Disclosed are systems, methods, and non-transitory computer-readable storage media for malware detection and content item recovery. For example, a content management system can receive information describing changes made to content items stored on a user device. The content management system can analyze the information to determine if the described changes are related to malicious software on the user device. When the changes are related to malicious software, the content management system can determine which content items are effected by the malicious software and/or determine when the malicious software first started making changes to the user device. The content management system can recover effected content items associated with the user device by replacing the effected versions of the content items with versions of the content items that existed immediately before the malicious software started making changes to the user device.

Disclosed herein are systems and methods for enabling the automatic detection of executable code from a stream of bytes. In some embodiments, the stream of bytes can be sourced from the hidden areas of files that traditional malware detection solutions ignore. In some embodiments, a machine learning model is trained to detect whether a particular stream of bytes is executable code. Other embodiments described herein disclose systems and methods for automatic feature extraction using a neural network. Given a new file, the systems and methods may preprocess the code to be inputted into a trained neural network. The neural network may be used as a “feature generator” for a malware detection model. Other embodiments herein are directed to systems and methods for identifying, flagging, and/or detecting threat actors which attempt to obtain access to library functions independently.

A system and a method for automatically clustering sandbox analysis reports of similar malware samples. An automated malware analysis process includes receiving from a sandbox server the sandbox analysis reports of the similar malware samples at an application programming interface (API) of the clustering server, clustering similar Uniform Resource Locators (URLs) together and clustering the sandbox analysis reports of events in sandbox reports clusters (1-n) based on the URL clustering, static properties of the malware samples and dynamic properties of the malware samples.

The present disclosure describes various embodiments of systems, apparatuses, and methods for detecting a Trojan inserted integrated circuit design using delay-based side channel analysis. In one such embodiment, an automated test generation algorithm produces test patterns that are likely to activate trigger conditions and change critical paths of an integrated circuit design.

An exemplary method of detecting a Trojan circuit in an integrated circuit is related to applying a test pattern comprising an initial test pattern followed by a corresponding succeeding test pattern to a golden design of the integrated circuit, wherein a change in the test pattern increases side-channel sensitivity; measuring a side-channel parameter in the golden design of the integrated circuit after application of the test pattern; applying the test pattern to a design of the integrated circuit under test; measuring the side-channel parameter in the design of the integrated circuit under test after application of the test pattern; and determining a Trojan circuit to be present in the integrated circuit under test when the measured side-channel parameters vary by a threshold.

A computer-implemented method includes monitoring, by a power monitor on a computer device, for a peripheral device connection. The peripheral device connection connecting a peripheral device to an input/output port of the computer device. The input/output port is configured to provide power from a power supply of the computer device to the peripheral device. In response to the monitoring for the peripheral device connection identifying the peripheral device connection, the method includes determining, by the power monitor, a device type and a negotiated power of the peripheral device as connected. The power monitor determines whether the negotiated power of the peripheral device as connected matches expected power information. In response to determining the negotiated power of the peripheral device does not match the expected power information, the power monitor takes action on the computer device.

Security can be improved in a business application or system, such as a mission-critical application, by automatically analyzing and detecting anomalies for mission-critical applications. This detection may be based on a dynamic analysis of business process logs and audit trails that includes User and Entity Behavior Analysis (“UEBA”).

A guest operating system executing on a virtual machine hosted by a host operating system may forward information about the state of the guest operating system to the host operating system for analysis regarding security threats. The host operating system may also forward information about the state of the host operating system to the guest operating system for analysis regarding security threats. One or both of the guest operating system and the host operating system may also forward the information about their state(s) to a remote server for analysis regarding security threats to the machine running the host operating system and hosting the virtual machine running the guest operating system. Security threats may be identified based on a detection of abnormal behavior. Abnormal behavior may be detected using machine-learning models. The machine-learning models may be trained/refined over time based on collected state information.

Methods and systems for allowing software components that operate at a specific exception level (e.g., EL-3 to EL-1, etc.) to repeatedly or continuously observe or evaluate the integrity of software components operating at a lower exception level (e.g., EL-2 to EL-0) to ensure that the software components have not been corrupted or compromised (e.g., subjected to malware, cyberattacks, etc.) include a computing device that identifies, by a component operating at a higher exception level (“HEL component”), at least one of a current vector base address (VBA), an exception raising instruction (ERI) address, or a control and system register value associated with a component operating at a lower exception level (“LEL component”). The computing device may perform a responsive action in response to determining that the current VBA, the ERT address, or control and system register value do not match the corresponding reference data.

A method for managing memory within a computing system. The method includes one or more computer processors identifying a range of physical memory addresses that store a first data. The method further includes determining whether a second data is stored within the range of physical memory addresses that stores the first data. The method further includes responding to determining that the second data is stored within the range of physical memory addresses that store the first data, by determining whether a process accessing the second data is identified as associated with a side-channel attack. The method further includes responding to determining that the process accessing the second data is associated with the side-channel attack, by initiating a response associated with the process accessing the second data.