利索-全球专利检索

  1. Login
  2. Sign Up

Search Results

1290 records (took 0.023 seconds)

    RANSOMWARE DETECTION VIA MONITORING OPEN FILE OR PROCESS
    1.
    发明公开
    RANSOMWARE DETECTION VIA MONITORING OPEN FILE OR PROCESS 审中-公开

    公开(公告)号：US20240330447A1

    公开(公告)日：2024-10-03

    申请号：US18343956

    申请日：2023-06-29

    Applicant: Dell Products L.P.

    Inventor： Ofir Ezrielev ,  Yeh'iel Zohar ,  Yevgeni Gehtman ,  Tomer Shachar ,  Maxim Balin

    IPC: G06F21/55 ,  G06F21/56

    CPC classification number: G06F21/554 ,  G06F21/562 ,  G06F2221/033

    Abstract: A bait file owned by a bait process is created and locked in a computing system. Attempts or access the bait file or kill the bait process are detected. The process attempting to access the bait file or kill the bait process is viewed as malicious and protective operations are performed in the computing system. When an attempt to access the bait file is performed, the process attempting to access the bait file and all files related to the process attempting to access the bait file are identified. The related processes are identified using a table that tracks related processes. The protection operations are performed with respect to the process attempting to access the bait file and all related processes.

    Advanced threat protection cross-product security controller
    3.
    发明授权
    Advanced threat protection cross-product security controller 有权

    公开(公告)号：US12079336B2

    公开(公告)日：2024-09-03

    申请号：US18092083

    申请日：2022-12-30

    Applicant: Musarubra US LLC

    Inventor： Derek Pearcy ,  Jessica Heinrich ,  Michael Bishop ,  Cristian Fiorentino ,  Jessica Gaskins ,  Martina Borkowsky

    IPC: G06F21/56 ,  G06F21/55 ,  G06F21/57 ,  H04L9/40

    CPC classification number: G06F21/562 ,  G06F21/552 ,  G06F21/577 ,  H04L63/1425

    Abstract: A system for securing electronic devices includes a processor, non-transitory machine readable storage medium communicatively coupled to the processor, security applications, and a security controller. The security controller includes computer-executable instructions on the medium that are readable by the processor. The security application is configured to determine a suspicious file from a client using the security applications, identify whether the suspicious file has been encountered by other clients using the security applications, calculate a time range for which the suspicious file has been present on the clients, determine resources accessed by the suspicious file during the time range, and create a visualization of the suspicious file, a relationship between the suspicious file and the clients, the time range, and the resources accessed by the suspicious file during the time range.

    Detecting malware campaigns based on analysis of composite time series of telemetry data
    4.
    发明授权
    Detecting malware campaigns based on analysis of composite time series of telemetry data 有权

    公开(公告)号：US12050684B2

    公开(公告)日：2024-07-30

    申请号：US17239511

    申请日：2021-04-23

    Applicant: VMware, Inc.

    Inventor： Jason Zhang ,  Stefano Ortolani ,  Giovanni Vigna

    IPC: G06F21/56

    CPC classification number: G06F21/562 ,  G06F2221/033

    Abstract: The disclosure herein describes the detection of malware campaigns based on analysis of attributes of telemetry data. Telemetry data associated with malware campaign detection includes multiple attributes and is associated with a first time interval. Statistics of a target statistic set are calculated based on a composite time series of the multiple attributes of the telemetry data. The target set is compared to a historical statistic set based on a second time interval and, based on the target set exceeding a statistic threshold of the historical set, peak detection analysis of the target set is performed. Based on the analysis indicating the presence of a valid peak result, a notification of detection of a malware campaign is sent, wherein the notification includes data indicative of the valid peak result and enables a receiver of the notification to take corrective action.

    METHOD FOR AUTOMATIC STORING OF MALICIOUS SAMPLES
    5.
    发明公开
    METHOD FOR AUTOMATIC STORING OF MALICIOUS SAMPLES 审中-公开

    公开(公告)号：US20240202334A1

    公开(公告)日：2024-06-20

    申请号：US18066377

    申请日：2022-12-15

    Applicant: Nozomi Networks Sagl

    Inventor： Alexey KLEYMENOV ,  Alessandro DI PINTO ,  Moreno CARULLO ,  Andrea CARCANO

    IPC: G06F21/56 ,  G06F16/13 ,  H04L9/06

    CPC classification number: G06F21/566 ,  G06F16/137 ,  G06F21/562 ,  H04L9/0643 ,  G06F2221/034

    Abstract: The present invention relates to a method for automatically storing malicious samples, comprising collecting input samples from sample providers relating to malwares and goodwares, parsing each of the input samples to extract metadata relating to each of said input sample, adding the metadata relating to each of said input sample in a metadata database, storing each of the input sample in a sample storage, wherein the adding comprises converting the original hashes of each of the input samples to SHA256 hashes according to a hash mapping table operatively connected to the metadata database, and wherein the storing comprises defining the filename of each of the input samples equal to the corresponding SHA256 hash.

    In-memory protection for controller security
    6.
    发明授权
    In-memory protection for controller security 有权

    公开(公告)号：US11995177B2

    公开(公告)日：2024-05-28

    申请号：US17330478

    申请日：2021-05-26

    Applicant: Karamba Security Ltd.

    Inventor： Assaf Harel ,  Amiram Dotan ,  Tal Efraim Ben David ,  David Barzilai

    IPC: G06F21/52 ,  G06F11/36 ,  G06F21/51 ,  G06F21/56 ,  G06F21/57 ,  H04L67/12

    CPC classification number: G06F21/52 ,  G06F11/3668 ,  G06F21/51 ,  G06F21/562 ,  G06F21/566 ,  G06F21/577 ,  G06F2221/033 ,  H04L67/12

    Abstract: In one implementation, a method for providing security on controllers includes detecting computer-readable code running on a controller, the computer-readable code including code portions that each include instructions to be performed by the controller; identifying a current code portion of the computer-readable code; accessing an in-memory graph that models an operational flow of the computer-readable code, wherein the in-memory graph includes a plurality of nodes, each of the nodes corresponding to one of the code portions and each of the nodes having a risk value for the associated code portion that is a measure of security risk for the associated code portion; identifying the risk value for the current code portion; selecting, from a plurality of available flow control integrity (IMV) schemes, an IMV scheme based on the identified risk value; and applying, to the code portion as the code portion is running on the controller, the selected IMV scheme.

Patent Agency Ranking