AO Kaspersky Lab

A system generates a temporal model for a phishing resource from the database. The system evaluates the phishing resource based on the temporal model. The system determines that the phishing resource is non-phishing based on evaluation results generated during the evaluating. The system updates information about the phishing resource in the database.

An exemplary method for security monitoring and incident response using large language models comprises: receiving input data from elements of Security Operations Center (SOC), generating and sending a query based on the received input data to a Large Language Model (LLM), parsing a response received from the LLM, and performing analysis to determine whether a threat has been identified. In one aspect, the method further comprises: when a threat is identified, collecting artifacts of the threat, and analyzing the threat further with involvement of security professionals, when a threat is not identified, determining whether additional data is needed, and when additional data is needed, determining a type of the additional data, when the type of additional data that is determined, collecting additional information from elements of the SOC, and when additional data is not needed, terminating the incident response.

Discloses are systems and method for detecting malicious code in a file. The system receives at least one file. The system analyzes the at least one file, during which offsets from a beginning of the at least one file are detected for data that is similar to code that assembles strings in memory from data included in machine instructions. The system performs emulation of the machine instructions included in the code according to the detected offsets, further comprising: checking an effect of each respective machine instruction of the machine instructions on a control flow, and extracting strings from virtual memory if the respective machine instruction affects the control flow. The system analyzes extracted strings, during which malicious code is detected using malicious code detection rules.

Disclosed system and method for secure transfer of data between networks. An example method comprises: setting a first state of the gateway, wherein in the first state a destination agent of the gateway is granted access to a first memory and denied access to a second network; while the gateway is in the first state, configuring the destination agent, based on one or more parameters stored in the first memory, to transfer data received from a source agent of the gateway to the second network; changing the state of the gateway to a second state, wherein in the second state the destination agent is denied access to the first memory and granted access to the second network; and while the gateway is in the second state, controlling transfer of the data from the source agent of the first network to the destination agent of the second network.

Disclosed are systems and methods for blocking the malicious activity of legitimate drivers. An example method comprises collecting information about protected objects and information about drivers loaded in an operating system (OS) of a computer system; detecting at least one legitimate driver using information about the drivers loaded into the OS and malicious activity detection rules; intercepting an Import Address Table (IAT) call and/or an input/output control (IOCTL) system call made by at least one legitimate driver; determining if the intercepted call is directed to a protected object and triggers a malicious activity detection rule that requires blocking of the intercepted call; and blocking the intercepted call from detected legitimate drivers directed to the protected object based on the triggered malicious activity detection rule.

Disclosed are systems and methods for loading an operating system (OS) driver. An example method comprises: receiving, by a server, at least one version of the OS kernel; compiling the driver for each version of the OS kernel; generating a driver template by removing from at least one compiled driver information necessary to load said compiled driver into an OS; generating a configuration file that includes necessary information to load the driver on at least one version of the OS kernel, wherein the necessary information is extracted from the compiled drivers; and transmitting, by the server, the driver template and the configuration file to a OS of the client which assembles a resulting driver from the driver template and the configuration file and loads at least one resulting driver into the OS of the client.

A method for determination of anomalies in a cyber-physical system (CPS) includes generating one or more diagnostic rules configured to calculate at least one auxiliary CPS variable. One or more values of the at least one auxiliary CPS variable are calculated for a predefined output interval of time based on collected values of a group of primary CPS variables for a predefined input interval of time based on the generated diagnostic rule. An anomaly is determined based on the collected values of the group of primary CPS variables and the one or more calculated values of the at least one auxiliary CPS variable.

Disclosed herein are systems and methods for anti-virus scanning of objects on a mobile device. In one aspect, a method comprises: receiving, by a security module, a command to perform an anti-virus scan of an object; checking, by the security module, whether a mobile security application is installed or pre-installed on the mobile device; when the mobile security application is installed or pre-installed, determining whether the mobile security application is activated, and when the mobile security application is not activated, activating the mobile security application; when the mobile security application is not installed or pre-installed on the mobile device, installing and activating the mobile security application; transmitting, by the security module, the object to the mobile security application for performing an anti-virus scan of the object; and performing an anti-virus scan of the object to determine whether the object is malicious.

Disclosed herein are systems and methods for detecting phishing sites using Document Object Model (DOM) hashes and a machine learning (ML) classifier. In one aspect, an exemplary method comprises: parsing at least one webpage of a website to generate a DOM tree of the webpage; generating at least one string of DOM tree elements according to one of more predetermined patterns; generating a hash of at least one string; checking if the hash is found in a database of hashes of known fishing websites; when the hash is not in the database, analyzing the associated webpage using a ML-based classifier trained to identify phishing websites; and determining if the webpage is a phishing or not based on the output of the classifier.

A method of interrupting an incoming call on a mobile device includes: intercepting an incoming telephone call received by a mobile device; determining one or more parameters of the intercepted telephone call; determining if the intercepted telephone call matches one or more telephone calls associated with a list of prohibited phone numbers by comparing the determined parameters of the intercepted call with parameters of the one or more telephone calls associated with the list of prohibited phone numbers; and in response to determining a match between the intercepted telephone call and the one or more telephone calls associated with the list of prohibited phone numbers: blocking reception of the intercepted telephone call; identifying a calling party associated with the intercepted telephone call; sending an authentication request to the identified calling party; and interrupting the intercepted telephone call in response to unsuccessful authentication.