An analysis engine of an anomaly detection system receives an input captured by a monitoring device, determines, based on a currently used anomaly detection model, that the input represents an object or event that should not be classified as an anomaly, and determines, based on a previously used model, that the input was previously classified as an anomaly. In response, the analysis engine determines a respective classification result for the input based on additional models used between the currently and previously used models, determines, based on the respective classification results, that it is likely that the anomaly detection system has been deliberately re-trained to falsely classify the input, and initiates an action to correctly classify the input as representing an object or event that should be classified as an anomaly. The anomaly detection models and classification results may be stored in a training repository for the anomaly detection system.

Examples of the present disclosure describe systems and methods for a behavioral threat detection engine. In examples, the behavioral threat detection engine manages execution of one or more virtual machines, wherein each virtual machine processes a rule in relation to a context. The behavioral threat detection engine uses any of a variety of techniques to identify when events occur. Accordingly, the behavioral threat detection engine provides event indications, in the form of event packets, to one or more virtual machines, such that corresponding rules are able to process the events accordingly. Eventually, a rule may make a determination as to the presence or absence of a behavior. As a result, execution of the associated virtual machine may be halted, thereby indicating to the behavioral threat detection engine that a determination has been made. Thus a behavioral threat detection engine employs a behavior-based approach to detecting malicious or potentially malicious behaviors.

A method for receiving firmware including pieces of firmware data is provided. The method is performed by a first apparatus in a multicast group including at least the first apparatus and a second apparatus. The method includes (a) receiving first meta-information for the firmware data from the second apparatus, (b) generating, based on the first meta-information, second meta-information for at least one piece of firmware data to be used to apply the firmware to the first apparatus, among the firmware data, and (c) receiving, based on the second meta-information, the at least one piece of firmware data from a firmware providing apparatus or the second apparatus. The first meta-information includes at least history information including version and partitioning information for each of the pieces of firmware data, and the second meta-information includes at least the history information for each of the at least one piece of firmware data.

A controller that is separate from a processor of the system verifies controller code for execution on the controller. In response to verifying the controller code, the controller verifies system boot code.

A system and methods for sandboxed malware analysis and automated patch development, deployment and validation, comprising a business operating system, vulnerability scoring engine, binary translation engine, sandbox simulation engine, at least one network endpoint, at least one database, a network, and a combination of machine learning and vulnerability probing techniques, to analyze software, locate any vulnerabilities or malicious behavior, and attempt to patch and prevent undesired behavior from occurring, autonomously.

There is disclosed a method, computer program product and a system for regulating execution of a suspicious process, comprising determining a file system location of an executable file associated with the suspicious process, encrypting the file, and creating a wrapper for the file with the same file name and location as the file associated with the suspicious process.

Example embodiments provide methods, apparatuses, systems, computing devices, and/or the like for vetting USB device firmware via a USB-specific firmware analysis framework. In one example, a method is provided for analyzing firmware of a Universal Serial Bus (USB) device. The example method includes steps of receiving a firmware image extracted from the USB device, identifying signatures from the firmware image relating to USB operation, and building an expected model of operation of the USB device using the identified signatures and a database of operational information regarding USB devices. The example method further includes the steps of generating a recovered model of operation of the USB device based on the firmware image and the identified signatures, and comparing the recovered model of operation with the expected model of operation to identify unexpected or unknown behaviors. The example method may further include generating a report comprising the identified unexpected or unknown behaviors.

Systems and methods are provided for the classification of identified security vulnerabilities in software applications, and their automated triage based on machine learning. The disclosed system may generate a report listing detected potential vulnerability issues, and extract features from the report for each potential vulnerability issue. The system may receive policy data and business rules, and compare the extracted features relative to such data and rules. The system may determine a token based on the source code of a potential vulnerability issue, and a vector based on the extracted features of a potential vulnerability issue and based on the token. The system may select a machine learning modelling method and/or an automated triaging method based on the vector, and determine a vulnerability accuracy score based on the vector using the selected method.

An information processing device, includes: a metadata generator generating, based on an update request of firmware, first metadata including identification of the firmware; a time manager; a validity period determiner determining a first validity period for the first metadata based on time acquired from the time manager; a counter counting up a value per unit time; an acquirer acquiring a first counter value of the counter for the first metadata; a storage storing entries in which second metadata including identification of firmware, a second validity period of the second metadata, and a second counter value of the counter having been acquired for the second metadata are associated; and a determiner detecting the second metadata including same identification as the first metadata, acquire the second validity period and the second counter value from the entry including the detected second metadata, and detecting falsification of the first validity period.

In general, embodiments relate to a method for performing a local vulnerability check of an application upgrade to be downloaded, comprising: receiving an application upgrade download request from a client device; sending, by a client device upgrade manager, information related to the application upgrade download request to a local vulnerability validator; determining by the local vulnerability validator, based on impact score information, that a specific version of the application upgrade to be downloaded has vulnerabilities; sending the impact score information to the client device upgrade manager; and notifying, based on the impact score information, the client device that the application upgrade to be downloaded has vulnerabilities.