元の名称記録: Acronis International GmbH

Systems and methods for dynamic software updating without update points. Software objects are updated at any moment during execution. Updating of object state (“upgrade”) is asynchronous with the update process. Delayed synchronization of state allows for control over timing and extent of state transitions.

Systems and methods for ransomware protection in advanced injection-based attacks. Events from a driver are analyzed to identify a potentially malicious actor. A confidence level is calculated for the potentially malicious actor identification to weigh the probability that the actor is malware or a source of malware. Behavior associated with the potentially malicious actor can be collected, if it is likely that the potentially malicious actor is associated with malware, such as if the confidence level is over a predetermined threshold. Subsequently, one or more virtual honeypots are generated for the suspicious processes and the response to the virtual honeypots is included in anti-ransomware heuristic analysis.

Systems and methods for adaptive threat detection system configuration based on advanced environmental security ranking. A method includes real-time adjustment of system components, including EDR agents, event scoring units, and event enrichment units, in response to changing threat landscapes and network environments. A method further includes retraining machine learning models, controlling thresholds, and selecting event datasets for training and testing. Additionally, a system configuration manager dynamically adjusts detection engine parameters, including correlation levels, rule-based detector settings, and the depth of analysis.

Systems and methods for advanced event ranking and correlation for threat detection. A method includes real-time processing of events with stateful threat detection, combining immediate detection capabilities with sophisticated threat analysis. A method further includes multi-stage processing in a detection engine, where generic events from endpoint detection and response (EDR) agents are scored and enriched to provide extended context based on machine learning models for event scoring, enriched events correlation, and applying security rules to detect threats.