专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20230070519A1 STATISTICAL ANALYSIS OF NETWORK BEHAVIOR USING EVENT VECTORS TO IDENTIFY BEHAVIORAL ANOMALIES USING A COMPOSITE SCORE 有权
公开(公告)号：US20230070519A1
公开(公告)日：2023-03-09
申请号：US17947684
申请日：2022-09-19
申请人： Webroot Inc.
发明人： William Wright , George D. Kellerman
IPC分类号： H04L9/40 , G06N7/00 , G06F21/55
摘要： Examples of the present disclosure describe systems and methods for identifying anomalous network behavior. In aspects, a network event may be observed network sensors. One or more characteristics may be extracted from the network event and used to construct an evidence vector. The evidence vector may be compared to a mapping of previously-identified events and/or event characteristics. The mapping may be represented as one or more clusters of expected behaviors and anomalous behaviors. The mapping may be modeled using analytic models for direction detection and magnitude detection. One or more centroids may be identified for each of the clusters. A “best fit” may be determined and scored for each of the analytic models. The scores may be fused into single binocular score and used to determine whether the evidence vector is likely to represent an anomaly.

2. 发明授权

US11481486B2 Behavioral threat detection engine 有权
公开(公告)号：US11481486B2
公开(公告)日：2022-10-25
申请号：US16366065
申请日：2019-03-27
申请人： Webroot Inc.
发明人： Eric Klonowski , Fred Krenson
IPC分类号： G06F21/55 , G06F9/455 , G06F21/56
摘要： Examples of the present disclosure describe systems and methods for a behavioral threat detection engine. In examples, the behavioral threat detection engine manages execution of one or more virtual machines, wherein each virtual machine processes a rule in relation to a context. The behavioral threat detection engine uses any of a variety of techniques to identify when events occur. Accordingly, the behavioral threat detection engine provides event indications, in the form of event packets, to one or more virtual machines, such that corresponding rules are able to process the events accordingly. Eventually, a rule may make a determination as to the presence or absence of a behavior. As a result, execution of the associated virtual machine may be halted, thereby indicating to the behavioral threat detection engine that a determination has been made. Thus a behavioral threat detection engine employs a behavior-based approach to detecting malicious or potentially malicious behaviors.

3. 发明申请

US20220284094A1 METHODS AND APPARATUS FOR MALWARE THREAT RESEARCH 有权
公开(公告)号：US20220284094A1
公开(公告)日：2022-09-08
申请号：US17751275
申请日：2022-05-23
申请人： Webroot Inc.
发明人： Melvyn Morris , Paul Stubbs , Markus Hartwig , Darren Harter
IPC分类号： G06F21/56 , G06F21/57
摘要： In one aspect, a method of classifying a computer object as malware includes receiving at a base computer data about a computer object from each of plural remote computers on which the object or similar objects are stored. The data about the computer object received from the plural computers is compared in the base computer. The computer object is classified as malware on the basis of said comparison. In one embodiment, the data about the computer object includes one or more of: executable instructions contained within or constituted by the object; the size of the object; the name of the object; the logical storage location or path of the object on the respective remote computers; the vendor of the object; the software product and version associated with the object; and, events initiated by or involving the object when the object is created, configured or runs on the respective remote computers.

4. 发明申请

US20220217160A1 WEB THREAT INVESTIGATION USING ADVANCED WEB CRAWLING 有权
公开(公告)号：US20220217160A1
公开(公告)日：2022-07-07
申请号：US17549313
申请日：2021-12-13
申请人： WEBROOT, INC.
发明人： John Morgan , Rob Tietje , David Wang , Tejas Pattabhi , Josh Biol
IPC分类号： H04L9/40 , G06F16/951
摘要： Examples of the present disclosure describe systems and methods for evaluating malicious web content for associated threats using specialized web crawling techniques. A seed resource identifier is evaluated to determine a second resource identifier associated with the seed resource identifier. A resource corresponding to the second resource identifier is scanned to identify a third resource identifier. The third resource identifier is processed with a machine learning model to classify the third resource identifier according to a classification representing a predicted level of threat. The machine learning model trained to classify resource identifiers into a plurality of classifications. A corrective action can be executed based on the classification of the third resource identifier.

5. 发明申请

US20210232674A1 RESTRICTING ACCESS TO APPLICATION PROGRAMMING INTERFACES (APIs) 有权
公开(公告)号：US20210232674A1
公开(公告)日：2021-07-29
申请号：US17228258
申请日：2021-04-12
申请人： Webroot Inc.
发明人： Andrew L. Sandoval , John R. Shaw, II
IPC分类号： G06F21/51 , G06F9/54 , G06F21/62 , G06F21/52
摘要： Examples of the present disclosure describe systems and methods for restricting access to application programming interfaces (APIs). For example, when a process calls an API, the API call may be intercepted by a security system for evaluation of its trustfulness before the API is allowed to run. Upon intercepting an API call, the process calling the API may be evaluated to determine if the process is known to the security system, such that known processes that are untrusted may be blocked from calling the API. Further, when the security system cannot identify the process calling the API, the security service may evaluate a call stack associated with the call operation to determine if attributes of the call operation are known to the security system. If the call operation is known to the security system as untrusted, the call operation may be blocked from calling the API.

6. 发明申请

US20210182389A1 Discrete Processor Feature Behavior Collection 有权
公开(公告)号：US20210182389A1
公开(公告)日：2021-06-17
申请号：US17187180
申请日：2021-02-26
申请人： Webroot Inc.
发明人： Eric Klonowski
IPC分类号： G06F21/55 , G06F21/56 , G06F11/34 , G06F11/36
摘要： Examples of the present disclosure describe systems and methods for discrete processor feature behavior collection and analysis. In aspects, a monitoring utility may initialize a set of debugging and/or performance monitoring feature sets for a microprocessor. When the microprocessor receives from software content a set of instructions that involves the loading of a set of modules or code segments, the set of modules or code segments may be evaluated by the monitoring utility. The monitoring utility may generate a process trace of the loaded set of modules or code segments. Based on the process trace output, various execution paths may be reconstructed in real-time. The system and/or API calls made by the microprocessor may then be compared to the process trace output to quickly observe the interaction between the software content and the operating system of the microprocessor.

7. 发明授权

US11005879B2 Peer device protection 有权
公开(公告)号：US11005879B2
公开(公告)日：2021-05-11
申请号：US16018156
申请日：2018-06-26
申请人： Webroot Inc.
发明人： Paul Barnes
IPC分类号： H04L29/06 , H04L29/08 , H04L12/24 , H04W12/00 , H04L12/26 , H04W84/18 , H04W4/70
摘要： Peer device protection enables a first device comprising a digital security agent to remedy security issues on (or associated with) a set of devices visible to the first device. The first device may comprise a digital security agent may identify a set of devices visible to the first device. The first device may monitor the set of devices to collect data, such as types of communications and data points of interest. The digital security agent may apply threat detection to the collected data to identify anomalous network behavior. When anomalous network behavior is detected, the first device may cause an indicator of compromise (IOC) to be generated. Based on the IOC, the first device may facilitate remediation of the anomalous network behavior and/or apply security to one or more devices in the set of devices.

8. 发明申请

US20210049262A1 STACK PIVOT EXPLOIT DETECTION AND MITIGATION 有权
公开(公告)号：US20210049262A1
公开(公告)日：2021-02-18
申请号：US17088285
申请日：2020-11-03
申请人： Webroot Inc.
发明人： Andrew Sandoval
IPC分类号： G06F21/52 , G06F11/36
摘要： Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting exploits. In aspects, various “checkpoints” may be identified in software code. At each checkpoint, the current stack pointer, stack base, and stack limit for each mode of execution may be obtained. The current stack pointer for each mode of execution may be evaluated to determine whether the stack pointer falls within a stack range between the stack base and the stack limit of the respective mode of execution. When the stack pointer is determined to be outside of the expected stack range, a stack pivot exploit is detected and one or more remedial actions may be automatically performed.

9. 发明授权

US10902124B2 Real-time JavaScript classifier 有权
公开(公告)号：US10902124B2
公开(公告)日：2021-01-26
申请号：US15884673
申请日：2018-01-31
申请人： Webroot Inc.
发明人： Mauritius A. Schmidtler , Yuanhang Huang , Chahm An
IPC分类号： G06F21/00 , G06F21/56 , G06F21/55 , H04L29/06
摘要： Aspects of the present disclosure are operable to protect against malicious objects, such as JavaScript code, which may be encountered, downloaded, or otherwise accessed from a content source by a computing system. In an example, antivirus software implementing aspects disclosed herein may be capable of detecting malicious objects in real-time. Aspects of the present disclosure aim to reduce the amount of time used to detect malicious code while maintaining detection accuracy, as detection delays and/or a high false positive rate may result in a negative user experience. Among other benefits, the systems and methods disclosed herein are operable to identify malicious objects encountered by a computing system while maintaining a high detection rate, a low false positive rate, and a high scanning speed.

10. 发明授权

US10594710B2 Statistical analysis of network behavior using event vectors to identify behavioral anomalies using a composite score 有权
公开(公告)号：US10594710B2
公开(公告)日：2020-03-17
申请号：US15355561
申请日：2016-11-18
申请人： Webroot Inc.
发明人： William Wright , George D. Kellerman
IPC分类号： G06F21/55 , G06F21/50 , H04L29/06 , G06N7/00
摘要： Examples of the present disclosure describe systems and methods for identifying anomalous network behavior. In aspects, a network event may be observed network sensors. One or more characteristics may be extracted from the network event and used to construct an evidence vector. The evidence vector may be compared to a mapping of previously-identified events and/or event characteristics. The mapping may be represented as one or more clusters of expected behaviors and anomalous behaviors. The mapping may be modeled using analytic models for direction detection and magnitude detection. One or more centroids may be identified for each of the clusters. A “best fit” may be determined and scored for each of the analytic models. The scores may be fused into single binocular score and used to determine whether the evidence vector is likely to represent an anomaly.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式