专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

WO2018009537A1 AUTOMATIC INLINE DETECTION BASED ON STATIC DATA 审中-公开
标题翻译：基于静态数据的自动在线检测
公开(公告)号：WO2018009537A1
公开(公告)日：2018-01-11
申请号：PCT/US2017/040711
申请日：2017-07-05
申请人： WEBROOT INC.
发明人： SCHMIDTLER, Mauritius , YOOSOOFMIYA, Reza M. , THEROUX, Kristina
IPC分类号： G06F21/56 , H04L29/06
CPC分类号： H04L63/1416 , G06F21/56 , G06F21/564 , H04L63/1408 , H04L63/1425 , H04L63/145 , H04L67/06
摘要： Examples of the present disclosure describe systems and methods of automatic inline detection based on static data. In aspects, a file being received by a recipient device may be analyzed using an inline parser. The inline parser may identify sections of the file and feature vectors may be created for the identified sections. The feature vectors may be used to calculate a score corresponding to the malicious status of the file as the information is being analyzed. If a score is determined to exceed a predetermined threshold, the file download process may be terminated. In aspects, the received files, file fragments, feature vectors and/or additional data may be collected and analyzed to build a probabilistic model used to identify potentially malicious files.
摘要翻译：本公开的示例描述了基于静态数据的自动内联检测的系统和方法。在各方面中，可以使用内联分析器来分析由接收方设备接收的文件。内联语法分析器可以识别文件的部分，并且可以为识别的部分创建特征向量。当信息被分析时，特征向量可以用于计算与文件的恶意状态相对应的分数。如果确定分数超过预定阈值，则可以终止文件下载过程。在各方面中，可以收集并分析接收到的文件，文件片段，特征向量和/或附加数据以构建用于识别潜在恶意文件的概率模型。

2. 发明申请

WO2014110146A1 MANAGED EXECUTION AND EXPIRATION OF AGENT COMMANDS 审中-公开
标题翻译：管理执行和执行代理人的命令
公开(公告)号：WO2014110146A1
公开(公告)日：2014-07-17
申请号：PCT/US2014/010701
申请日：2014-01-08
申请人： WEBROOT, INC.
发明人： JAROCH, Joseph , MORRIS, Melvyn
IPC分类号： G06F11/00
CPC分类号： H04L41/046 , G06F9/4843 , H04L67/10
摘要： Methods and apparatus for managing the expiration and execution of commands sent from a remote system having administration functions to an agent residing on a computer system are disclosed. An exemplary method includes receiving, at an agent, one or more commands, storing the one or more received commands, retrieving the one or more stored commands, and determining whether the one or more retrieved commands can be executed by comparing at least one time parameter associated with the agent to at least one time parameter associated with the one or more retrieved commands.
摘要翻译：公开了用于管理从具有管理功能的远程系统发送到驻留在计算机系统上的代理的命令的到期和执行的方法和装置。一种示例性方法包括在代理处接收一个或多个命令，存储一个或多个接收到的命令，检索一个或多个存储的命令，以及通过比较至少一个时间参数来确定是否可以执行所述一个或多个检索到的命令与所述代理相关联的至少一个时间参数与所述一个或多个检索到的命令相关联。

3. 发明申请

WO2017106477A1 REAL-TIME SCANNING OF IP ADDRESSES 审中-公开
标题翻译：实时扫描IP地址
公开(公告)号：WO2017106477A1
公开(公告)日：2017-06-22
申请号：PCT/US2016/066897
申请日：2016-12-15
申请人： WEBROOT INC.
发明人： HO, Huy Dang , LONAS, Hal , TRAN, Trung
IPC分类号： H04L12/26 , H04L29/06
CPC分类号： H04L63/14 , G06F21/44 , G06F21/552 , G06F2221/2103 , H04L43/18 , H04L61/2503 , H04L61/6068 , H04L63/1433
摘要： Examples of the present disclosure describe systems and methods of providing real-time scanning of IP addresses. In aspects, input may be received by a real-time IP scanning system. The system may generate one or more work orders based on the input. A scanner associated with the system may access a work order and attempt to communicate with one or more devices identified by the work order. If the attempted communication with a device is successful, a protocol analyzer may be used to provide a predefined payload to the device. If the response from the device matches an expected string, the device may be determined to be a safe and/or legitimate device. If the response from the device does not match an expected string, the device may be determined to be a malicious device.
摘要翻译：本公开的示例描述了提供IP地址的实时扫描的系统和方法。在各方面，输入可以由实时IP扫描系统接收。系统可以根据输入生成一个或多个工单。与系统相关联的扫描仪可以访问工作指令并尝试与工作指令所标识的一个或多个设备进行通信。如果尝试与设备的通信成功，则可以使用协议分析器向设备提供预定义的有效载荷。如果来自设备的响应与预期的字符串匹配，则设备可以被确定为安全和/或合法的设备。如果来自设备的响应与预期的字符串不匹配，则可能确定设备是恶意设备。

4. 发明申请

WO2021252742A1 SYSTEM AND METHOD FOR LEAK PREVENTION FOR DOMAIN NAME SYSTEM REQUESTS 审中-公开
公开(公告)号：WO2021252742A1
公开(公告)日：2021-12-16
申请号：PCT/US2021/036779
申请日：2021-06-10
申请人： WEBROOT, INC.
发明人： BARNETT, Jonathan Alexander Thorold
IPC分类号： H04L29/06 , H04L29/12 , G06F17/22 , G06F17/30 , G06F21/60 , H04L61/1511 , H04L63/0236 , H04L63/10 , H04L63/20 , H04L67/32
摘要： Embodiments of systems and methods for DNS leak prevention and protection are disclosed herein. In particular, certain embodiments include a local DNS protection agent installed on a system and an associated trusted external DNS protection server. The DNS protection agent prevents DNS leaks from applications on the system such that all DNS requests from the system are confined to requests from the DNS protection agent to the associated DNS protection server. As the DNS leak prevention provided by the DNS protection agent stops applications on the system from circumventing the DNS protection server, all DNS requests originating from the system remain under the control of the DNS protection server and thus desired DNS protection (e.g., as implemented on the DNS protection server) may be maintained. Certain embodiments prevent applications from using certain DNS security protocols, such as DoH and DoT, without going through the DNS protection agent.

5. 发明申请

WO2018017872A1 DYNAMIC SENSORS 审中-公开
标题翻译：动态传感器
公开(公告)号：WO2018017872A1
公开(公告)日：2018-01-25
申请号：PCT/US2017/043143
申请日：2017-07-20
申请人： WEBROOT INC.
发明人： DUFOUR, David , LONAS, Hal
IPC分类号： G06F21/57 , H04L29/06 , H04W4/00 , H04W12/12
摘要： Examples of the present disclosure describe systems and methods for generating dynamic sensors. In aspects, a device may be detected on a network. If the device is not recognized by the network, a generic container may be created. If the device is recognized by the network, a device-specific container may be created, and device-specific threat protection and/or a device-specific machine model may be loaded into the container. In either case, a threat intelligence model and/or an ecosystem-specific machine model may also be loaded into the container. The container may then be deployed to one or more networks. In aspects, the container may be used to analyze network traffic to sense potential threats for ecosystems comprising varying devices and topologies.
摘要翻译：本公开的示例描述了用于生成动态传感器的系统和方法。在各方面中，可以在网络上检测到设备。如果设备未被网络识别，则可以创建通用容器。如果设备被网络识别，则可以创建设备特定的容器，并且可以将特定于设备的威胁防护和/或设备特定的机器模型加载到容器中。无论哪种情况，威胁情报模型和/或生态系统特定的机器模型也可以加载到容器中。该容器然后可以被部署到一个或多个网络。在各方面，容器可用于分析网络流量以感测包括不同设备和拓扑的生态系统的潜在威胁。

6. 发明申请

WO2017087840A1 BINOCULAR FUSION ANALYTICS SECURITY 审中-公开
标题翻译：双目融合分析安全
公开(公告)号：WO2017087840A1
公开(公告)日：2017-05-26
申请号：PCT/US2016/062841
申请日：2016-11-18
申请人： WEBROOT INC.
发明人： WRIGHT, William , KELLERMAN, George D.
IPC分类号： H04L29/06 , G06F21/55
CPC分类号： H04L63/1425 , G06F21/552 , G06N7/005 , H04L63/1416
摘要： Examples of the present disclosure describe systems and methods for identifying anomalous network behavior. In aspects, a network event may be observed network sensors. One or more characteristics may be extracted from the network event and used to construct an evidence vector. The evidence vector may be compared to a mapping of previously-identified events and/or event characteristics. The mapping may be represented as one or more clusters of expected behaviors and anomalous behaviors. The mapping may be modeled using analytic models for direction detection and magnitude detection. One or more centroids may be identified for each of the clusters. A "best fit" may be determined and scored for each of the analytic models. The scores may be fused into single binocular score and used to determine whether the evidence vector is likely to represent an anomaly.
摘要翻译：本公开的示例描述了用于识别异常网络行为的系统和方法。在某些方面，网络事件可能会被网络传感器观察到。可以从网络事件中提取一个或多个特征并用于构建证据向量。证据向量可以与先前识别的事件和/或事件特征的映射进行比较。该映射可以表示为预期行为和异常行为的一个或多个集群。可以使用用于方向检测和幅度检测的分析模型对映射进行建模。可以为每个集群标识一个或多个质心。 “最适合” 可以为每个分析模型确定并评分。分数可以融合为单个双眼分数，并用于确定证据向量是否可能表示异常。

7. 发明申请

WO2016183316A8 AUTOMATIC THREAT DETECTION OF EXECUTABLE FILES BASED ON STATIC DATA ANALYSIS 审中-公开
公开(公告)号：WO2016183316A8
公开(公告)日：2016-11-17
申请号：PCT/US2016/032090
申请日：2016-05-12
申请人： WEBROOT INC.
发明人： SCHMIDTLER, Mauritius , DALAL, Gaurav , YOOSOOFMIYA, Reza
IPC分类号： G06F21/56 , G06F11/36 , G06F9/44 , G06F21/64 , G06F21/62
摘要： Aspects of the present disclosure relate to threat detection of executable files. A plurality of static data points may be extracted from an executable file without decrypting or unpacking the executable file. The executable file may then be analyzed without decrypting or unpacking the executable file. Analysis of the executable file may comprise applying a classifier to the plurality of extracted static data points. The classifier may be trained from data comprising known malicious executable files, known benign executable files and known unwanted executable files. Based upon analysis of the executable file, a determination can be made as to whether the executable file is harmful.

8. 发明申请

WO2015200211A1 NETWORK THREAT PREDICTION AND BLOCKING 审中-公开
标题翻译：网络威胁预测和阻塞
公开(公告)号：WO2015200211A1
公开(公告)日：2015-12-30
申请号：PCT/US2015/036973
申请日：2015-06-22
申请人： WEBROOT INC.
发明人： LONAS, Hal , DUFOUR, David , WITT, Chip
IPC分类号： H04L29/06 , H04L12/26
CPC分类号： H04L63/0227 , H04L41/069 , H04L63/14 , H04L63/1425 , H04L63/1441
摘要： A firewall monitors network activity and stores information about that network activity in a network activity log. The network activity is analyzed to identify a potential threat. The potential threat is further analyzed to identify other potential threats that are related to the potential threat, and are likely to pose a future risk to a protected network. A block list is updated to include the potential threat and the other potential threats to protect the protected network from the potential threat and the other potential threats.
摘要翻译：防火墙监控网络活动并将有关该网络活动的信息存储在网络活动日志中。分析网络活动以识别潜在的威胁。进一步分析潜在威胁，以确定与潜在威胁相关的其他潜在威胁，并可能对受保护网络构成未来风险。更新阻止列表以包含潜在威胁和其他潜在威胁，以保护受保护的网络免受潜在威胁和其他潜在威胁。

9. 发明申请

WO2015113052A1 DETECTING AND PREVENTING EXECUTION OF SOFTWARE EXPLOITS 审中-公开
标题翻译：检测和防止软件出现的执行
公开(公告)号：WO2015113052A1
公开(公告)日：2015-07-30
申请号：PCT/US2015/013111
申请日：2015-01-27
申请人： WEBROOT INC.
发明人： GIULIANI, Marco , BIZZARRI, Marco , VOLTATTORNI, Benedetto , MAYR, Johannes
IPC分类号： G06F21/50
CPC分类号： H04L63/1441 , G06F21/52 , G06F21/554 , H04L63/1408
摘要： In non-limiting examples, anti-exploit systems and methods described herein monitor a memory space of a process for execution of functions. Stack walk processing is executed upon invocation of one of the functions in the monitored memory space. During execution of the stack walk processing, at least one memory check is performed to detect suspicious behavior. An alert of suspicious behavior is triggered when the performing of the memory check detects at least one of: code execution attempted from non-executable memory, identification of an invalid base pointer, identification of an invalid stack return address, attempted execution of a return-oriented programming technique, the base pointer is outside a current thread stack, and a return address is detected as being inside a virtual memory area. If an alert of suspicious behavior is triggered, execution of a payload is prevented for the invoked function.
摘要翻译：在非限制性示例中，本文所述的防攻击系统和方法监视用于执行功能的过程的存储器空间。在调用监视的存储器空间中的一个功能时执行堆栈步进处理。在堆栈行进处理的执行期间，执行至少一个存储器检查以检测可疑行为。当执行存储器检查检测到以下至少之一时触发可疑行为的警报：从不可执行存储器尝试的代码执行，无效基础指针的标识，无效堆栈返回地址的标识，基本指针位于当前线程堆栈之外，并且返回地址被检测为位于虚拟存储器区域内。如果触发了可疑行为的警报，则对被调用的功能可以防止有效载荷的执行。

10. 发明申请

WO2016183316A1 AUTOMATIC THREAT DETECTON OF EXECUTABLE FILES BASED ON STATIC DATA ANALYSIS 审中-公开
标题翻译：基于静态数据分析的可执行文件的自动威胁检测
公开(公告)号：WO2016183316A1
公开(公告)日：2016-11-17
申请号：PCT/US2016/032090
申请日：2016-05-12
申请人： WEBROOT INC.
发明人： SCHMIDTLER, Mauritius , DALAL, Gaurav , YOOSOOFMIYA, Reza
IPC分类号： G06F21/56 , G06F11/36 , G06F9/44 , G06F21/64 , G06F21/62
CPC分类号： G06F21/565 , G06F8/53 , G06F21/562 , G06F2221/033 , G06N99/005
摘要： Aspects of the present disclosure relate to threat detection of executable files. A plurality of static data points may be extracted from an executable file without decrypting or unpacking the executable file. The executable file may then be analyzed without decrypting or unpacking the executable file. Analysis of the executable file may comprise applying a classifier to the plurality of extracted static data points. The classifier may be trained from data comprising known malicious executable files, known benign executable files and known unwanted executable files. Based upon analysis of the executable file, a determination can be made as to whether the executable file is harmful.
摘要翻译：本公开的方面涉及可执行文件的威胁检测。可以从可执行文件中提取多个静态数据点，而无需解密或解包可执行文件。然后可以分析可执行文件而不对可执行文件进行解密或解包。可执行文件的分析可以包括将分类器应用于多个提取的静态数据点。分类器可以从包括已知恶意可执行文件，已知的良性可执行文件和已知的不可执行文件的数据进行培训。基于可执行文件的分析，可以确定可执行文件是否是有害的。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式