Anti-virus vendors are confronted with a multitude of potentially malicious samples today. Receiving thousands of new samples every day is not uncommon. The signatures that detect confirmed malicious threats are mainly still created manually, so it is important to discriminate between samples that pose a new unknown threat and those that are mere variants of known malware.This survey article provides an overview of techniques based on dynamic analysis that are used to analyze potentially malicious samples. It also covers analysis programs that leverage these It also covers analysis programs that employ these techniques to assist human analysts in assessing, in a timely and appropriate manner, whether a given sample deserves closer manual inspection due to its unknown malicious behavior.

/pdf/a-survey-on-automated-dynamic-malware-analysis-techniques-2b10kp3xz0.pdf

A survey on automated dynamic malware-analysis techniques and tools

Anomaly detection is an important problem that has been well-studied within diverse research areas and application domains. The aim of this survey is two-fold, firstly we present a structured and comprehensive overview of research methods in deep learning-based anomaly detection. Furthermore, we review the adoption of these methods for anomaly across various application domains and assess their effectiveness. We have grouped state-of-the-art research techniques into different categories based on the underlying assumptions and approach adopted. Within each category we outline the basic anomaly detection technique, along with its variants and present key assumptions, to differentiate between normal and anomalous behavior. For each category, we present we also present the advantages and limitations and discuss the computational complexity of the techniques in real application domains. Finally, we outline open issues in research and challenges faced while adopting these techniques.

Deep Learning for Anomaly Detection: A Survey.

An integrated system includes a system user interface (SUI) that provides an iconic, at-a-glance representation of integrated security system status. The SUI is for use across all client devices including mobile or cellular telephones, a mobile portal, a web portal, and a touchscreen device. The SUI includes a number of display elements presented across all types of client devices for monitoring status of the integrated security system. The display elements of the SUI include an orb icon, text summary, security button, device warnings, system warnings, interesting sensors, and quiet sensors. The SUI thus provides system status summary information agnostically across all clients. Additionally, the SUI provides consistent iconography, terminology, and display rules across all clients as well as consistent sensor and system detail across clients.

Cross-client sensor user interface in an integrated security network

A method for protecting a network from an attack includes measuring a property of traffic entering the network, and analyzing the property using at least one fuzzy logic algorithm in order to detect the attack.

Dynamic network protection

Disclosed is an improved approach to implement I/O and storage device management in a virtualization environment. According to some approaches, a Service VM is employed to control and manage any type of storage device, including directly attached storage in addition to networked and cloud storage. The Service VM implements the Storage Controller logic in the user space, and can be migrated as needed from one node to another. IP-based requests are used to send I/O request to the Service VMs. The Service VM can directly implement storage and I/O optimizations within the direct data access path, without the need for add-on products.

Architecture for managing I/O and storage for a virtualization environment

A technique for self-isolation of a network device that has been identified as potentially harmful. The network device may be isolated from the network except for an out-of-band communication channel that can be used for management purposes to restore or repair the device prior to the network connection being re-established.

Techniques for self-isolation of networked devices

Generally, this disclosure describes systems and methods for transparently instrumenting a computer process. The systems and methods are configured to allow instrumenting executable code while permitting legacy memory scanning tools to monitor corresponding uninstrumented executable code stored in memory.

Method and apparatus for transparently instrumenting an application program

This document describes a Policy Information Base (PIB) for a device implementing the Differentiated Services Architecture. The provisioning classes defined here provide policy control over resources implementing the Differentiated Services Architecture. These provisioning classes can be used with other none Differentiated Services provisioning classes (defined in other PIBs) to provide for a comprehensive policy controlled mapping of service requirement to device resource capability and usage.

/pdf/differentiated-services-quality-of-service-policy-411hsjh6kd.pdf

Differentiated Services Quality of Service Policy Information Base

Hardware of a virtualized processor based system detecting a specified type of memory access to an identified region of memory and in response to the detecting generating an interrupt for a virtual machine monitor (VMM) of the virtualized processor based system.

Providing protected access to critical memory regions

A network intrusion detection unit (NIDU) identifies a protocol used to transmit a packet and the flow to which the packet belongs. The NIDU determines whether a rules table exists for the protocol, and determines, if the rules table exists, whether a state table includes a matching flow entry corresponding to the flow. If the state table includes the matching flow entry, the NIDU determines whether a state of the flow will transition from a current state indicated in the matching flow entry to a valid destination state indicated in a state-transition rule in the rules table. If the state of the flow will not transition to a valid destination state, the NIDU discards the packet.

Ravi L. Sahita

Papers

Techniques for self-isolation of networked devices

Method and apparatus for transparently instrumenting an application program

Differentiated Services Quality of Service Policy Information Base

Providing protected access to critical memory regions

State-transition based network intrusion detection