A method for performing program analysis includes receiving programs of a first platform that have been assigned a first label and programs of the first platform that have been assigned a second label. Each of the programs of the first platform is expressed as platform-independent logical features. A discriminatory model or classifier is trained, using machine learning, based on the expression of the programs of the first platform as platform-independent logical features, to distinguish between programs of the first label and programs of the second label. An unlabeled program of a second platform is received and is expressed as platform-independent logical features. The trained discriminatory model or classifier is used to determine if the unlabeled program warrants the first label or the second label, based on the expression of the unlabeled program as platform-independent logical features.

Web security methods and apparatus are disclosed herein. A method includes receiving a detection model for detecting malicious webpages via a transceiver of the computing device, and storing the detection model in a non-volatile memory of the computing device. One or more JavaScripts are detected in the webpage, wherein each of the JavaScripts can be separately executed. A feature vector for each of the JavaScripts may be generated, either incrementally as the web page is being loaded or prefetching the JavaScript for the web page, to produce one or more feature vectors for the webpage, wherein a particular feature vector includes values for different features of a JavaScript. Each of the feature vectors are analyzed with the multi-instance learning based detection model to determine whether the webpage from which the JavaScripts originate is malicious or benign.

Utilizing an Information Analyzer to profile data in order to identify data assets that contain executable code for the purpose of ensuring the security and integrity of the profiled data. The results of the data profiling process can be used by security policies to reduce the risks of malicious code execution attacks.

The present disclosure provides techniques for calculating an entity's cybersecurity risk based on identified relationships between the entity and one or more vendors. Customer/vendor relationships may impact the cybersecurity risk for each of the parties involved because a security compromise of a downstream or upstream provider can lead to a compromise of multiple other companies. For example, if organization A uses B (e.g., a cloud service provider) to store files, and B is compromised, this may lead to organization A being compromised (e.g., the files organization A stored using B may have been compromised by the breach of B's cybersecurity). Embodiments of the present disclosure further provide a technique for calculating a cybersecurity risk score for an organization based on identified customer/vendor relationships.

A method includes receiving electronic data, extracting a first identifier from the electronic data, extracting first attributes from the electronic data, and searching a database for identifiers that match the first identifier to determine a number of matching identifiers. The method also includes determining that the number of matching identifiers exceeds a first threshold and searching the database for attributes associated with each of the matching identifiers to determine a subset of matching attributes. The method further includes calculating a specificity for the subset of matching attributes, determining that the specificity of the subset of matching attributes is less than or equal to a second threshold, and creating a filter based at least in part on the determination that the specificity of the subset of matching attributes is less than or equal to the second threshold.

A computer implemented method of detecting malware in a received software component includes generating a profile for the malware by accessing machine code for the malware, identifying a subset of the machine code for the malware as a logical subroutine of the malware, and extracting one or more features of the logical subroutine of the malware as the profile. The method further includes accessing machine code for the received software component to identify a plurality of logical subroutines thereof and extracting one or more features of each logical subroutine of the received software component for comparison with the profile to detect the malware in the received software component.

Disclosed herein are systems and methods for categorizing an application on a computing device including gathering a set of attributes of an application. The set of attributes of the application includes at least one of: a number of files in an application package of the application; a number of executable files in the application package; numbers and types of permissions being requested; a number of classes in the executable files in the application package; and a number of methods in the executable files in the application package. sending the gathered set of attributes to a trained classification model. The application is classified, using the classification model, based on the gathered set of attributes by generating one or more probabilities of the application belonging to respective one or more categories of applications. A category of the application is determined based on the generated one or more probabilities.

Methods, computer program products, and systems are presented. The methods include, for instance: analyzing a dataset associated with a service provided by the data protection service provider in order to determine a policy for when and how to replicate the respective components of the dataset corresponding to the service from a source site to a target site, such that the target site may perform the service with a minimum cost.

In some embodiments, a method includes processing at least a portion of a received file into a first set of fragments and analyzing each fragment from the first set of fragments using a machine learning model to identify within each fragment first information potentially relevant to whether the file is malicious. The method includes forming a second set of fragments by combining adjacent fragments from the first set of fragments and analyzing each fragment from the second set of fragments using the machine learning model to identify second information potentially relevant to whether the file is malicious. The method includes identifying the file as malicious based on the first information within at least one fragment from the first set of fragments and the second information within at least one fragment from the second set of fragments. The method includes performing a remedial action based on identifying the file as malicious.

A flexible security system has been created that allows for fluid security operations that adapt to the dynamic nature of user behavior while also allowing the security related operations themselves to be dynamic. This flexible system includes ongoing collection and/or updating of multi-perspective “security contexts” per actor and facilitating consumption of these multi-perspective security contexts for security related operations on the users. These security related operations can include policy-based security enforcement and inspection. A security platform component or security entity uses a multi-perspective security context for a user or actor. Aggregating and maintaining behavioral information into a data structure for an actor over time from different sources allows a security platform component or entity to have historical context for an actor from one or more security perspectives. Descriptors that form a security context can originate from various sources having visibility of user behavior and/or user attributes.