Joseph L Chen

US Patent:

8099784, Jan 17, 2012

Filed:

Feb 13, 2009

Appl. No.:

12/371501

Inventors:

Joseph Chen - Los Angeles CA, US
Jamie Jooyoung Park - Los Angeles CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 11/00

US Classification:

726 23

Abstract:

To evade heuristic detection, malware is often designed to trick users into installing the malware by being packaged in a standard installer known to the user's computer for typically installing legitimate software. To prevent removal of the malware, the malware modifies or removes its uninstaller. A security module manages this type of evasion technique by monitoring and detecting installations performed on a computer. The module detects attempts to remove or modify the uninstaller for the application to render the uninstaller incapable of uninstalling the application. The module can intercept and block such attempts, and then analyze the application for malicious code. Where the application is determined to be malware, the module prevents malicious activity. The module can also use the malware's own uninstaller to uninstall the malware from the computer.

US Patent:

8225405, Jul 17, 2012

Filed:

Jan 29, 2009

Appl. No.:

12/362352

Inventors:

Christopher Peterson - Culver City CA, US
Joseph H. Chen - Los Angeles CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

H04L 29/06

US Classification:

726 24, 726 23, 726 25, 713187, 713188

Abstract:

Unknown malicious code is heuristically detected on a host computer system. A virus signature for the malicious code is created locally on the host computer system. A blacklist on the host computer system is updated with the virus signature for the heuristically detected malicious code. Accordingly, the blacklist is updated with the virus signature of the heuristically detected malicious code without distribution of the virus signature to the general public. Further, the host computer system is scanned for other instances of the heuristically detected malicious code using the created virus signature. Accordingly, file based detection and remediation of the malicious code is achieved without requiring execution of the malicious code for detection and the associated risks.

US Patent:

8281399, Oct 2, 2012

Filed:

Mar 28, 2012

Appl. No.:

13/433259

Inventors:

Joseph Chen - Los Angeles CA, US
Allen Hair - Los Angeles CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 21/00

US Classification:

726 24

Abstract:

A computer-implemented method for using property tables to perform non-iterative malware scans may include (1) obtaining at least one malware signature from a security software provider that identifies at least one property value for an item of malware, (2) accessing a property table for a computing device that identifies property values shared by one or more application packages installed on the computing device and, for each property value, each application package that shares the property value in question, and (3) determining, by comparing each property value identified in the malware signature with the property table, whether any of the application packages match the malware signature without having to iterate through the individual property values of each application package. Various other methods, systems, and computer-readable media are also disclosed.

US Patent:

8302191, Oct 30, 2012

Filed:

Mar 13, 2009

Appl. No.:

12/404249

Inventors:

Robert Conrad - Culver City CA, US
Christopher Peterson - Culver City CA, US
Joseph H. Chen - Los Angeles CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 21/00

US Classification:

726 23, 726 22

Abstract:

A submission filtering component filters malware related content received for analysis. The submission filtering component determines an analysis priority rating for each source from which malware related content is received. An analysis priority ratings is based on various factors indicative of how likely the source is to transmit malware related content that is important to analyze. The malware filtering component transforms the received stream of malware related content into a subset to be analyzed, based on the analysis priority ratings associated with sources from which malware related content is received. A malware analysis component analyzes the subset of malware related content.

US Patent:

8302194, Oct 30, 2012

Filed:

Oct 26, 2009

Appl. No.:

12/606163

Inventors:

Robert Conrad - Culver City CA, US
Joseph Chen - Los Angeles CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 12/14
G06F 7/04
G06F 11/30
G06F 15/173
G06F 15/16
H04L 29/06
H04L 9/32

US Classification:

726 24, 726 25, 726 26, 713151, 713165, 713168, 713187, 713188, 709224, 709225, 709232

Abstract:

The prevalence rate of a file to be subject to behavior based heuristics analysis is determined, and the aggressiveness level to use in the analysis is adjusted, responsive to the prevalence rate. The aggressiveness is set to higher levels for lower prevalence files and to lower levels for higher prevalence files. Behavior based heuristics analysis is applied to the file, using the set aggressiveness level. In addition to setting the aggressiveness level, the heuristic analysis can also comprise dynamically weighing lower prevalence files as being more likely to be malicious and higher prevalence files as being less likely. Based on the applied behavior based heuristics analysis, it is determined whether or not the file comprises malware. If it is determined that the file comprises malware, appropriate steps can be taken, such as blocking, deleting, quarantining and/or disinfecting the file.

US Patent:

8321935, Nov 27, 2012

Filed:

Feb 26, 2009

Appl. No.:

12/393957

Inventors:

Joseph H. Chen - Los Angeles CA, US
Christopher Peterson - Culver City CA, US
Robert Conrad - Culver City CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 11/00
G06F 12/14
G06F 12/16
G08B 23/00

US Classification:

726 22, 726 23

Abstract:

A malware analysis component receives information concerning malware infections on a large plurality of client computers, as detected by an anti-malware product or submitted directly by users. The malware analysis component analyzes this wide array of information, and identifies suspicious malware detection and submission activity associated with specific sources. Where identified suspicious patterns of malware detection and submission activity associated with a specific source meet a given threshold over time, the malware analysis component determines that the source is an originator of malware.

US Patent:

8370942, Feb 5, 2013

Filed:

Mar 12, 2009

Appl. No.:

12/403321

Inventors:

Christopher Peterson - Culver City CA, US
Robert Conrad - Culver City CA, US
Joseph H. Chen - Los Angeles CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

H04L 29/06

US Classification:

726 24, 726 22, 726 23

Abstract:

A malware source analysis component determines which sources of malware are sufficiently suspicious such that all binary files located thereon should be analyzed. In order to makes such determinations, the malware source analysis component receives information concerning malware infections from a plurality of sources. The malware source analysis component analyzes the received information, and determines suspiciousness levels associated with specific sources. Responsive to identifying a given threshold suspiciousness level associated with a source, the malware source analysis component adjudicates that source to be suspicious. Where a source is adjudicated to be suspicious, the malware source analysis component submits submission instructions to that source, directing it to identify binary files thereon and submit them to be analyzed. The malware source analysis component receives binary files from suspicious sources according to the submission instructions, and analyzes the received binary files.

US Patent:

8402539, Mar 19, 2013

Filed:

Sep 8, 2011

Appl. No.:

13/227997

Inventors:

Joseph Chen - Los Angeles CA, US
Adam Glick - Culver City CA, US
Jeffrey Wilhelm - Venice CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

H04L 29/06
G06F 15/16
G06F 11/30

US Classification:

726 22, 709227

Abstract:

A method for detecting malware may include 1) receiving a request to determine whether a connection from a client device to a server is being blocked, 2) attempting to connect to the server from a kernel mode of the client device, 3) determining that the client device successfully connected to the server from the kernel mode, 4) attempting to connect to the server from a user mode of the client device, 5) determining that the client device did not successfully connect to the server from the user mode, 6) determining, based on the client device successfully connecting to the server from the kernel mode and failing to connect to the server from the user mode, that malware is blocking the connection from the client device to the server, and 7) in response to determining that the malware is blocking the connection, performing at least one security action.

Address:

2565 Reynolds Dr, Tustin, CA 92782

VIN:

JA4MS41X37Z004185

Make:

MITSUBISHI

Model:

OUTLANDER

Year:

2007