,  G06F21/57 ,  G06F13/42 ,  G06F21/44

    摘要： A bus filter driver and security agent components configured to retrieve and analyze firmware images are described herein. The bus filter driver may attach to a bus device associated with a memory component and retrieve a firmware image of firmware stored on the memory component. The bus filter driver may also retrieve hardware metadata. A kernel-mode component of the security agent may then retrieve the firmware image and hardware metadata from the bus filter driver and provide the firmware image and hardware metadata to a user-mode component of the security agent for security analysis. The security agent components may then provide results of the analysis and/or the firmware image and hardware metadata to a remote security service to determine a security status for the firmware.