Emc IP Holding Company LLC

Emc Corporation

Rsa Security Inc.

Intel Corporation

Alex Zaslavsky

Marcelo Blatt

Anatoly Gendelev

Zohar Duchin

Alon Kaufman

Shay Amram

Salah E Machani

Liron Liptz

Lior Asher

Shachar Israeli

Kevin Bowers

Ido Zilberberg

Alma Zohar

Arkady Koganov

Alon Hazan

Carmit Sahar

Eyal Kolman

Yael Villa

Boris Kronrod

Alex Vaystikh

Oleg Freylafert

Naveen Sunkavally

Eliav Zipper

Guoying Luo

Zhou Li

Ereli Eran

Kineret Raviv

Ika Bar-Menachem

Martin Rosa

Uri Fleyder

Lior Ben-Porat

Leandro Diato

Daniel Hassan

Yariv Amar

Christina Tkachenko

Boris Gorelik

Victor Malchikov

Peleg Yiftachel

Luan Nguyen

Yafit Levi-Maor

Oren Karmi

Techniques are provided for generating performance improvement recommendations for machine learning models. One method comprises evaluating performance metrics for multiple implementations of a machine learning model; computing a performance score that aggregates the performance metrics for a given machine learning model implementation; and recommending a modification to the given machine learning model implementation based on the performance score by evaluating one or more performance metrics for the given implementation relative to at least one additional performance metric for the given implementation, wherein the recommended modification is based on a performance with the recommended modification for another implementation. A given performance metric may be weighted based on an expected improvement from modifying a factor related to the given performance metric. The recommended modification to the given machine learning model implementation may comprise an indication of the expected improvement for the modification.

Performance improvement recommendations for machine learning models

Techniques are provided for ground distance calculations using sanitized location data. One method comprises a service provider obtaining: (i) a geographic zone identifier of multiple predefined geographic zones of a first location of a user, and (ii) a first distance between the first location of the user and multiple reference points that define boundaries of the predefined geographic zones; the service provider obtaining: (i) a geographic zone identifier of the multiple predefined geographic zones of a second location of the user, and (ii) a second distance between the first location of the user and the multiple reference points; and computing a ground distance between the first location and the second location by selecting a subset of the multiple reference points based at least in part on the relative geographic zones of the current and second locations. The user may: (i) estimate the first location and calculate the first distance; and/or (ii) compute the first and second distances.

Ground distance determination using zone-based location data

Techniques are provided for community-based anomaly detection policy sharing among organizations. One method comprises obtaining a cluster of organizations derived from clustering multiple organizations based on predefined clustering parameters; obtaining multiple policies from the organizations in the cluster; selecting one of the obtained plurality of policies based on a predefined policy sharing criteria; and sharing the selected policy with one or more of the organizations in the cluster. A use of the selected policy by one or more of the organizations may be simulated to evaluate a performance of the selected policy. The selected policy may be normalized and/or abstracted prior to being shared with organizations in the cluster. A given policy obtained from the organizations in the cluster may be weighted based on an influence rating of one or more source organizations that provided the given policy.

Community-based anomaly detection policy sharing among organizations

Techniques are provided for selecting attributes to cluster users for a user application entitlement evaluation. An exemplary method comprises obtaining enterprise reference data indicating a plurality of attributes for a plurality of enterprise users; obtaining enterprise entitlement data indicating user application entitlements for the plurality of enterprise users; selecting at least one of the plurality of attributes as a cluster attribute using predefined information content rules applied on the enterprise entitlement data; determining a probability of a user application entitlement for the one or more user application entitlements based on a number of users for a plurality of values of the cluster attribute and a number of users for a plurality of pairs of the cluster attribute and a value of the one or more user application entitlements; and identifying anomalies in the enterprise entitlement data based on the probability of the user application entitlement for at least one user application entitlement and at least one predefined anomaly threshold.

Data-driven attribute selection for user application entitlement analysis

Techniques are provided for user behavior analytics using keystroke analysis of pseudo-random data strings. One method comprises obtaining timestamps corresponding to keystroke activities on a device of a user associated with typing a pseudo-random character string comprising multiple characters, wherein at least one timestamp is adjusted based on errors associated with the typing of the pseudo-random character string; determining a time difference between keystroke activities associated with the pseudo-random character string using at least one adjusted timestamp; obtaining a time difference distribution for a subset of character sequences in the pseudo-random character string; determining a probability value for one or more character sequences in the subset; and determining an aggregate probability value for the pseudo-random character string based on the probability values. An authentication and/or an identity verification of the user can be based on the aggregate probability value for the pseudo-random character string.

User behavior analytics using keystroke analysis of pseudo-random character strings

Techniques are provided for authenticating a user using an endpoint device of the user with a local policy and endpoint data. One method comprises obtaining, at an endpoint device of a given user, behavioral anomalies from a remote engine that generates the behavioral anomalies based on behavior of multiple users; in response to an access request by the given user, performing the following steps at the endpoint device: obtaining authentication data related to the given user and/or the endpoint device; generating features based on the authentication data; applying the features to a behavior model incorporating the behavioral anomalies to determine a behavior score for the access request; and evaluating the access request to make an authentication decision based on the behavior score. The behavior score indicates, for example, a confidence that the given user is an expected user and/or a same user who has previously been validated.

User authentication by endpoint device using local policy engine and endpoint data

Techniques are provided for visualizing user access data and for configuring and enforcing location-based access policies. One method comprises obtaining a plurality of risk-based policies specified by administrators using a map-based interface for multiple geographic regions, wherein the map-based interface comprises one or more zoom levels within each geographic region of the geographic regions, and wherein each geographic region has an associated aggregated risk score indicating a level of risk for user access events that occurred within the respective geographic region; and performing the following steps, in response to a user access event: determining a geolocation of the user access event; identifying a particular geographic region associated with the determined geolocation; identifying one or more of the plurality of risk-based policies associated with the particular geographic region; and processing the user access event based on the identified risk-based policies associated with the particular geographic region.

Map-based techniques for visualizing user access data and for configuring and enforcing location-based access policies

Techniques are provided for generating adaptive policies from organization data for detection of risk-related events. One method comprises obtaining features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises a discrete value of the given feature or a range of values for the given feature; obtaining a probability of occurrence associated with each data value based on the organization data; identifying a plurality of candidate anomalous data values based on the probabilities of occurrence; determining an intervention rate for a plurality of combinations of the candidate anomalous data values; and generating policies for the organization using the combinations of candidate anomalous data values based on a corresponding intervention rate. The generated policies are used to detect one or more risk-related events.

Automated generation of adaptive policies from organizational data for detection of risk-related events

A method involves performing a mathematical estimation operation identifying a risk score threshold. The operation identifies the risk score threshold as a point on a curve rather than a value of a particular risk score. Such a curve approximates the distribution of risk score values output over a time interval and represents a function embodied by a plot of risk score percentile vs. risk score value. The risk engine, rather than selecting a particular risk score, selects a curve from a family of curves that is known to accurately represent such risk score distributions. For example, the risk engine may choose the curve that provides the best fit to the previous week's risk scores over the family of curves. The risk engine identifies the risk score threshold by finding a risk score value such that the function evaluated at that risk score value produces a specified risk score percentile.

Authenticating users in the presence of small transaction volumes

Techniques are provided for evaluating anomaly detection algorithms using impersonation data derived from user transaction data. An exemplary method comprises obtaining transaction data of a given enterprise organization comprising transactions of a plurality of users; generating impersonation data by modifying one or more features of a subset of the transaction data of the given enterprise organization; classifying (i) at least a portion of the transaction data of the given enterprise organization, and (ii) at least a portion of the impersonation data using the anomaly detection algorithm of the given enterprise organization, wherein records of the impersonation data comprise a known classification; and evaluating a performance of the anomaly detection algorithm of the given enterprise organization by comparing the classification of records of the impersonation data by the anomaly detection algorithm with the known classification.

Evaluation of anomaly detection algorithms using impersonation data derived from user data

Techniques of risk-based authentication involve adjusting a risk engine used by a recipient entity based on feedback acquired from multiple entities. Along these lines, both a recipient risk engine and one or more donor risk engines perform risk-based authentication for which respective feedback is generated. The feedback indicates whether certain transaction requests predicted to be fraudulent are confirmed to be fraudulent. The recipient risk engine is then adjusted based on the feedback created for itself, the feedback created for any of the donor risk engines, or some combination thereof.

Maintaining a risk model using feedback directed to other risk models

There are disclosed herein a technique for use in security. In at least one embodiment, the technique comprises receiving information relating to users and performing an affinity propagation clustering operation in connection with the information to identify a cluster of similar users. Further, the technique determines a risk in connection with a user in the cluster by comparing the user to one or more other users in the cluster. Still further, based on the risk in connection with the user, the technique controls access by the user to a computerized resource.

Method, apparatus and computer program product for providing security via user clustering

An improved technique involves generating, from historical transaction data, a relational graph that represents connections between users who initiate transactions and transaction devices used to carry out the transactions. By supplementing traditional relational database models with a tool such as a graph database, a risk analysis server is able to express users and transaction devices as nodes in a graph and the connections between them as edges in the graph. The risk analysis server may then match the topology of the graph in a neighborhood of the user initiating the transaction to a known topology that is linked to an indication of risk. In some arrangements, this topology is an input into a risk model used to compute a risk score for adaptive authentication.

Network neighborhood topology as a predictor for fraud and anomaly detection

Techniques are provided for determining anomaly scores for transactions based on adaptive clustering of the location of a given user over multiple transactions. In one embodiment, a method comprises obtaining transaction data for a given computer transaction by a user; extracting one or more location features from the transaction data for the given computer transaction; determining a user location of the given computer transaction based on the one or more location features; assigning the given computer transaction to one user location cluster of a plurality of user location clusters of the user based on a distance between the user location and centroids of each of the plurality of user location clusters, when the determined user location satisfies one or more predefined distance criteria; determining an anomaly score for the given computer transaction based at least in part on a centroid location of the assigned user location cluster; and updating the centroid location of the assigned user location cluster based on the user location.

Anomaly score generation based on adaptive clustering of user location

Clustering is provided of computer security attacks by the threat actor based on features of the attacks. Attack data is obtained for a given attack and a plurality of features of the given attack are extracted from a plurality of attack attributes. A feature-based score is computed for the given attack based on the extracted features relative to each of a plurality of attack clusters. Each attack cluster is comprised of a plurality of attacks performed by a particular attacker. The given computer security attack is assigned to a particular attack cluster if the feature-based score for the particular attack satisfies a predefined score criteria.

Clustering computer security attacks by threat actor based on attack features

Growing community of inventors

Petah Tiqwa, Israel

Alex Zaslavsky