Abstract: A system and a method for analyzing files using visual cues in the presentation of the file is provided. These visual aids may be extracted using a convolutional neural network, classified, and used in conjunction with file metadata to determine if a provided document is likely to be malicious. This methodology may be extended to detect a variety of social engineering-related attacks including phishing sites or malicious emails. A method for analyzing a received file to determine if the received file comprises malicious code begins with generating an image that would be displayed if the received file is opened by the native software program. Then the image is analyzed, and output is generated. Metadata is also extracted from the received file. Then, a maliciousness score is generated based on the output, the metadata, and a reference dataset.
Abstract: A remote sensing system comprising localized sensors and monitoring by one or more servers is described. The sensors capture data from computers and the network, provide that information to the one or more servers, and the one or more servers identify trends and anomalies in the information collected. The one or more servers provide information regarding the trends and anomalies to the computers. Optionally, the one or more servers can push changes to the sensors, such as updates to software code.
Type:
Application
Filed:
February 21, 2014
Publication date:
August 27, 2015
Applicant:
Endgame Systems, Inc.
Inventors:
Nils D. Puhlmann, John Herren, Earle W. Ady, Michael Kelly Whalen, Justin Trent Altman, David M. Nichols, Robert Geoffrey Meyers, Anderson Osagie, Sudhanshu Sethi