A system analyzes content accessed at a network site to determine whether it is malicious. The system employs a tool able to identify spyware that is piggy-backed on executable files (such as software downloads) and is able to detect “drive-by download” attacks that install software on the victim's computer when a page is rendered by a browser program. The tool uses a virtual machine (VM) to sandbox and analyze potentially malicious content. By installing and running executable files within a clean VM environment, commercial anti-spyware tools can be employed to determine whether a specific executable contains piggy-backed spyware. By visiting a Web page with an unmodified browser inside a clean VM environment, predefined “triggers,” such as the installation of a new library, or the creation of a new process, can be used to determine whether the page mounts a drive-by download attack.

Detection of spyware threats within virtual machine

A system and method are provided for identifying inappropriate content in websites on a network. Unrecognized uniform resource locators (URLs) or other web content are accessed by workstations and are identified as possibly having malicious content. The URLs or web content may be preprocessed within a gateway server module or some other software module to collect additional information related to the URLs. The URLs may be scanned for known attack signatures, and if any are found, they may be tagged as candidate URLs in need of further analysis by a classification module.

System and method of analyzing web content

A method of detecting malicious software (malware) includes receiving a file and storing a memory baseline for a system. The method also includes copying the file to the system, executing the file on the system, terminating operation of the system, and storing a post-execution memory map. The method further includes analyzing the memory baseline and the post-execution memory map and determining that the file includes malware.

Method and system for automatic detection and analysis of malware

According to one embodiment, a computer-implemented method for execution on one or more processors includes receiving a first file and determining a file type of the first file. The method also includes determining, according to a first policy, a plurality of malware detection schemes to apply to the first file based on the determined file type of the first file. In addition, the method includes scheduling the application of the determined plurality of malware detection schemes to the first file amongst a plurality of detection nodes according to a second policy. Further, the method includes determining, in response to determining the results of applying the plurality of malware detection schemes, that the first file is malware or determining that the first file is suspected malware according to a third policy.

System and method for malware detection

Methods, systems, and media for detecting covert malware are provided. In accordance with some embodiments, a method for detecting covert malware in a computing environment is provided, the method comprising: generating simulated user activity outside of the computing environment; conveying the simulated user activity to an application inside the computing environment; and determining whether a decoy corresponding to the simulated user activity has been accessed by an unauthorized entity.

Methods, systems, and media for detecting covert malware

Pattern recognition of common modes by neural networks and other techniques are used to monitor and determine or predict the state of networks, computers, software systems, logical networks or other components of an information system, to report actual or predicted states, and to report other state characteristics.

Method and apparatus for system state monitoring using pattern recognition and neural networks

A method for detecting malicious programs, the method includes determining whether an object is suspicious, opening the suspicious object in a disposable, secure, single purpose VM (virtual machine) session and detecting indications of malicious behavior when the suspicious object is opened within the VM session.

Method and system for isolating suspicious email

An adaptive system modeling method is provided. A system model is generated by using data corresponding to an input features set selected by using a baseline significance signature of the system. A superset of the input features and other features also is selected by using the baseline significance signature. Data collected from the system corresponding to the superset is maintained online. A new significance signature of the system is periodically or intermittently determined by performing a discriminant analysis using the online superset data, and is used to detect an evolutionary change in the system.

Method and apparatus for discovering evolutionary changes within a system

Method and apparatus for providing computer security is provided. Subscriber information is stored in a repository and an exploit probe is sent to a subscriber's computer system. A probe message based on the computer system's response to the exploit probe is generated.

Method and apparatus for providing computer security

A method for plan generation is provided. One or more initial plans are generated and evaluated to determine quality scores for the plans. One or more of the plans is selected according to the quality scores and modified to generate modified plans. The modified plans are evaluated to determine updated quality scores for the modified plans. Selection, modification and evaluation of modified plans are repeated until one of the modified plans is satisfactory.

David E. Huddleston

Papers

Method and apparatus for system state monitoring using pattern recognition and neural networks

Method and system for isolating suspicious email

Method and apparatus for discovering evolutionary changes within a system

Method and apparatus for providing computer security

Method and apparatus for plan generation