Peer-Reviewed Publications from NortonLifeLock Research Group
Aware: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings
In Proceedings of the 26th USENIX Security Symposium (Aug 2017)
Automatic Application Identification from Billions of Files
In Proceedings of the 23rd SIGKDD Conference on Knowledge Discovery and Data Mining (KDD 2017)
Mapping binary files into software packages enables malware detection and other tasks, but is challenging. By combining installation data with file metadata that we summarize into sketches, from millions of machines and billions of files, we can use efficient approximate clustering techniques to map files to applications automatically and reliably.
Lean On Me: Mining Internet Service Dependencies From Large-Scale DNS Data
In Proceedings of the 33th Annual computer Security Applications Conference (ACSAC 2017)
To assess the security risk for a given entity, and motivated by the effects of recent service disruptions, we perform a large-scale analysis of passive and active DNS datasets including more than 2.5 trillion queries in order to discover the dependencies between websites and Internet services.
Mini-Batch Spectral Clustering
In Proceedings of the 2017 International Joint Conference on Neural Networks (IJCNN 2017)
This paper proposes a practical approach to learn spectral clustering based on adaptive stochastic gradient optimization. Crucially, the proposed approach recovers the exact spectrum of Laplacian matrices in the limit of the iterations, and the cost of each iteration is linear in the number of samples. Extensive experimental validation on data sets with up to half a million samples demonstrate its scalability and its ability to outperform state-of-the-art approximate methods to learn spectral clustering for a given computational budget.
RiskTeller: Predicting the Risk of Cyber Incidents
In Proceedings of the 24th ACM Conference on Computer and Communications Security (ACM SIGSAC 2017)
Large-Scale Identification of Malicious Singleton Files
In Proceedings of the 7th ACM Conference on Data and Application Security and Privacy (CODASPY)
94% of the software files that Symantec saw in a 1-year dataset appeared only once on a single machine. We examine the primary reasons for which both benign and malicious software files appear as singletons, and design a classifier to distinguish between these two classes of singleton software files.
Smoke Detector: Cross-Product Intrusion Detection With Weak Indicators
In Proceedings of the Annual Computer Security Applications Conference (ACSAC 2017)
Smoke Detector significantly expands upon limited collections of hand-labeled security incidents by framing event data as relationships between events and machines, and performing random walks to rank candidate security incidents. Smoke Detector significantly increases incident detection coverage for mature Managed Security Service Providers.
Predicting Cyber Threats with Virtual Security Products
In Proceedings of the 33th Annual computer Security Applications Conference (ACSAC 2017)
We set out to predict which security events and incidents a security product would have detected had it been deployed, based on the events produced by other security products that were in place. We discovered that the problem is tractable, and that some security products are much harder to model than others, which makes them more valuable.
Marmite: Spreading Malicious File Reputation Through Download Graphs
In Proceedings of the 33rd Annual Computer Security Applications Conference (ACSAC 2017)
We presented Marmite, a system that can detect malicious files by leveraging a global download graph and label propagation with Bayesian confidence.
Related News
Back to Top
© 2019–2023 NortonLifeLock Inc. All rights reserved. NortonLifeLock, the NortonLifeLock Logo, the Checkmark Logo, Norton, LifeLock, and the LockMan Logo are trademarks or registered trademarks of NortonLifeLock Inc. or its affiliates in the United States and other countries.
Other names may be trademarks of their respective owners.
© 2019–2023 NortonLifeLock Inc. All rights reserved. NortonLifeLock, the NortonLifeLock Logo, the Checkmark Logo, Norton, LifeLock, and the LockMan Logo are trademarks or registered trademarks of NortonLifeLock Inc. or its affiliates in the United States and other countries.
Other names may be trademarks of their respective owners.