Patents by Inventor Kangkook Jee
Kangkook Jee has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Patent number: 11423142Abstract: A method for implementing confidential machine learning with program compartmentalization includes implementing a development stage to design an ML program, including annotating source code of the ML program to generate an ML program annotation, performing program analysis based on the development stage, including compiling the source code of the ML program based on the ML program annotation, inserting binary code based on the program analysis, including inserting run-time code into a confidential part of the ML program and a non-confidential part of the ML program, and generating an ML model by executing the ML program with the inserted binary code to protect the confidentiality of the ML model and the ML program from attack.Type: GrantFiled: November 25, 2019Date of Patent: August 23, 2022Inventors: Chung Hwan Kim, Junghwan Rhee, Kangkook Jee, Zhichun Li
-
Patent number: 11295008Abstract: Systems and methods for implementing a system architecture to support a trusted execution environment (TEE) with computational acceleration are provided. The method includes establishing a first trusted channel between a user application stored on an enclave and a graphics processing unit (GPU) driver loaded on a hypervisor. Establishing the first trusted channel includes leveraging page permissions in an extended page table (EPT) to isolate the first trusted channel between the enclave and the GPU driver in a physical memory of an operating system (OS). The method further includes establishing a second trusted channel between the GPU driver and a GPU device. The method also includes launching a unified TEE that includes the enclave and the hypervisor with execution of application code of the user application.Type: GrantFiled: February 11, 2020Date of Patent: April 5, 2022Inventors: Chung Hwan Kim, Junghwan Rhee, Kangkook Jee, Zhichun Li, Adil Ahmad, Haifeng Chen
-
Patent number: 11275832Abstract: Methods and systems for security monitoring and response include assigning an anomaly score to each of a plurality of event paths that are stored in a first memory. Events that are cold, events that are older than a threshold, and events that are not part of a top-k anomalous path are identified. The identified events are evicted from the first memory to a second memory. A threat associated with events in the first memory is identified. A security action is performed responsive to the identified threat.Type: GrantFiled: February 4, 2020Date of Patent: March 15, 2022Inventors: Ding Li, Kangkook Jee, Zhichun Li, Zhengzhang Chen, Xiao Yu
-
Patent number: 11223649Abstract: A method for ransomware detection and prevention includes receiving an event stream associated with one or more computer system events, generating user-added-value knowledge data for one or more digital assets by modeling digital asset interactions based on the event stream, including accumulating user-added-values of each of the one or more digital assets, and detecting ransomware behavior based at least in part on the user-added-value knowledge, including analyzing destruction of the user-added values for the one or more digital assets.Type: GrantFiled: April 9, 2019Date of Patent: January 11, 2022Inventors: Zhenyu Wu, Yue Li, Junghwan Rhee, Kangkook Jee, Zichun Li, Jumpei Kamimura, LuAn Tang, Zhengzhang Chen
-
Patent number: 11194906Abstract: A method for implementing automated threat alert triage via data provenance includes receiving a set of alerts and security provenance data, separating true alert events within the set of alert events corresponding to malicious activity from false alert events within the set of alert events corresponding to benign activity based on an alert anomaly score assigned to the at least one alert event, and automatically generating a set of triaged alert events based on the separation.Type: GrantFiled: July 10, 2019Date of Patent: December 7, 2021Inventors: Ding Li, Kangkook Jee, Zhengzhang Chen, Zhichun Li, Wajih Ul Hassan
-
Patent number: 11030308Abstract: A method and system are provided for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system. The method includes receiving, by a processor operatively coupled to a memory, a Tracking Description Language (TDL) query including general constraints, a tracking declaration and an output specification, parsing, by the processor, the TDL query using a language parser, executing, by the processor, a tracking analysis based on the parsed TDL query, generating, by the processor, a tracking graph by cleaning a result of the tracking analysis, and outputting, by the processor and via an interface, query results based on the tracking graph.Type: GrantFiled: June 12, 2018Date of Patent: June 8, 2021Inventors: Ding Li, Kangkook Jee, Zhengzhang Chen, LuAn Tang, Zhichun Li
-
Patent number: 11030157Abstract: Systems and methods for mining and compressing commercial data including a network of point of sale devices to log commercial activity data including independent commercial events and corresponding dependent features. A middleware system is in communication with the network of point of sale devices to continuously collect and compress a stream of the commercial activity data and concurrently store the compressed commercial activity data. Compressing the stream includes a file access table corresponding to the commercial activity data, producing compressible file access templates (CFATs) according to frequent patterns of commercial activity data using the file access table, and replacing dependent feature sequences with a matching compressible file access template. A database is in communication with the middleware system to store the compressed commercial data.Type: GrantFiled: May 15, 2018Date of Patent: June 8, 2021Inventors: Ding Li, Kangkook Jee, Zhichun Li, Mu Zhang, Zhenyu Wu
-
Patent number: 10931635Abstract: Systems and methods for an automotive security gateway include an in-gateway security system that monitors local host behaviors in vehicle devices to identify anomalous local host behaviors using a blueprint model trained to recognize secure local host behaviors. An out-of-gateway security system monitors network traffic across remote hosts, local devices, hotspot network, and in-car network to identify anomalous behaviors using deep packet inspection to inspect packets of the network. A threat mitigation system issues threat mitigation instructions corresponding to the identified anomalous local host behaviors and the anomalous remote host behaviors to secure the vehicle devices by removing the identified anomalous local host behaviors and the anomalous remote host behaviors. Automotive security gateway services and vehicle electronic control units operate the vehicle devices according to the threat mitigation instructions.Type: GrantFiled: September 28, 2018Date of Patent: February 23, 2021Inventors: Junghwan Rhee, Hongyu Li, Shuai Hao, Chung Hwan Kim, Zhenyu Wu, Zhichun Li, Kangkook Jee, Lauri Korts-Parn
-
Patent number: 10929539Abstract: Systems and methods are disclosed for enhancing cybersecurity in a computer system by detecting safeness levels of executables. An installation lineage of an executable is identified in which entities forming the installation lineage include at least an installer of the monitored executable, and a network address from which the executable is retrieved. Each entity of the entities forming the installation lineage is individually analyzed using at least one safeness analysis. Results of the at least one safeness analysis of each entity are inherited by other entities in the lineage of the executable. A backtrace result for the executable is determined based on the inherited safeness evaluation of the executable. A total safeness of the executable, based on at least the backtrace result, is evaluated against a set of thresholds to detect a safeness level of the executable. The safeness level of the executable is output on a display screen.Type: GrantFiled: July 19, 2018Date of Patent: February 23, 2021Inventors: Jungwhan Rhee, Zhenyu Wu, Lauri Korts-Parn, Kangkook Jee, Zhichun Li, Omid Setayeshfar
-
Patent number: 10853487Abstract: Systems and methods are disclosed for securing an enterprise environment by detecting suspicious software. A global program lineage graph is constructed. Construction of the global program lineage graph includes creating a node for each version of a program having been installed on a set of user machines. Additionally, at least two nodes are linked with a directional edge. For each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed is determined; and the prevalence number is recorded to the metadata associated with the respective node. Anomalous behavior is identified based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph. An alarm is displayed on a graphical user interface for each suspicious software based on the identified anomalous behavior.Type: GrantFiled: July 19, 2018Date of Patent: December 1, 2020Inventors: Junghwan Rhee, Zhenyu Wu, Lauri Korts-Parn, Kangkook Jee, Zhichun Li, Omid Setayeshfar
-
Publication number: 20200257794Abstract: Systems and methods for implementing a system architecture to support a trusted execution environment (TEE) with computational acceleration are provided. The method includes establishing a first trusted channel between a user application stored on an enclave and a graphics processing unit (GPU) driver loaded on a hypervisor. Establishing the first trusted channel includes leveraging page permissions in an extended page table (EPT) to isolate the first trusted channel between the enclave and the GPU driver in a physical memory of an operating system (OS). The method further includes establishing a second trusted channel between the GPU driver and a GPU device. The method also includes launching a unified TEE that includes the enclave and the hypervisor with execution of application code of the user application.Type: ApplicationFiled: February 11, 2020Publication date: August 13, 2020Inventors: Chung Hwan Kim, Junghwan Rhee, Kangkook Jee, Zhichun Li, Adil Ahmad, Haifeng Chen
-
Publication number: 20200250308Abstract: Methods and systems for security monitoring and response include assigning an anomaly score to each of a plurality of event paths that are stored in a first memory. Events that are cold, events that are older than a threshold, and events that are not part of a top-k anomalous path are identified. The identified events are evicted from the first memory to a second memory. A threat associated with events in the first memory is identified. A security action is performed responsive to the identified threat.Type: ApplicationFiled: February 4, 2020Publication date: August 6, 2020Inventors: Ding Li, Kangkook Jee, Zhichun Li, Zhengzhang Chen, Xiao Yu
-
Patent number: 10733149Abstract: Systems and methods for data reduction including organizing data of an event stream into a file access table concurrently with receiving the event stream, the data including independent features and dependent features. A frequent pattern tree (FP-Tree) is built including nodes corresponding to the dependent features according to a frequency of occurrence of the dependent features relative to the independent features. Each single path in the FP-Tree is merged into a special node corresponding to segments of dependent features to produce a reduced FP-Tree. All path combinations in the reduced FP-Tree are identified. A compressible file access template (CFAT) is generated corresponding to each of the path combinations. The data of the event stream is compressed with the CFATs to reduce the dependent features to special events representing the dependent features.Type: GrantFiled: May 15, 2018Date of Patent: August 4, 2020Assignee: NEC CorporationInventors: Ding Li, Kangkook Jee, Zhichun Li, Mu Zhang, Zhenyu Wu
-
Publication number: 20200184070Abstract: A method for implementing confidential machine learning with program compartmentalization includes implementing a development stage to design an ML program, including annotating source code of the ML program to generate an ML program annotation, performing program analysis based on the development stage, including compiling the source code of the ML program based on the ML program annotation, inserting binary code based on the program analysis, including inserting run-time code into a confidential part of the ML program and a non-confidential part of the ML program, and generating an ML model by executing the ML program with the inserted binary code to protect the confidentiality of the ML model and the ML program from attack.Type: ApplicationFiled: November 25, 2019Publication date: June 11, 2020Inventors: Chung Hwan Kim, Junghwan Rhee, Kangkook Jee, Zhichun Li
-
Patent number: 10574674Abstract: A system and computer-implemented method are provided for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts. The system includes a set of DNS resolver agents configured to (i) gather DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries, and (ii) associate the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries. The system further includes a backend server configured to detect one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs.Type: GrantFiled: July 7, 2017Date of Patent: February 25, 2020Assignee: NEC CorporationInventors: Kangkook Jee, Zhichun Li, Guofei Jiang, Lauri Korts-Parn, Zhenyu Wu, Yixin Sun, Junghwan Rhee
-
Patent number: 10572661Abstract: Methods and systems for security analysis include determining whether a process has an origin internal to a system or external to the system using a processor based on monitored behavior events associated with the process. A security analysis is performed on only processes that have an external origin to determine if any of the processes having an external origin represent a security threat. A security action is performed if a process having an external origin is determined to represent a security threat.Type: GrantFiled: July 18, 2017Date of Patent: February 25, 2020Assignee: NEC CorporationInventors: Zhenyu Wu, Jungwhan Rhee, Yuseok Jeon, Zhichun Li, Kangkook Jee, Guofei Jiang
-
Publication number: 20200042700Abstract: A method for implementing automated threat alert triage via data provenance includes receiving a set of alerts and security provenance data, separating true alert events within the set of alert events corresponding to malicious activity from false alert events within the set of alert events corresponding to benign activity based on an alert anomaly score assigned to the at least one alert event, and automatically generating a set of triaged alert events based on the separation.Type: ApplicationFiled: July 10, 2019Publication date: February 6, 2020Inventors: Ding Li, Kangkook Jee, Zhengzhang Chen, Zhichun Li, Wajih Ul Hassan
-
Patent number: 10505962Abstract: A computer-implemented method for performing privilege flow analysis is presented. The computer-implemented method includes monitoring at least one program operating system (OS) event handled by a program, generating a privilege flow graph, determining an inferred program behavior context, and generating, based on a combination of the privilege flow graph and the inferred program behavior context, an inferred behavior context-aware privilege flow graph to distinguish different roles of processes and/or threads within the program.Type: GrantFiled: June 15, 2017Date of Patent: December 10, 2019Assignee: NEC CorporationInventors: Junghwan Rhee, Yuseok Jeon, Zhichun Li, Kangkook Jee, Zhenyu Wu, Guofei Jiang
-
Publication number: 20190342330Abstract: A method for ransomware detection and prevention includes receiving an event stream associated with one or more computer system events, generating user-added-value knowledge data for one or more digital assets by modeling digital asset interactions based on the event stream, including accumulating user-added-values of each of the one or more digital assets, and detecting ransomware behavior based at least in part on the user-added-value knowledge, including analyzing destruction of the user-added values for the one or more digital assets.Type: ApplicationFiled: April 9, 2019Publication date: November 7, 2019Inventors: Zhenyu Wu, Yue Li, Junghwan Rhee, Kangkook Jee, Zichun Li, Jumpei Kamimura, LuAn Tang, Zhengzhang Chen
-
Patent number: 10402564Abstract: A computer-implemented method for analyzing operations of privilege changes is presented. The computer-implemented method includes inputting a program and performing source code analysis on the program by generating a privilege control flow graph (PCFG), generating a privilege data flow graph (PDFG), and generating a privilege call context graph (PCCG). The computer-implemented method further includes, based on the source code analysis results, instrumenting the program to perform inspections on execution states at privilege change operations, and performing runtime inspection and anomaly prevention.Type: GrantFiled: June 15, 2017Date of Patent: September 3, 2019Assignee: NEC CorporationInventors: Junghwan Rhee, Yuseok Jeon, Zhichun Li, Kangkook Jee, Zhenyu Wu, Guofei Jiang