Abstract: Methods, apparatus, systems and articles of manufacture are disclosed for generic process chain entity mapping. An example apparatus includes at least one memory, instructions in the apparatus, and processor circuitry to execute the instructions to receive process chain input data, the input data including a system path, identify a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns, extract at least one of (1) metadata information or (2) command line parameter information from the match, and output transformed data based on the at least one of the extracted metadata information or command line parameter information, the transformed data output in a generalized format.

Abstract: Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.

Abstract: Apparatus, systems, and methods to classify malware with explainability are disclosed. An example apparatus includes at least one memory; instructions in the apparatus; and processor circuitry. The example processor circuitry is to execute the instructions to: generate feature vectors from a first input; train a neural network model using a first portion of the feature vectors; add one or more fully connected layers to the trained neural network model to form a hybrid model; validate the hybrid model using a second portion of the feature vectors; and deploy the validated hybrid model as a malware classifier, the malware classifier to provide a malware classification with explainability in response to a second input.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed for generic process chain entity mapping. An example apparatus includes at least one memory, instructions in the apparatus, and processor circuitry to execute the instructions to receive process chain input data, the input data including a system path, identify a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns, extract at least one of (1) metadata information or (2) command line parameter information from the match, and output transformed data based on the at least one of the extracted metadata information or command line parameter information, the transformed data output in a generalized format.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed. In one example, an apparatus includes at least one memory, instructions, and processor circuitry. The processor circuitry at least executes or instantiates the instructions to receive a group of indicators from a campaign attack, then query an indicator database with an indicator from the group of indicators, and then predict an identification of the campaign attack in response to the indicator having a current deterministic indicator and confidence scoring (DISC) score in the indicator database, wherein the DISC score represents at least one of a lethality component, a determinism component, or a confidence component of the indicator.

Abstract: There is disclosed in one example a computing apparatus, including: a processor and a memory; a network interface to communicatively couple to a backup client; a storage to receive backup data from the client, including a plurality of versions and an associated reputation for each version, the associated reputation to indicate a probability that the version is valid; and instructions encoded within the memory to instruct the processor to: receive from the backup client a request to store a new version of the backup data; determine that the client has exceeded a backup threshold; identify a backup version having a lowest reputation for validity; and expunge the backup version having the lowest reputation for validity.

Abstract: Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.

Abstract: Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.

Abstract: There is disclosed in one example a computing apparatus, including: a processor and a memory; a network interface to communicatively couple to a backup client; a storage to receive backup data from the client, including a plurality of versions and an associated reputation for each version, the associated reputation to indicate a probability that the version is valid; and instructions encoded within the memory to instruct the processor to: receive from the backup client a request to store a new version of the backup data; determine that the client has exceeded a backup threshold; identify a backup version having a lowest reputation for validity; and expunge the backup version having the lowest reputation for validity.

Abstract: There is disclosed in one example a computing apparatus, including: an interface to a backup source in a current state; a backup storage having stored thereon a first backup version of a previous state of the source; and a backup engine to: compute a delta between the current state and the previous state; save via the backup storage a second backup version sufficient to reconstruct the current state; and assign the second backup version a reputation relative to one or more previous backup versions.

Abstract: There is disclosed in one example a computing apparatus, including: an interface to a backup source in a current state; a backup storage having stored thereon a first backup version of a previous state of the source; and a backup engine to: compute a delta between the current state and the previous state; save via the backup storage a second backup version sufficient to reconstruct the current state; and assign the second backup version a reputation relative to one or more previous backup versions.

Abstract: Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.

Abstract: A gripper for holding an item formed from a pliable sheet material includes a body, a first contact member located a fixed position relative to the body, a second contact member which is movable into a closed position to fixate the sheet material between the first contact member and the second contact member, a first positioning member and a second positioning member located in a fixed position relative to the body. The second contact member is connected to a support movable along a trajectory to move the second contact member in the open position and in the closed position, the support including a third positioning member attached to the support to move along with the support, where the third positioning member is magnetically engaged by the first positioning member in the open position and by the second positioning member in the closed position.

Abstract: A gripper for holding an item formed from a pliable sheet material includes a body, a first contact member located a fixed position relative to the body, a second contact member which is movable into a closed position to fixate the sheet material between the first contact member and the second contact member, a first positioning member and a second positioning member located in a fixed position relative to the body. The second contact member is connected to a support movable along a trajectory to move the second contact member in the open position and in the closed position, the support including a third positioning member attached to the support to move along with the support, where the third positioning member is magnetically engaged by the first positioning member in the open position and by the second positioning member in the closed position.