Netskope, Inc.

Microsoft Technology Licensing, LLC

Normalyze, Inc.

Abhinav Singh

Himanshu Sharma

Ravishankar Ganesh Ithal

Nihar Niranjan Mehta

Mummoorthy Murugesan

Shu Zhang

Jie Xiao

Lihong Pei

Yanbo Ma

Rohan Rajiv

Rohan Koundal

Roberto Alexis Rodriguez

Kean Loong Tan

Yaolin Wang

Yuhao Zhang

Bharath S Kallur

The technology disclosed relates to a system and method for detecting risk events in cloud environment that obtains set of risk signature definitions and deploys an event log scanner to the cloud environment. The event log scanner is configured to detect instances of candidate risk events in accordance with the set of risk signature definitions based on a scan of event log and to label each detected instance with a signature identifier that identifies one or more risk signatures that corresponds to the detected instance. Result metadata is received indicative of the detected instances, based on the result metadata, context information associated with the detected instances is obtained based on cloud infrastructure graph. An output is generated representing a classification of one or more of the detected instances of candidate risk events as a risk event based on the context information relative to the set of risk signature definitions.

Risk event detection using activity and graph-based context for cloud data security posture management

The disclosed technology teaches reducing threat detection processing by applying similarity measures. The method includes recognizing that a file is an edited version of a previously processed file and retrieving, from an archive, at least an entropy measure of the previously processed file, and calculating an entropy measure for the edited version of the file. The method applies a similarity measure to compare the entropy measures for the edited version and the previously processed file, avoiding full threat scanning of the file to detect malware except when the similarity measure reaches a scanning trigger. When any similarity measure or combination of similarity measures reaches a trigger, the technology teaches processing the file by using a threat detection module to detect malware. Further included is logging the edited version of the file for further processing when the similarity measure reaches a logging trigger.

Reducing threat detection processing by applying similarity measures to entropy measures of files

The disclosed technology teaches reducing threat detection processing, including recognizing that a file is an edited version of a previously processed file and retrieving, from an archive, metadata values, hashes for property groups and an entropy measure of the previously processed file. Also included is parsing the file into metadata values and property groups and calculating hashes of the property groups and entropy measure for the file. The method further includes applying similarity measures to compare the metadata values, the entropy measures, and the hashes on the property groups, for the edited version and the previously processed file. When any similarity measure or combination of similarity measures reaches a trigger, the technology teaches processing the file by using a threat detection module to detect malware. Property groups include core properties, application properties, document content and programming scripts for the edited version of the file and the previously processed file.

Efficient scanning for threat detection using in-doc markers

Techniques for optimizing network-transferred multi-card content items are provided. In one technique, a first content item selection event is initiated that involves a set of content delivery campaigns that includes a content delivery campaign that includes a content item that comprises multiple cards. The content delivery campaign is selected and the content item is transmitted to a first computing device, where the multiple cards have a first card configuration. One or more events that are associated with the first computing device displaying at least one card of the plurality of cards is identified. Based on the events, a second card configuration is determined. Another content item selection event that involves the content delivery campaign is initiated and the content delivery campaign is selected. The content item is transmitted to a second computing device, where the multiple cards have the second card configuration.

Optimization of network-transferred multi-card content items

Growing community of inventors

Sunnyvale, CA, United States of America

Abhinav Singh