Abstract: An anonymous information sharing service is described herein. The anonymous information sharing service includes performing anonymous authentication of a user who would like to report an incident, anonymizing incident data, and sharing the incident data with multiple users of the anonymous information sharing service.

Abstract: Methods, system, and media for determining similar malware samples are disclosed. Two or more malware samples are received and analyzed to extract information from the two or more malware samples. The extracted information is converted to a plurality of sets of strings. A similarity between the two or more malware samples is determined based on the plurality of the sets of strings.

Abstract: Methods, system, and media for detecting malware are disclosed. A network may be monitored for a configured time interval collecting all of or some of the network traffic or samples of the network traffic. Feature vectors may be extracted from the network traffic resulting in feature vectors. One or more machine learning models may be applied to the feature vectors producing a score. The score may indicate the presence of malware or the presence of a particular type of malware. One or more scores obtained by applying learning models may be fused by another machine learning model into a resulting score. A threshold value may be calculated to accompany a score indicating the likelihood that the traffic sample indicates the presence of malware and the likely effectiveness of planned remediation effort. An alert may be generated from the score and the threshold when the threshold is exceeded.

Abstract: Methods, system, and media for determining similar malware samples are disclosed. Two or more malware samples are received and analyzed to extract information from the two or more malware samples. The extracted information is converted to a plurality of sets of strings. A similarity between the two or more malware samples is determined based on the plurality of the sets of strings.

Abstract: An anonymous information sharing service is described herein. The anonymous information sharing service includes performing anonymous authentication of a user who would like to report an incident, anonymizing incident data, and sharing the incident data with multiple users of the anonymous information sharing service.

Abstract: Methods, system, and media for detecting malware are disclosed. A network may be monitored to collect samples of the network traffic. Feature vectors may be extracted from the sampled network traffic. One or more machine learning models may be applied to the feature vectors to produce a score indicative of the presence of a particular type of malware. One or more scores obtained by applying the machine learning models may be fused by another machine learning model into a resulting score. A threshold value may be calculated to accompany a score indicating the likelihood that the traffic sample indicates the presence of malware and the likely effectiveness of planned remediation effort. An alert may be generated from the score and the threshold when the threshold is acceded.

Abstract: Methods, system, and media for determining similar malware samples are disclosed. Two or more malware samples are received and analyzed to extract information from the two or more malware samples. The extracted information is converted to a plurality of sets of strings. A similarity between the two or more malware samples is determined based on the plurality of the sets of strings.

Abstract: An anonymous information sharing service is described herein. The anonymous information sharing service includes performing anonymous authentication of a user who would like to report an incident, anonymizing incident data, and sharing the incident data with multiple users of the anonymous information sharing service.

Abstract: Methods, system, and media for detecting malware are disclosed. A network may be monitored for a configured time interval collecting all of or some of the network traffic or samples of the network traffic. Feature vectors may be extracted from the network traffic resulting in feature vectors. One or more machine learning models may be applied to the feature vectors producing a score. The score may indicate the presence of malware or the presence of a particular type of malware. One or more scores obtained by applying learning models may be fused by another machine learning model into a resulting score. A threshold value may be calculated to accompany a score indicating the likelihood that the traffic sample indicates the presence of malware and the likely effectiveness of planned remediation effort. An alert may be generated from the score and the threshold when the threshold is acceded. The alert may be presented to a user based on an indication by the user as to the type of malware of interest.