JP6305442B2 - 複数のアナライザモデルプロバイダを用いたモバイルデバイスにおけるオンライン挙動分析エンジン - Google Patents

複数のアナライザモデルプロバイダを用いたモバイルデバイスにおけるオンライン挙動分析エンジン Download PDF

Info

Publication number
JP6305442B2
JP6305442B2 JP2015558035A JP2015558035A JP6305442B2 JP 6305442 B2 JP6305442 B2 JP 6305442B2 JP 2015558035 A JP2015558035 A JP 2015558035A JP 2015558035 A JP2015558035 A JP 2015558035A JP 6305442 B2 JP6305442 B2 JP 6305442B2
Authority
JP
Japan
Prior art keywords
behavior
mobile device
model
behavior model
processor
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
JP2015558035A
Other languages
English (en)
Japanese (ja)
Other versions
JP2016512631A (ja
JP2016512631A5 (enExample
Inventor
ラジャルシ・グプタ
マーク・バプスト
モハンマド・ホセイン・レシャディ
サミール・クマール
Original Assignee
クアルコム，インコーポレイテッド
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US13/937,462 external-priority patent/US9747440B2/en
Application filed by クアルコム，インコーポレイテッド filed Critical クアルコム，インコーポレイテッド
Publication of JP2016512631A publication Critical patent/JP2016512631A/ja
Publication of JP2016512631A5 publication Critical patent/JP2016512631A5/ja
Application granted granted Critical
Publication of JP6305442B2 publication Critical patent/JP6305442B2/ja
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N5/00—Computing arrangements using knowledge-based models
    • G06N5/04—Inference or reasoning models
    • G06N5/043—Distributed expert systems; Blackboards

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Debugging And Monitoring (AREA)
  • Artificial Intelligence (AREA)
  • Computational Linguistics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Mathematical Physics (AREA)
JP2015558035A 2013-02-15 2014-02-06 複数のアナライザモデルプロバイダを用いたモバイルデバイスにおけるオンライン挙動分析エンジン Active JP6305442B2 (ja)

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
US201361765461P 2013-02-15 2013-02-15
US61/765,461 2013-02-15
US13/937,462 US9747440B2 (en) 2012-08-15 2013-07-09 On-line behavioral analysis engine in mobile device with multiple analyzer model providers
US13/937,462 2013-07-09
PCT/US2014/015088 WO2014126779A1 (en) 2013-02-15 2014-02-06 On-line behavioral analysis engine in mobile device with multiple analyzer model providers

Publications (3)

Publication Number Publication Date
JP2016512631A JP2016512631A (ja) 2016-04-28
JP2016512631A5 JP2016512631A5 (enExample) 2017-03-02
JP6305442B2 true JP6305442B2 (ja) 2018-04-04

Family

ID=51354483

Family Applications (1)

Application Number Title Priority Date Filing Date
JP2015558035A Active JP6305442B2 (ja) 2013-02-15 2014-02-06 複数のアナライザモデルプロバイダを用いたモバイルデバイスにおけるオンライン挙動分析エンジン

Country Status (5)

Country Link
EP (1) EP2956884B1 (enExample)
JP (1) JP6305442B2 (enExample)
KR (1) KR20150119895A (enExample)
CN (1) CN105074718A (enExample)
WO (1) WO2014126779A1 (enExample)

Families Citing this family (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9710648B2 (en) 2014-08-11 2017-07-18 Sentinel Labs Israel Ltd. Method of malware detection and system thereof
US11507663B2 (en) 2014-08-11 2022-11-22 Sentinel Labs Israel Ltd. Method of remediating operations performed by a program and system thereof
US9710752B2 (en) * 2014-09-11 2017-07-18 Qualcomm Incorporated Methods and systems for aggregated multi-application behavioral analysis of mobile device behaviors
KR101822404B1 (ko) * 2015-11-30 2018-01-26 임욱빈 Dnn 학습을 이용한 세포이상 여부 진단시스템
CN109314716B (zh) * 2016-07-02 2022-03-29 英特尔公司 用于物联网的认知边缘处理
CN106778241B (zh) * 2016-11-28 2020-12-25 东软集团股份有限公司 恶意文件的识别方法及装置
US11616812B2 (en) 2016-12-19 2023-03-28 Attivo Networks Inc. Deceiving attackers accessing active directory data
US11695800B2 (en) 2016-12-19 2023-07-04 SentinelOne, Inc. Deceiving attackers accessing network data
US11881051B2 (en) * 2017-02-24 2024-01-23 Telefonaktiebolaget Lm Ericsson (Publ) Classifying an instance using machine learning
JP6767924B2 (ja) 2017-05-19 2020-10-14 東芝映像ソリューション株式会社 システム、方法及びプログラム
JP6767926B2 (ja) 2017-05-23 2020-10-14 東芝映像ソリューション株式会社 電子装置、方法及びプログラム
WO2019032728A1 (en) 2017-08-08 2019-02-14 Sentinel Labs, Inc. METHODS, SYSTEMS AND DEVICES FOR DYNAMICALLY MODELING AND REGROUPING END POINTS FOR ONBOARD NETWORKING
WO2019066099A1 (ko) * 2017-09-27 2019-04-04 (주)알티캐스트 통합된 분석 모델에 기초하여 이상 행동을 감지하는 시스템 및 그 방법
KR101971799B1 (ko) * 2017-11-08 2019-05-13 주식회사 알티캐스트 통합된 분석 모델에 기초하여 이상 행동을 감지하는 시스템 및 그 방법
US11470115B2 (en) 2018-02-09 2022-10-11 Attivo Networks, Inc. Implementing decoys in a network environment
US12111861B2 (en) * 2018-10-09 2024-10-08 Schneider Electric USA, Inc. Dynamic ontology data operation
WO2020075270A1 (ja) * 2018-10-11 2020-04-16 株式会社ウフル 機械学習モデル切替システム、機械学習モデル切替方法及びプログラム
WO2020075271A1 (ja) * 2018-10-11 2020-04-16 株式会社ウフル 機械学習モデル切替システム、機械学習モデル切替方法及びプログラム
EP3918500B1 (en) * 2019-03-05 2024-04-24 Siemens Industry Software Inc. Machine learning-based anomaly detections for embedded software applications
JP7278423B2 (ja) 2019-05-20 2023-05-19 センチネル ラブス イスラエル リミテッド 実行可能コード検出、自動特徴抽出及び位置独立コード検出のためのシステム及び方法
EP3767503B1 (de) * 2019-07-18 2025-02-19 Siemens Aktiengesellschaft Verfahren und testumgebung zur bereitstellung einer anwendung für eine computergesteuerte komponente
KR102310187B1 (ko) * 2019-09-25 2021-10-08 한국전자기술연구원 복수의 엣지와 클라우드를 포함하는 분산 컴퓨팅 시스템 및 이의 적응적 지능 활용을 위한 분석 모델 제공 방법
CA3126246A1 (en) * 2020-08-12 2022-02-12 T-Mobile Usa, Inc. Rules-based just-in-time mobile content service
US12126630B2 (en) 2020-10-19 2024-10-22 Pathlock Inc. Systems, methods, and devices for implementing security operations in a security platform
CN116250270A (zh) * 2020-10-28 2023-06-09 华为技术有限公司 一种模型配置方法及装置
KR102431555B1 (ko) * 2020-11-05 2022-08-11 주식회사 에벤에셀케이 스토리지를 공유하는 프로세스 간의 연계를 통해 데이터를 처리하기 위한 방법, 시스템, 및 컴퓨터-판독가능 매체
US11579857B2 (en) 2020-12-16 2023-02-14 Sentinel Labs Israel Ltd. Systems, methods and devices for device fingerprinting and automatic deployment of software in a computing network using a peer-to-peer approach
US11899782B1 (en) 2021-07-13 2024-02-13 SentinelOne, Inc. Preserving DLL hooks
US12452273B2 (en) 2022-03-30 2025-10-21 SentinelOne, Inc Systems, methods, and devices for preventing credential passing attacks
US12468810B2 (en) 2023-01-13 2025-11-11 SentinelOne, Inc. Classifying cybersecurity threats using machine learning on non-euclidean data

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7487543B2 (en) * 2002-07-23 2009-02-03 International Business Machines Corporation Method and apparatus for the automatic determination of potentially worm-like behavior of a program
JP2006053788A (ja) * 2004-08-12 2006-02-23 Ntt Docomo Inc ソフトウェア動作監視装置及びソフトウェア動作監視方法
US8108929B2 (en) * 2004-10-19 2012-01-31 Reflex Systems, LLC Method and system for detecting intrusive anomalous use of a software system using multiple detection algorithms
US8239505B2 (en) * 2007-06-29 2012-08-07 Microsoft Corporation Progressively implementing declarative models in distributed systems
US8479286B2 (en) * 2009-12-15 2013-07-02 Mcafee, Inc. Systems and methods for behavioral sandboxing
US8806620B2 (en) * 2009-12-26 2014-08-12 Intel Corporation Method and device for managing security events
CA2817576C (en) * 2010-11-24 2016-06-07 Logrhythm, Inc. Scalable analytical processing of structured data
US20120167218A1 (en) * 2010-12-23 2012-06-28 Rajesh Poornachandran Signature-independent, system behavior-based malware detection
US8640245B2 (en) * 2010-12-24 2014-01-28 Kaspersky Lab, Zao Optimization of anti-malware processing by automated correction of detection rules
WO2012109533A1 (en) * 2011-02-10 2012-08-16 Beyondtrust Software, Inc. System and method for detecting or preventing data leakage using behavior profiling
JP5665188B2 (ja) * 2011-03-31 2015-02-04 インターナショナル・ビジネス・マシーンズ・コーポレーションＩｎｔｅｒｎａｔｉｏｎａｌ Ｂｕｓｉｎｅｓｓ Ｍａｃｈｉｎｅｓ Ｃｏｒｐｏｒａｔｉｏｎ ソフトウエア更新を適用した情報処理装置を検査するシステム
RU2454705C1 (ru) * 2011-04-19 2012-06-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ защиты компьютерного устройства от вредоносных объектов, использующих сложные схемы заражения
CN102790758B (zh) * 2011-05-18 2017-08-18 海尔集团公司 防火墙系统及其处理方法

Also Published As

Publication number Publication date
EP2956884B1 (en) 2020-09-09
KR20150119895A (ko) 2015-10-26
WO2014126779A1 (en) 2014-08-21
CN105074718A (zh) 2015-11-18
JP2016512631A (ja) 2016-04-28
EP2956884A1 (en) 2015-12-23

Similar Documents

Publication Publication Date Title
JP6305442B2 (ja) 複数のアナライザモデルプロバイダを用いたモバイルデバイスにおけるオンライン挙動分析エンジン
US9747440B2 (en) On-line behavioral analysis engine in mobile device with multiple analyzer model providers
US9690635B2 (en) Communicating behavior information in a mobile computing device
US9609456B2 (en) Methods, devices, and systems for communicating behavioral analysis information
EP2850865B1 (en) Minimizing latency of behavioral analysis using signature caches
US9298494B2 (en) Collaborative learning for efficient behavioral analysis in networked mobile device
US9652362B2 (en) Methods and systems of using application-specific and application-type-specific models for the efficient classification of mobile device behaviors
JP6235000B2 (ja) クライアントクラウド挙動アナライザのためのアーキテクチャ
US9491187B2 (en) APIs for obtaining device-specific behavior classifier models from the cloud
US9319897B2 (en) Secure behavior analysis over trusted execution environment
US9324034B2 (en) On-device real-time behavior analyzer
US20160232353A1 (en) Determining Model Protection Level On-Device based on Malware Detection in Similar Devices
US20160078362A1 (en) Methods and Systems of Dynamically Determining Feature Sets for the Efficient Classification of Mobile Device Behaviors

Legal Events

Date Code Title Description
A529 Written submission of copy of amendment under article 34 pct

Free format text: JAPANESE INTERMEDIATE CODE: A529

Effective date: 20150812

A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A523

Effective date: 20170123

A621 Written request for application examination

Free format text: JAPANESE INTERMEDIATE CODE: A621

Effective date: 20170123

A977 Report on retrieval

Free format text: JAPANESE INTERMEDIATE CODE: A971007

Effective date: 20180129

TRDD Decision of grant or rejection written
A01 Written decision to grant a patent or to grant a registration (utility model)

Free format text: JAPANESE INTERMEDIATE CODE: A01

Effective date: 20180205

A61 First payment of annual fees (during grant procedure)

Free format text: JAPANESE INTERMEDIATE CODE: A61

Effective date: 20180306

R150 Certificate of patent or registration of utility model

Ref document number: 6305442

Country of ref document: JP

Free format text: JAPANESE INTERMEDIATE CODE: R150

R250 Receipt of annual fees

Free format text: JAPANESE INTERMEDIATE CODE: R250

R250 Receipt of annual fees

Free format text: JAPANESE INTERMEDIATE CODE: R250

R250 Receipt of annual fees

Free format text: JAPANESE INTERMEDIATE CODE: R250

R250 Receipt of annual fees

Free format text: JAPANESE INTERMEDIATE CODE: R250

R250 Receipt of annual fees

Free format text: JAPANESE INTERMEDIATE CODE: R250