Trend Micro Incorporated

Anomalous loading of a dynamic-link library (DLL) is detected on a desktop computer. When the file of the DLL is not a known normal file, the locality sensitive (LSH) values of files of known versions of a known normal DLL that corresponds to the DLL are obtained from an LSH repository and compared to the LSH value of the file of the DLL. The smallest distance between the LSH value of the file of the DLL and each of the LSH values from the repository is selected for comparison to a risk threshold. The Loading of the DLL is detected to be an anomaly when the smallest distance is not less than the risk threshold.

A cloud computing platform provides compute instances of customer accounts. A shell script in a compute instance is evaluated by normalizing the shell script to output a set of tokens that are separated by a predetermined separator. The set of tokens is searched for presence of reference tokens. The counts of the reference tokens in the set of tokens are formed into an occurrence vector, which is evaluated by a machine learning model to determine if the shell script is malicious.

Disclosed are a system and method for detecting an unauthorized Internet of things (IoT) device in a private computer network. Packets of network traffic are collected in the private computer network. An IoT packet is identified from among the collected packets. IoT data is extracted from the IoT packet and encrypted. The encrypted IoT data is transmitted to an artificial neural network in the cloud over the public Internet. The artificial neural network infers, based on the encrypted IoT data, a device type of an IoT device that transmitted the IoT packet in the private computer network. The IoT device is detected to be unauthorized in response to detecting that the device type of the IoT device is not a recognized IoT device type in the private computer network.

Software products that are installed on a computer are identified from application names of application programs on the computer. The application names are pre-filtered to discard those that do not meet initial product filtering criteria that were used to collect sample data from which training datasets for training encoder-only transformer models were selected. Application names that meet initial product filtering criteria are classified using the encoder-only transformer models. Application names that have been classified by the encoder-only transformer models as those of supported products are post-filtered to discard those that do not meet the initial product filtering criteria of corresponding supported products. Application names that have not been discarded by the post-filtering are deemed to be those of software products installed on the computer.

A cybersecurity system protects personally identifiable information (PII) of users on a computer network. A webpage received in an endpoint computer of the cybersecurity system is parsed to detect one or more input fields that ask a user of the endpoint computer for a PII. Instead of entering the PII of the user into an input field, a substitute value for the PII of the user is entered into the input field based at least on a website that served the webpage to the endpoint computer.

A secure web gateway is deployed on the cloud between a web client and a web server. The secure web gateway sends the web client a redirect response status code with a replacement server location in response to a Hypertext Transfer Protocol (HTTP) request sent by the web client to access a target resource on the web server. The secure web gateway thereafter receives from the web client a Hypertext Transfer Protocol Secure (HTTPS) request to access the target resource, the HTTPS request includes the replacement server location. The secure web gateway sends the HTTPS request as an HTTP request to the web server. The secure web gateway receives an HTTP response from the web server, and forwards the HTTP response as an HTTPS response to the web client.

A system for protecting public-facing computing assets of an organization includes a correlation system and security appliances. Public-facing computing assets of the organization are discovered as being accessible from the Internet. The security appliances monitor network traffic between monitored computing assets of the organization and clients on the Internet. The correlation system correlates certificate information of digital certificates of the monitored computing assets with certificate information of digital certificates of the discovered public-facing computing assets to identify an unprotected computing asset.

Similar geographically proximate infrastructures are identified from a received compromised Internet protocol (IP) address of a compromised infrastructure. The geographic location of the compromised infrastructure is determined from the compromised IP address. The geographic locations of other infrastructures are determined from their respective exposed IP addresses. Geographically proximate infrastructures are identified from among the other infrastructures, with the geographically proximate infrastructures having geographic locations that are within a predetermined distance of the geographic location of the compromised infrastructure. Similar geographically proximate infrastructures are identified from among the geographically proximate infrastructures, with the similar geographically proximate infrastructures having a same industrial purpose as the compromised infrastructure.

Behavior report generation monitors the behavior of unknown sample files executing in a sandbox. Behaviors are encoded and feature vectors created based upon a q-gram for each sample. Prototypes extraction includes extracting prototypes from the training set of feature vectors using a clustering algorithm. Once prototypes are identified in this training process, the prototypes with unknown labels are reviewed by domain experts who add a label to each prototype. A K-Nearest Neighbor Graph is used to merge prototypes into fewer prototypes without using a fixed distance threshold and then assigning a malware family name to each remaining prototype. An input unknown sample can be classified using the remaining prototypes and using a fixed distance. For the case that no such prototype is close enough, the behavior report of a sample is rejected and tagged as an unknown sample or that of an emerging malware family.

An enterprise network has endpoints, which are computers with a computer program that needs patches to remove vulnerabilities. A plot of a percentage of vulnerable endpoints over time is generated. Patching cycles and residual phases are identified in the plot. A Residual Vulnerable Percentage (RVP) is determined from the plot, the RVP being an average of percentage of vulnerable endpoints in a residual phase. A Time to Patch Managed (TTPM) is determined from the plot as a time period from a beginning of a patching cycle to a beginning of a residual phase in the patching cycle. A performance indicator that is based on the RVP or the TTPM is compared to a corresponding reference to determine if a corrective action needs to be performed to address deficiencies in the efficiency and/or effectiveness of the patching process.