Abstract: Systems and methods are provided to detect ransomware and ransomware-like behavior.

Abstract: Systems and methods are provided to measure the similarity between a first and second data sample. The method can include creating a plurality of k-mers from the first data sample, each k-mer having a first length; generating a first vector from the plurality of k-mers by processing the plurality of k-mers with a plurality of hash functions; calculating a similarity level between the first and second data sample by comparing the first vector to a second vector, the second vector representing the second data sample; and based on the similarity level, determining a maliciousness level of the first data sample.

Abstract: Systems and methods are provided to measure the similarity between a first and second data sample. The method can include creating a plurality of k-mers from the first data sample, each k-mer having a first length; generating a first vector from the plurality of k-mers by processing the plurality of k-mers with a plurality of hash functions; calculating a similarity level between the first and second data sample by comparing the first vector to a second vector, the second vector representing the second data sample; and based on the similarity level, determining a maliciousness level of the first data sample.

Abstract: Systems and methods are provided to measure the similarity between a first and second data sample. The method can include creating a plurality of k-mers from the first data sample, each k-mer having a first length; generating a first vector from the plurality of k-mers by processing the plurality of k-mers with a plurality of hash functions; calculating a similarity level between the first and second data sample by comparing the first vector to a second vector, the second vector representing the second data sample; and based on the similarity level, determining a maliciousness level of the first data sample.

Abstract: A method, computer program product, system and apparatus for the prevention of RGA and DGA malware over an existing internet service is disclosed. The invention exploits the fact that when malware rapidly attempts to access many contact points, a malware is likely to need several attempts to find a current server. Software is installed on the individual endpoints in a network of internet services. The software monitors the websites or services and collects information about access attempts. The invention detects a series of failed attempts by the malware to access the service/website. These attempts can be accrued by being temporally linked (e.g., many attempts in a short time, many attempts consecutively), conceptually linked (e.g., similar addresses, similar attempts across multiple machines or time scales), higher than normal prevalence or other methods. The invention provides an indication of a malware attempt if enough failed attempts have accrued.

Abstract: A method, computer program product, system and apparatus for the prevention of RGA and DGA malware over an existing internet service is disclosed. The invention exploits the fact that when malware rapidly attempts to access many contact points, a malware is likely to need several attempts to find a current server. Software is installed on the individual endpoints in a network of internet services. The software monitors the websites or services and collects information about access attempts. The invention detects a series of failed attempts by the malware to access the service/website. These attempts can be accrued by being temporally linked (e.g., many attempts in a short time, many attempts consecutively), conceptually linked (e.g., similar addresses, similar attempts across multiple machines or time scales), higher than normal prevalence or other methods. The invention provides an indication of a malware attempt if enough failed attempts have accrued.

Abstract: The present invention is directed towards systems and methods for predicting one or more desired properties of external nodes or properties of their relations with internal nodes, based on a selected group of nodes about which it is known whether the nodes have the desired properties, or it is known whether they have a desired relation property with an internal node. The method comprises storing in one or more data structures a first data set regarding external nodes and a second data set regarding nodes with known properties in a selected group, each data set having one or more data items representing one or more events relating to or attributes of each node in the data set, the second data set including one or more types of data items not included in the first data set.

Abstract: The present invention is directed towards systems and methods for predicting one or more desired properties of external nodes or properties of their relations with internal nodes, based on a selected group of nodes about which it is known whether the nodes have the desired properties, or it is known whether they have a desired relation property with an internal node. The method comprises storing in one or more data structures a first data set regarding external nodes and a second data set regarding nodes with known properties in a selected group, each data set having one or more data items representing one or more events relating to or attributes of each node in the data set, the second data set including one or more types of data items not included in the first data set.

Abstract: The present invention is directed towards systems and methods for predicting one or more desired properties of external nodes or properties of their relations with internal nodes, based on a selected group of nodes about which it is known whether the nodes have the desired properties, or it is known whether they have a desired relation property with an internal node. The method comprises storing in one or more data structures a first data set regarding external nodes and a second data set regarding nodes with known properties in a selected group, each data set having one or more data items representing one or more events relating to or attributes of each node in the data set, the second data set including one or more types of data items not included in the first data set.

Abstract: The present invention is directed towards systems and methods for predicting one or more desired properties of external nodes or properties of their relations with internal nodes, based on a selected group of nodes about which it is known whether the nodes have the desired properties, or it is known whether they have a desired relation property with an internal node. The method comprises storing in one or more data structures a first data set regarding external nodes and a second data set regarding nodes with known properties in a selected group, each data set having one or more data items representing one or more events relating to or attributes of each node in the data set, the second data set including one or more types of data items not included in the first data set.