Jamie K Park, 541770 Harvest Landing Ln, Tracy, CA 95376

8176556, May 8, 2012

Oct 31, 2008

12/263128

Kamron Farrokh - Beverly Hills CA, US
Jamie Jooyoung Park - Los Angeles CA, US
Joseph Chen - Los Angeles CA, US

Symantec Corporation - Mountain View CA

H04L 29/06

726 23, 713188

A computer-implemented method for tracing attacks. The method may include identifying a first website and determining that the first website loads an attack remotely through a second website. The method may also include determining that the second website hosts the attack. The method may include performing a security action, such as blocking downloads from the second website, with respect to the second website. The attack may be a drive-by download. Corresponding systems and computer-readable media are also disclosed.

8490195, Jul 16, 2013

Dec 19, 2008

12/340125

Joseph H. Chen - Los Angeles CA, US
Jamie J. Park - Los Angeles CA, US

Symantec Corporation - Mountain View CA

G06F 12/14

726 24, 726 3, 726 12, 726 22, 726 27, 713194, 705 51

Method and apparatus for behavioral detection of malware in a computer system are described. In some embodiments, a request by a process executing on a computer to change time of a clock managed by the computer is detected. The process is identified as a potential threat. At least one attribute associated with the process is analyzed to determine a threat level. The request to change the time of the clock is blocked and the process is designated as a true positive threat if the threat level satisfies a threshold level.

8528090, Sep 3, 2013

Jul 2, 2010

12/830286

Joseph Chen - Los Angeles CA, US
Jamie Jooyoung Park - Los Angeles CA, US

Symantec Corporation - Mountain View CA

G06F 21/00

726 24

A computer-implemented method for creating customized confidence bands for use in malware detection may include 1) identifying a portal for receiving executable content, 2) identifying metadata relating to the portal, 3) analyzing the metadata to determine what risk executable content received via the portal poses, and then 4) creating, based on the analysis, a confidence band to apply during at least one disposition of executable content received via the portal. Various other methods, systems, and computer-readable media are also disclosed.

8099784, Jan 17, 2012

Feb 13, 2009

12/371501

Joseph Chen - Los Angeles CA, US
Jamie Jooyoung Park - Los Angeles CA, US

Symantec Corporation - Mountain View CA

G06F 11/00

726 23

To evade heuristic detection, malware is often designed to trick users into installing the malware by being packaged in a standard installer known to the user's computer for typically installing legitimate software. To prevent removal of the malware, the malware modifies or removes its uninstaller. A security module manages this type of evasion technique by monitoring and detecting installations performed on a computer. The module detects attempts to remove or modify the uninstaller for the application to render the uninstaller incapable of uninstalling the application. The module can intercept and block such attempts, and then analyze the application for malicious code. Where the application is determined to be malware, the module prevents malicious activity. The module can also use the malware's own uninstaller to uninstall the malware from the computer.