Patents by Inventor Alexey M. Romanenko

Alexey M. Romanenko has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Patent number: 11403396
    Abstract: The present disclosure provides a system and method for allocating computer resources for detection of malicious files. In one aspect, the system comprises: a hardware processor configured to: form at least one behavior pattern grouping selected commands with shared parameters, apply a hash function on the at least one of the formed behavior pattern to obtain computed parameters, calculate a degree of harmfulness based on the obtained computed parameters using the hash function and a model for detection of malicious files, wherein the degree of harmfulness is a number value characterizing a probability that a malicious activity will be manifested by a time of computing said degree of harmfulness and wherein the model is a machine learning model trained using computed parameters of previous behavior patterns on which the hash function was applied to output degrees of harmfulness, and allocate the computing resources based on the calculated degree of harmfulness.
    Type: Grant
    Filed: October 5, 2020
    Date of Patent: August 2, 2022
    Assignee: AO Kaspersky Lab
    Inventors: Alexander C. Chistyakov, Ekaterina M. Lobacheva, Alexey M. Romanenko
  • Patent number: 11379581
    Abstract: A method for detection of malicious files includes training a mapping model for mapping files in a probability space. A plurality of characteristics of an analyzed file is determined based on a set of rules. A mapping of the analyzed file in probability space is generated based on the determined plurality of characteristics. A first database is searched using the generated mapping of the analyzed file to determine whether the analyzed file is associated with a family of malicious files. The first database stores mappings associated with one or more families of malicious files. In response to determining that the analyzed file is associated with the family of malicious files, a selection of one or more methods of malware detection is made from a second database. The second database stores a plurality of malware detection methods. The selected method is used to detect the associated family.
    Type: Grant
    Filed: March 11, 2020
    Date of Patent: July 5, 2022
    Assignee: AO Kaspersky Lab
    Inventors: Alexander Chistyakov, Alexey M. Romanenko
  • Patent number: 11366896
    Abstract: A system and method is provided for detecting anomalous events based on a dump of an address space of a software process in a memory of a computing device. An exemplary method includes detecting at least one event occurring in an operating system of the computing device during an execution of the software process, determining a context of the detected event, wherein the context comprises a dump of an address space of the software process containing code that was being executed at the moment of occurrence of the detected event, selecting a set of features of the dump for use in determining whether or not the event is anomalous, transforming the selected set of features of the dump into a convolution, determining a popularity of the convolution by polling a database, and determining that the detected event is an anomalous event if the determined popularity is below a threshold value.
    Type: Grant
    Filed: December 17, 2019
    Date of Patent: June 21, 2022
    Assignee: AO KASPERSKY LAB
    Inventors: Alexey V. Monastyrsky, Mikhail A. Pavlyushchik, Alexey M. Romanenko, Maxim Y. Golovkin
  • Publication number: 20220171880
    Abstract: A method for detecting a false positive outcome in classification of files includes, analyzing a file to determine whether or not the file is to be recognized as being malicious, analyzing a file to determine whether a digital signature certificate is present for the file, in response to recognizing the file as being malicious; comparing the digital certificate of the file with one or more digital certificates stored in a database of trusted files, in response to determining that the digital signature certificate is present for the file; and detecting a false positive outcome if the digital certificate of the file is found in the database of trusted files, when the false positive outcome is detected, excluding the file from further determination of whether the file is malicious and calculating a flexible hash value of the file.
    Type: Application
    Filed: February 15, 2022
    Publication date: June 2, 2022
    Inventors: Sergey V. Prokudin, Alexander S. Chistyakov, Alexey M. Romanenko
  • Patent number: 11288401
    Abstract: Disclosed herein are systems and methods for reducing a number of false positives in classification of files. In one aspect, an exemplary method comprises, analyzing a file to determine whether or not the file is to be recognized as being malicious, when the file is recognized as being malicious, analyzing the file to detect a false positive outcome, when the false positive outcome is detected, excluding the file from being scanned and calculating a flexible hash of the file, and storing the calculated flexible hash in a database of exceptions.
    Type: Grant
    Filed: September 11, 2019
    Date of Patent: March 29, 2022
    Assignee: AO Kaspersky Lab
    Inventors: Sergey V. Prokudin, Alexander S. Chistyakov, Alexey M. Romanenko
  • Publication number: 20220043910
    Abstract: Disclosed herein are methods and systems for selecting a detection model for detection of a malicious file. An exemplary method includes: monitoring a file during execution of the file within a computer system by intercepting commands of the file being executed and determining one or more parameters of the intercepted commands. A behavior log of the file being executed containing behavioral data is formed based on the intercepted commands and based on the one or more parameters of the intercepted commands. The behavior log is analyzed to form a feature vector. The feature vector characterizes the behavioral data. One or more detection models are selected from a database of detection models based on the feature vector. Each of the one or more detection models includes a decision-making rule for determining a degree of maliciousness of the file being executed.
    Type: Application
    Filed: October 12, 2021
    Publication date: February 10, 2022
    Inventors: Alexander S. Chistyakov, Alexey M. Romanenko, Alexander S. Shevelev
  • Patent number: 11227048
    Abstract: Disclosed herein are methods and systems for detecting malicious files. An exemplary method comprises emulating execution of a file under analysis, forming a behavior log of the emulated execution of the file under analysis, forming one or more behavior patterns from commands and parameters selected from the behavior log, calculating a convolution of the one or more behavior patterns, selecting two or more models for detecting malicious files from a database, calculating a degree of maliciousness of the file being executed based using the convolution and the two or more models, forming a decision making template based on the degree of maliciousness and determining that the file is malicious when a degree of similarity between the decision making template and a predetermined decision making template exceeds a predetermined threshold value.
    Type: Grant
    Filed: May 17, 2019
    Date of Patent: January 18, 2022
    Assignee: AO Kaspersky Lab
    Inventors: Alexander S. Chistyakov, Alexey M. Romanenko, Alexander S. Shevelev
  • Patent number: 11216555
    Abstract: A system and method is provided for providing a set of convolutions to a computing device for detecting anomalous events occurring in an operating system of the computing device. An exemplary method includes launching an agent in an operating system of a client device, registering, by the agent, events occurring in the operating system, for each registered event, determining a context of the event, wherein the context comprises a call stack at a moment of occurrence of the event, selecting a set of features based on the call stack of the event, generating a convolution based on the selected set of features of the event and the context of the event, and adding the generated convolution to a set of convolutions of events occurring on client devices, and providing, to a client device from which a request is received, the set of convolutions of events occurring on client devices.
    Type: Grant
    Filed: December 3, 2019
    Date of Patent: January 4, 2022
    Assignee: AO Kaspersky Lab
    Inventors: Alexey V. Monastyrsky, Mikhail A. Pavlyushchik, Alexey M. Romanenko, Maxim Y. Golovkin
  • Patent number: 11188649
    Abstract: Methods and systems are described in the present disclosure for classifying malicious objects. In an exemplary aspect, a method includes: collecting data describing a state of an object of the computer system, forming a vector of features, calculating a degree of similarity based on the vector, calculating a limit degree of difference that is a numerical value characterizing the probability that the object being classified will certainly belong to another class, forming a criterion for determination of class of the object based on the degree of similarity and the limit degree of difference, determining that the object belongs to the determined class when the data satisfies the criterion, wherein the data is collected over a period of time defined by a data collection rule and pronouncing the object as malicious when it is determined that the object belongs to the specified class.
    Type: Grant
    Filed: June 26, 2019
    Date of Patent: November 30, 2021
    Assignee: AO Kaspersky Lab
    Inventors: Alexander S. Chistyakov, Alexey M. Romanenko, Alexander S. Shevelev
  • Patent number: 11176250
    Abstract: Disclosed herein are methods and systems for detecting malicious files. An exemplary method comprises: forming a feature vector based on behavioral data of execution of a file, calculating parameters based on the feature vector using a trained model for calculation of parameters, wherein the parameters comprise: i) a degree of maliciousness that is a probability that the file may be malicious, and ii) a limit degree of safety that is a probability that the file will definitely prove to be malicious, wherein an aggregate of consecutively calculated degrees is described by a predetermined time law, deciding that the file is malicious when the degree of maliciousness and the limit degree of safety satisfy a predetermined criterion, wherein that criterion is a rule for the classification of the file according to an established correlation between the degree of maliciousness and the limit degree of safety.
    Type: Grant
    Filed: May 17, 2019
    Date of Patent: November 16, 2021
    Assignee: AO KASPERSKY LAB
    Inventors: Alexander S. Chistyakov, Alexey M. Romanenko, Alexander S. Shevelev
  • Patent number: 11036858
    Abstract: Methods and systems are described in the present disclosure for training a model for detecting malicious objects on a computer system. In an exemplary aspect, a method includes: selecting files from a database used for training a detection model, the selection is performed based on learning rules, performing an analysis on the files by classifying them in a hierarchy of maliciousness, forming behavior patterns based on execution of the files and parameters of the execution, training the detection model according to the analysis of the files and the behavior patterns, verifying the trained detection model using a test selection of files to test determinations of harmfulness of the test selection of files, and when the verification fails, retraining the detection model using a different set of files from the database, otherwise applying the detection model to a new set of files to determine maliciousness.
    Type: Grant
    Filed: July 2, 2019
    Date of Patent: June 15, 2021
    Assignee: AO Kaspersky Lab
    Inventors: Alexander S. Chistyakov, Alexey M. Romanenko, Alexander S. Shevelev
  • Publication number: 20210150030
    Abstract: Disclosed herein are systems and methods for determining a coefficient of harmfulness of a file using a trained learning model. In one aspect, an exemplary method includes forming a first vector containing a plurality of attributes of a known malicious file. A learning model is trained using the first vector to identify a plurality of significant attributes that influence identification of the malicious file. A second vector is formed containing a plurality of attributes of known safe files. The learning model is trained using the second vector to identify attributes insignificant to the identification of the malicious file. An unknown file is analyzed by the learning model. The learning model outputs a numerical value identifying a coefficient of harmfulness relating to a probability that the unknown file will prove to be harmful.
    Type: Application
    Filed: January 26, 2021
    Publication date: May 20, 2021
    Inventors: Sergey V Prokudin, Alexey M. Romanenko
  • Publication number: 20210152592
    Abstract: Disclosed are systems and methods for countering a cyber-attack on computing devices by means of which users are interacting with services, which store personal data on the users. Data is collected about the services with which the users are interacting by means of the devices, as well as data about the devices themselves. The collected data is analyzed to detect when a cyber-attack on the devices is occurring as a result of a data breach of personal data on users from the online service. A cluster of the computing devices of different users of the online service experiencing the same cyber attack is identified. Attack vectors are identified based on the characteristics of the cyber attack experienced by the computing devices in the cluster. Actions are selected for countering the cyber-attack based on the identified attack vector and are sent to the devices of all users of the corresponding cluster.
    Type: Application
    Filed: December 22, 2020
    Publication date: May 20, 2021
    Inventors: Vladislav V. MARTYNENKO, Alexey M. ROMANENKO
  • Publication number: 20210097177
    Abstract: A method for detection of malicious files includes training a mapping model for mapping files in a probability space. A plurality of characteristics of an analyzed file is determined based on a set of rules. A mapping of the analyzed file in probability space is generated based on the determined plurality of characteristics. A first database is searched using the generated mapping of the analyzed file to determine whether the analyzed file is associated with a family of malicious files. The first database stores mappings associated with one or more families of malicious files. In response to determining that the analyzed file is associated with the family of malicious files, a selection of one or more methods of malware detection is made from a second database. The second database stores a plurality of malware detection methods. The selected method is used to detect the associated family.
    Type: Application
    Filed: March 11, 2020
    Publication date: April 1, 2021
    Inventors: Alexander Chistyakov, Alexey M. Romanenko
  • Publication number: 20210073418
    Abstract: Disclosed herein are systems and methods for reducing a number of false positives in classification of files. In one aspect, an exemplary method comprises, analyzing a file to determine whether or not the file is to be recognized as being malicious, when the file is recognized as being malicious, analyzing the file to detect a false positive outcome, when the false positive outcome is detected, excluding the file from being scanned and calculating a flexible hash of the file, and storing the calculated flexible hash in a database of exceptions.
    Type: Application
    Filed: September 11, 2019
    Publication date: March 11, 2021
    Inventors: Sergey V. Prokudin, Alexander S. Chistyakov, Alexey M. Romanenko
  • Patent number: 10929533
    Abstract: Disclosed herein are systems and methods of identifying malicious files using a learning model trained on a malicious file. In one aspect, an exemplary method comprises selecting, using a hardware processor, the malicious file from a plurality of malicious files that are known to be harmful, selecting, using the hardware processor, a plurality of safe files from a set of safe files that are known to be safe, generating, using the hardware processor, a learning model by training a neural network with the malicious file and the plurality of safe files, generating, using the hardware processor, rules for detection of malicious files from the learning model, determining, using the hardware processor, whether attributes of an unknown file fulfill the rules for detection of malicious files using the learning model and responsive to determining that the rules for detection are fulfilled, identifying, using the hardware processor, the unknown file as malicious.
    Type: Grant
    Filed: November 9, 2018
    Date of Patent: February 23, 2021
    Assignee: AO Kaspersky Lab
    Inventors: Sergey V. Prokudin, Alexey M. Romanenko
  • Patent number: 10929534
    Abstract: Disclosed are systems and methods for detection of malicious files using machine learning. An example method comprises: selecting one or more data blocks in an object being analyzed based on rules; performing a static analysis on the one or more data blocks to determine a set of features of the one or more data blocks; determining a degree of harmfulness of the object based on the set of features and a model for detection of malicious objects, wherein the model has been trained by a method for machine learning on at least one safe object and one malicious object; recognizing the object is safe when the degree of harmfulness does not exceed a predetermined threshold of harmfulness; and recognizing the object is malicious when the degree of harmfulness of the one or more data blocks exceeds the predetermined threshold of harmfulness.
    Type: Grant
    Filed: June 14, 2018
    Date of Patent: February 23, 2021
    Assignee: AO KASPERSKY LAB
    Inventors: Alexander S. Chistyakov, Ekaterina M. Lobacheva, Alexey M. Romanenko
  • Patent number: 10922410
    Abstract: Disclosed are systems and methods generating a convolution function for training a malware detection model. An example method comprises selecting, by a processor, one or more commands from a log according to a set of predetermined rules, forming, by the processor, one or more behavior patterns from the one or more selected commands, determining, by the processor, a feature vector according to the one or more behavior patterns, generating, by the processor, a convolution function according to the feature vector, wherein a size of a result of the convolution function of the feature vector is less than the size of the feature vector, and computing, by the processor, one or more parameters for training a malware detection model using the convolution function on the one or more behavior patterns.
    Type: Grant
    Filed: June 15, 2018
    Date of Patent: February 16, 2021
    Assignee: AO KASPERSKY LAB
    Inventors: Alexander S. Chistyakov, Ekaterina M. Lobacheva, Alexey M. Romanenko
  • Patent number: 10904283
    Abstract: Systems and methods for countering a cyber attack on computing devices used by users gather data about services with which users are interacting, as well as data about devices used by users for such interactions. The collected data is analyzed to detect when a cyber-attack on the devices is occurring as a result of a data breach of personal data on users from at least one service. Actions are selected for countering the cyber-attack and are sent to the devices of all users of the corresponding cluster in the event that a match is found in the characteristics of the attack vector for at least one device of another user whose devices belong to the corresponding cluster.
    Type: Grant
    Filed: June 19, 2018
    Date of Patent: January 26, 2021
    Assignee: AO Kaspersky Lab
    Inventors: Vladislav V. Martynenko, Alexey M. Romanenko
  • Publication number: 20210019406
    Abstract: The present disclosure provides a system and method for allocating computer resources for detection of malicious files. In one aspect, the system comprises: a hardware processor configured to: form at least one behavior pattern grouping selected commands with shared parameters, apply a hash function on the at least one of the formed behavior pattern to obtain computed parameters, calculate a degree of harmfulness based on the obtained computed parameters using the hash function and a model for detection of malicious files, wherein the degree of harmfulness is a number value characterizing a probability that a malicious activity will be manifested by a time of computing said degree of harmfulness and wherein the model is a machine learning model trained using computed parameters of previous behavior patterns on which the hash function was applied to output degrees of harmfulness, and allocate the computing resources based on the calculated degree of harmfulness.
    Type: Application
    Filed: October 5, 2020
    Publication date: January 21, 2021
    Inventors: Alexander C. Chistyakov, Ekaterina M. Lobacheva, Alexey M. Romanenko