Detection and mitigation of fileless security threats
AssigneeMcAfee, Inc.
InventorsGerman Lancioni, Cedric Cochin, Kunal Mehta
Life of this patent
Estimating the term…
Abstract
There is disclosed in one example a computing apparatus, including: a hardware platform; and a storage medium having stored thereon executable instructions to provide an inference engine configured to: receive a new suspicious fragment object from a protected device; add the new suspicious fragment object to a rolling map configured to provide a temporal snapshot of suspicious fragment objects over a time span; determine a connection between the new suspicious fragment object and an existing suspicious fragment object within the rolling map; apply the connection to a connection map; and operate a map classifier to determine that the connection map represents a probable computer security threat.
Claims20
A computing apparatus, comprising:
- a hardware platform;
- and
- a storage medium having stored thereon executable instructions to provide an inference engine configured to:
- receive a new suspicious fragment object from a protected device;
- add the new suspicious fragment object to a rolling map configured to provide a temporal snapshot of suspicious fragment objects over a time span;
- determine a connection between the new suspicious fragment object and an existing suspicious fragment object within the rolling map;
- apply the connection to a connection map;
- and
- operate a map classifier to determine that the connection map represents a probable computer security threat.
One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to provide an inference engine configured to:
- receive a new suspicious fragment object from a client device;
- add the new suspicious fragment object to a rolling map configured to provide a snapshot of suspicious fragment objects over a time span;
- identify a probable connection between the new suspicious fragment object and an existing suspicious fragment object within the rolling map;
- apply the connection to a connection map;
- and
- determine that the connection map represents a probable computer security threat.
A computing device, comprising:
- a hardware platform;
- a storage medium having encoded thereon instructions to provide a threat detection engine comprising:
- a plurality of harvesters to harvest new or updated objects from a plurality of persistent system elements;
- an extractor to extract potential code fragments from the new or updated objects;
- and
- a fragment classifier to identify a fragment as suspicious;
- and
- an interface to provide the suspicious fragment to an inference engine.
Dependencies are inferred from the claim text.