Microsoft Technology Licensing, LLC

Amir Rubin

Benjamin E Nick

Yogesh Kant Roy

Ram Shankar Siva Kumar

Jugal Parikh

Shay Kels

William Blum

Daniel L Mace

Yair Tsarfaty

Edir Vinicio Garcia Lazo

Arie Agranonik

Charles Edouard Elie Bettan

Itai Kollmann Dekel

Jeremias Eichelbaum

Nihal Irmak Pakis

Peter A Bryan

A computer-implemented method of generating a security language query from a user input query includes receiving, at a computer system, an input security hunting user query indicating a user intention; selecting, using a trained machine learning model and based on the input security hunting query, an example user security hunting query and corresponding example security language query; generating, using the trained machine learning model, query metadata from the input security hunting query; generating a prompt, the prompt comprising: the input security hunting user query; the selected example user security hunting query and the corresponding example security language query; and the generated query metadata; inputting the prompt to a large language model; receiving a security language query from the large language model corresponding to the input security hunting query reflective of the user intention.

Generating security language queries

Some embodiments help protect an organization against ransomware attacks by combining incrimination logics. An organizational-level incrimination logic helps detect alert spikes across many machines, which collectively indicate an attack. Graph-based incrimination logics help detect infestations of even a few machines, and local incrimination logics focus on protecting respective individual machines. Graph-based incrimination logics may compare monitored system graphs to known ransomware attack graphs. Graphs may have devices as nodes and device network connectivity, repeated files, repeated processes or actions, or other connections as edges. Statistical analyses and machine learning models may be employed as incrimination logics. Search logics may find additional incrimination candidates that would otherwise evade detection, based on files, processes, IP addresses, devices, accounts, or other computational entities previously incriminated. Incrimination engine results are forwarded to endpoint protection systems, intrusion protection systems, authentication controls, or other intervention mechanisms to enhance monitored system security.

Organization-level ransomware incrimination

Growing community of inventors

Vancouver, Canada

Amir Rubin