Patents by Inventor Joel R. Spurlock

Joel R. Spurlock has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Publication number: 20210029150
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to identify a process running on the electronic device, assign a reputation to the process if the process has a known reputation, determine if the process includes executable code, determine a reputation for the executable code, and combine the reputation for the executable code with the reputation assigned to the process to create a new reputation for the process.
    Type: Application
    Filed: September 30, 2020
    Publication date: January 28, 2021
    Applicant: McAfee, LLC
    Inventor: Joel R. Spurlock
  • Publication number: 20210019411
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.
    Type: Application
    Filed: October 6, 2020
    Publication date: January 21, 2021
    Applicant: McAfee, LLC
    Inventors: Craig D. Schmugar, Cedric Cochin, Andrew Furtak, Adam James Carrivick, Yury Bulygin, John J. Loucaides, Oleksander Bazhaniuk, Christiaan Beek, Carl D. Woodward, Ronald Gallella, Gregory Michael Heitzmann, Joel R. Spurlock
  • Publication number: 20210004458
    Abstract: There is disclosed in one example a computing apparatus, including: a processor and a memory; and instructions encoded within the memory to instruct the processor to provide a security agent to: identify a malicious process; construct a genealogical process tree of the malicious process, the genealogical process tree including both vertical direct inheritance and horizontal indirect inheritance relationships; and terminate the malicious process and at least some related processes in the genealogical process tree.
    Type: Application
    Filed: July 5, 2019
    Publication date: January 7, 2021
    Inventors: Jonathan L. Edwards, Saurabh Gautam, Dhananjay Kumar, Joel R. Spurlock
  • Publication number: 20200412744
    Abstract: There is disclosed in one example an advertisement reputation server, including: a hardware platform including a processor and a memory; a network interface; and an advertisement reputation engine including instructions encoded in memory to instruct the processor to: receive via the network interface a plurality of advertisement instances displayed on client devices; extract from the advertisement instances an advertiser identifier; analyze one or more advertisements associated with the advertiser identifier to assign an advertiser reputation; and publish via the network interface advertisement reputation information derived from the reputation for the advertisement identifier.
    Type: Application
    Filed: June 25, 2019
    Publication date: December 31, 2020
    Applicant: McAfee, LLC
    Inventors: Joel R. Spurlock, Nikhil Meshram, Prashanth Palasamudram Ramagopal, Daniel L. Burke
  • Patent number: 10834109
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to identify a process running on the electronic device, assign a reputation to the process if the process has a known reputation, determine if the process includes executable code, determine a reputation for the executable code, and combine the reputation for the executable code with the reputation assigned to the process to create a new reputation for the process.
    Type: Grant
    Filed: December 23, 2014
    Date of Patent: November 10, 2020
    Assignee: McAfee, LLC
    Inventor: Joel R. Spurlock
  • Patent number: 10831893
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.
    Type: Grant
    Filed: July 14, 2016
    Date of Patent: November 10, 2020
    Assignee: McAfee, LLC
    Inventors: Craig D. Schmugar, Cedric Cochin, Andrew Furtak, Adam James Carrivick, Yury Bulygin, John J. Loucaides, Oleksander Bazhaniuk, Christiaan Beek, Carl D. Woodward, Ronald Gallella, Gregory Michael Heitzmann, Joel R. Spurlock
  • Publication number: 20200272733
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to analyze data related to a digital certificate and assign a reputation to the digital certificate, where the reputation includes an indication if the data is proper. The analysis of the data can include determining if code signing for the digital certificate matches binary code for the digital certificate, if the digital certificate has been grafted to the data by modifying a portable executable file header, or the digital certificate is the same as another trusted digital certificate associated with different data.
    Type: Application
    Filed: March 30, 2020
    Publication date: August 27, 2020
    Applicant: McAfee, LLC
    Inventors: Joel R. Spurlock, Ramnath Venugopalan
  • Patent number: 10642976
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to analyze data related to a digital certificate and assign a reputation to the digital certificate, where the reputation includes an indication if the data is proper. The analysis of the data can include determining if code signing for the digital certificate matches binary code for the digital certificate, if the digital certificate has been grafted to the data by modifying a portable executable file header, or the digital certificate is the same as another trusted digital certificate associated with different data.
    Type: Grant
    Filed: June 27, 2015
    Date of Patent: May 5, 2020
    Assignee: McAfee, LLC
    Inventors: Joel R. Spurlock, Ramnath Venugopalan
  • Publication number: 20200117802
    Abstract: Systems, methods, and media for identifying and responding to malicious files having similar features are provided. More particularly, in some embodiments, systems for identifying and responding to malicious files having similar features are provided, the systems comprising: a memory; and a hardware processor coupled to the memory and configured to: receive feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information; create clusters based on the feature information; determine if a file corresponding to one of the clusters is malicious; and report to a plurality of endpoints that other files corresponding to the one of the clusters is malicious.
    Type: Application
    Filed: March 29, 2019
    Publication date: April 16, 2020
    Inventors: Joel R. Spurlock, Leonardo Frittelli
  • Patent number: 10579544
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to receive a request from a process to access data is a system, determine if the data is in a virtualized protected area of memory in the system, and allow access to the data if the data is in the virtualized protected area of memory and the process is a trusted process. The electronic device can also be configured to determine if new data should be protected, store the new data in the virtualized protected area of memory in the system if the new data should be protected, and store the new data in an unprotected area of memory in the system if the new data should not be protected.
    Type: Grant
    Filed: December 12, 2018
    Date of Patent: March 3, 2020
    Assignee: McAfee, LLC
    Inventors: Joel R. Spurlock, Zheng Zhang, Aditya Kapoor, Jonathan L. Edwards, Khai N. Pham
  • Publication number: 20200067960
    Abstract: A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide “content-less” malware detection, i.e., detecting a process as being an ‘anomaly’ not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) ‘trusted’ application behaviors, i.e., the trusted applications' “phenotypes” and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e.
    Type: Application
    Filed: October 31, 2019
    Publication date: February 27, 2020
    Inventors: Cedric Cochin, John D. Teddy, Ofir Arkin, James Bean, Joel R. Spurlock, Carl Woodward
  • Patent number: 10476899
    Abstract: A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide “content-less” malware detection, i.e., detecting a process as being an ‘anomaly’ not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) ‘trusted’ application behaviors, i.e., the trusted applications' “phenotypes” and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e.
    Type: Grant
    Filed: September 25, 2015
    Date of Patent: November 12, 2019
    Assignee: McAfee, LLC
    Inventors: Cedric Cochin, John D. Teddy, Ofir Arkin, James Bean, Joel R. Spurlock, Carl Woodward
  • Publication number: 20190155752
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to receive a request from a process to access data is a system, determine if the data is in a virtualized protected area of memory in the system, and allow access to the data if the data is in the virtualized protected area of memory and the process is a trusted process. The electronic device can also be configured to determine if new data should be protected, store the new data in the virtualized protected area of memory in the system if the new data should be protected, and store the new data in an unprotected area of memory in the system if the new data should not be protected.
    Type: Application
    Filed: December 12, 2018
    Publication date: May 23, 2019
    Applicant: McAfee, LLC
    Inventors: Joel R. Spurlock, Zheng Zhang, Aditya Kapoor, Jonathan L. Edwards, Khai N. Pham
  • Patent number: 10162767
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to receive a request from a process to access data is a system, determine if the data is in a virtualized protected area of memory in the system, and allow access to the data if the data is in the virtualized protected area of memory and the process is a trusted process. The electronic device can also be configured to determine if new data should be protected, store the new data in the virtualized protected area of memory in the system if the new data should be protected, and store the new data in an unprotected area of memory in the system if the new data should not be protected.
    Type: Grant
    Filed: June 27, 2015
    Date of Patent: December 25, 2018
    Assignee: McAfee, LLC
    Inventors: Joel R. Spurlock, Zheng Zhang, Aditya Kapoor, Jonathan L. Edwards, Khai N. Pham
  • Patent number: 10129291
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to monitor activities of objects in a system, compare the monitored activities to metadata for the system, and identify low prevalence outliers to detect potentially malicious activity. The monitored activities can include an analysis of metadata of the objects in the system to identify polymorphic threats, an object reuse analysis of the system to detect an object reusing metadata from another object, and a filename analysis of the system.
    Type: Grant
    Filed: June 27, 2015
    Date of Patent: November 13, 2018
    Assignee: McAfee, LLC
    Inventors: James Bean, Joel R. Spurlock
  • Patent number: 10083295
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to acquire a plurality of reputations related to an object and combine the plurality of reputations to create a total reputation for the object. The object can include a plurality of sub-objects and each of the plurality of reputations can correspond to one of the sub-objects.
    Type: Grant
    Filed: December 23, 2014
    Date of Patent: September 25, 2018
    Assignee: McAfee, LLC
    Inventors: Joel R. Spurlock, John D. Teddy
  • Patent number: 10083296
    Abstract: In an example, there is disclosed a computing apparatus having one or more logic elements providing a security agent operable for: detecting that a first process has launch a second process and placed the second process in a suspended state; detecting that the first process has modified or attempted to modify the second process; classifying the modification as potentially malicious; and taking a remedial action. There is also disclosed one or more computer-readable storage mediums having stored thereon executable instructions for providing the security agent, and a computer-executable method of providing the security agent.
    Type: Grant
    Filed: June 27, 2015
    Date of Patent: September 25, 2018
    Assignee: McAfee, LLC
    Inventors: Aditya Kapoor, Joel R. Spurlock, Jonathan L. Edwards
  • Patent number: 10050980
    Abstract: There is disclosed in an example a computing apparatus configured to operate as an enterprise threat intelligence server, and including: a network interface configured to communicatively couple to a network; and one or more logic elements providing a reputation engine, operable for: receiving a first uniform resource locator (URL) identifier; determining that a first URL identified by the first URL identifier has an unknown enterprise reputation; and establishing a baseline reputation for the URL. There is further disclosed a method of providing the reputation engine, and one or more computer-readable mediums having stored thereon executable instructions for providing the reputation engine.
    Type: Grant
    Filed: June 27, 2015
    Date of Patent: August 14, 2018
    Assignee: McAfee, LLC
    Inventors: James Bean, Joel R. Spurlock, Ramnath Venugopalan
  • Patent number: 10043003
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to acquire a plurality of reputations related to an object and combine the plurality of reputations to create a total reputation for the object. The object can include a plurality of sub-objects and each of the plurality of reputations can correspond to one of the sub-objects.
    Type: Grant
    Filed: December 23, 2014
    Date of Patent: August 7, 2018
    Assignee: McAfee, LLC
    Inventors: Joel R. Spurlock, John D. Teddy
  • Publication number: 20180096260
    Abstract: Disclosed herein are cloud-based machine learning systems and methods for monitoring networked devices to identify and classify characteristics, to infer typical or atypical behavior and assign reputation profiles across various networked devices, and to make remediation recommendations. In some embodiments, a cloud-based machine learning system may learn the typical operation and interfacing of a plurality of reputable devices that are known to be free from malicious software and other threats. In some embodiments, a cloud-based machine learning system may learn the typical operation and interfacing of a device, and may identify atypical operations or interfaces associated with that device by comparing the operations and interfaces to those of a plurality of networked devices or to those of a defined standard reference device.
    Type: Application
    Filed: September 30, 2016
    Publication date: April 5, 2018
    Applicant: McAfee, LLC
    Inventors: Vincent J. Zimmer, Joel R. Spurlock, Ramnath Venugopalan, Ned M. Smith, Igor G. Muttik, Rajesh Poornachandran