Sophos Limited

Embodiments disclosed include methods and apparatus for visualization of data and models (e.g., machine learning models) used to monitor and/or detect malware to ensure data integrity and/or to prevent or detect potential attacks. Embodiments disclosed include receiving information associated with artifacts scored by one or more sources of classification (e.g., models, databases, repositories). The method includes receiving inputs indicating threshold values or criteria associated with a classification of maliciousness of an artifact and for selecting sample artifacts. The method further includes classifying and selecting the artifacts, based on the criteria, to define a sample set, and based on the sample set, generating a ground truth indication of classification of maliciousness for each sample artifact in the sample set. The method further includes using the ground truth indications to evaluate and display, via an interface, a representation of a performance of sources of classification and/or quality of data.

Systems and methods for generating a network policy. The method includes receiving at an interface a goal-based rule specifying a network policy that is to be enforced at each of a plurality of enforcement points; communicating the goal-based rule to one or more processors executing instructions stored on memory to provide a rules service; generating a first serialized rule based on the goal-based rule and a first enforcement point of the plurality of enforcement points, wherein the first serialized rule is in a first format interpretable by the first enforcement point; generating a second serialized rule based on the goal-based rule and a second enforcement point of the plurality of enforcement points, wherein the second serialized rule is in a second format interpretable by the second enforcement point. The method further includes enforcing the first serialized rule at the first enforcement point and enforcing the second serialized rule at the second enforcement point.

Systems and methods for managing traffic in a network that uses Zero Trust Network Access (ZTNA). The method includes providing a ZTNA gateway in connectivity with a first network, providing a ZTNA agent on a first user device in connectivity with the first network, and analyzing, using at least one of the ZTNA gateway or the first user device, a communication between the ZTNA gateway and the first user device to determine whether the first user device is on the first network. The method further includes enabling the first device to access a first resource on the first network without tunneling traffic from the first user device to the ZTNA gateway upon determining the user device is on the first network.

Systems and methods for generating at least one object for a network policy. The method includes receiving at an interface a first object including a first plurality of data entries of a first type; storing the first object in a cloud accessible storage location for subsequent access; receiving at the interface a second object including a second plurality of data entries of the first type; storing the second object in the cloud accessible storage location for subsequent access; receiving a request to enforce a network policy that uses the first object; determining, using one or more processors executing instructions stored on memory, that the first object references the second object; and enforcing, using the one or more processors, the network policy using the first object and second object.

A method for protecting against minifilter squatting attacks includes installing an endpoint detection and response system on an endpoint device, wherein the endpoint detection and response system includes at least one filesystem minifilter driver, and appending the at least one filesystem minifilter driver with a randomly generated fractional to an assigned integer altitude at a time of loading the at least one filesystem minifilter driver and/or inserting a combination of randomly generated characters into a minifilter instance name at the time of loading the at least one filesystem minifilter driver.

A method for protecting against minifilter squatting attacks includes installing an endpoint detection and response system on an endpoint device, wherein the endpoint detection and response system includes at least one filesystem minifilter driver, and appending the at least one filesystem minifilter driver with a randomly generated fractional to an assigned integer altitude at a time of loading the at least one filesystem minifilter driver and/or inserting a combination of randomly generated characters into a minifilter instance name at the time of loading the at least one filesystem minifilter driver.

A method includes obtaining a pre-trained LLM that generates a resulting malicious response to a malicious prompt input to the LLM. The method further includes adjusting a respective weight of neurons of the LLM to cause the LLM to generate a known malicious response to a test prompt input to the LLM, where the test prompt includes a plurality of known test tokens. The method further includes identifying a subset of the neurons based on comparing a respective activity level of each neuron in response to the test prompt with a baseline activity level. The method further includes modifying the respective weights of one or more neurons in the subset of the neurons in the LLM such that, after the modifying, a likelihood that the LLM generates the resulting malicious response to the malicious prompt is below a threshold likelihood value.

A threat management facility receives data from a variety of sources such as compute instances within an enterprise network, cloud service providers supporting the enterprise network, and third-party data providers such as geolocation services. In order to facilitate prompt notification of potential risks, the threat management facility may incrementally update data for use in threat assessments as the data becomes available from these different sources, and create suitable alerts or notifications whenever the currently accumulated data provides an indication of threat meeting a predetermined threshold.

Systems and methods for updating a network appliance. The method includes receiving an update request from a network appliance, wherein the update request includes at least one self-signed certificate; executing an authentication procedure to authenticate the network appliance; providing the network appliance with at least one updated certificate associated with a controller device; enabling communication between the appliance and a controller device; and providing to the appliance a network resource location indicator of a firmware repository including an updated firmware version to allow the appliance to obtain the updated firmware version.

In embodiments, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation.