Qomplx, Inc.

Fractal Industries, Inc.

Andrew Sellers

Jason Crabtree

Richard Kelley

Ian MacLeod

Luka Jurukovski

Angadbir Singh Salaria

Randy Clayton

Michael James

Farooq Shaikh

Bhashit Parikh

Bharat Amin

Anant Borole

Joe Gray

Raveem Ismail

Farooq Israr Ahmed Shaikh

Marian Trnkus

Angad Salaria

Jeffrey Chung

Daniel Fricano

Paolo Angioletti

Alejandro Caceres

Tomas Fornara

John Uchiyama

Artem Panasenkov

Mike Chasman

Stuart Baurmann

Antony Pegg

Penelope Brooks

Shadrack Antwi

Sethan Arja

Nhan Tran

Rajat Gupta

A system for risk-based multi-factor authentication having a multi-dimensional time series data server configured to monitor and record a network's traffic data and to serve the traffic data to other modules and a directed computation graph module configured to receive network traffic data from the multi-dimensional time series data server, determine a network traffic baseline from the network traffic data, and determine a verification score needed before granting access based at least in part by the network traffic baseline. A plurality of verification methods build up a user's verification score to required level to gain access.

Risk-based multi-factor authentication

A system and method for a flexible, high-speed Managed Detection and Response platform that ingests, parses, normalizes, monitors, and correlates nearly any log source or security tool output. The MDR comprising of a declarative connector service that tags events with appropriate data source labels to facilitating data isolation, proper handling, and provenance across multiple customers and security products but otherwise aggregate alerts into a single data stream for consumption by the MDR SOC operators. A connector service further provides a programmatic (API-based) means to interchange data securely across environments. Event data is aggregated by the Managed Detection and Response platform that then utilizes enhanced log ingest capabilities to process the data allowing SOC operators to be able to write rules against the alerts.

System and method for aggregating and securing managed detection and response connection interfaces between multiple networked sources

A system and method for crowdsensing-based determination of risk management and contract validation, comprising at least a heterogeneous mixture of sensors and data-gathering techniques, a sensor fusion suite, and a business operating system, which ingests, transforms if necessary, and analyzes received data and develops and applies models of prediction of consequences of the sensor data and future events based on such data for purposes such as insurance liability and risk assessment, emergency services planning, and financial market predictions, and comparing historical models and data with current data and models to attempt to refine and utilize a more precise predictive model for these purposes.

System and method for model-based prediction using a distributed computational graph workflow

A system and methods for mitigating authentication ticket attacks within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by near-real-time comparison of hashes for each authentication object to previously-generated hashes.

Detecting KERBEROS ticket attacks within a domain

A system for corporate plan determination and validation employing an advanced decision platform comprises a data retrieval module configured to retrieve cooperative venture related data such as financial, operations and historical data related to the current cooperative plan. A predictive analytics module performs predictive risk functions on venture related data. A predictive simulation module performs predictive simulation functions on risk, operations, and financial data. An interactive display module displays the results of predictive analytics and predictive simulation according to pre-designated specifications of the analysts.

Intelligent automated planning system for large-scale operations

A system for programmatic and user interactive inclusion of time-series geospatial markers in analyses employing a cyber-decision platform has been developed comprising a module to retrieve an indexed geospatial image tiles and map overlay data corresponding to tiles. The system may attach a unique geo-hash label to each point of an indexed geospatial image tile based upon the point's geographical coordinates such that points in close proximity will have similar geo-hash values. A web application interface allows users to interactively retrieve and visualize indexed geospatial image tiles, add map overlays and create geo-hashes as desired.

Inclusion of time-series geospatial markers in analyses employing a cyber-decision platform

A system for fully integrated collection of business impacting data, analysis of that data and generation of both analysis driven business decisions and analysis driven simulations of alternate candidate business actions has been devised and reduced to practice. This business operating system may be used to monitor and predictively warn of events that impact the security of business infrastructure and may also be employed to monitor client-facing services supported by both software and hardware to alert in case of reduction or failure and also predict deficiency, service reduction or failure based on current event data.

System for automated capture and analysis of business information for security and client-facing infrastructure reliability

A system and method for cybersecurity reconnaissance, analysis, and scoring that uses distributed, cloud-based computing services to provide sufficient scalability for analysis of enterprise IT networks using only publicly available characterizations. The system and method comprise an in-memory associative array which manages a queue of vulnerability search tasks through a public-facing proxy network. The public-facing proxy network has search nodes configurable to present the network to search tools in a desired manner to control certain aspects of the search to obtain the desired results. A distributed data processing engine and cloud-based storage are used to provide scalable computing power and storage. Each of the cloud-based computing services is containerized and orchestrated for management and efficient scaling purposes.

Cybersecurity reconnaissance, analysis, and scoring using distributed systems

A system and method for collaborative cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and creates a virtual network space that provides a virtual reality environment for collaborative insights into network dynamics during a cyberattack. makes recommendations for cybersecurity improvements to networked systems based on a cost/benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a virtual network space model of the networked system created using a virtual network space manager. A simulation interaction server can facilitate secure sharing of virtual network spaces and simulations between and among various real and virtual actors to provide a collaborative space where one or more organization's network can be tested for resilience and mitigation. Recommendations are generated based on an analysis of the simulation results against a variety of cost/benefit indicators.

System and method for collaborative cybersecurity defensive strategy analysis utilizing virtual network spaces

A system for dynamic predictive analysis of data sets using an actor-driven distributed computational graph, wherein a pipeline orchestrator creates and manages individual data pipelines while providing data caching to enable interactions between specific activity actors within pipelines. Each pipeline then comprises a pipeline manager that creates and manages individual activity actors and directs operations within the pipeline while reporting back to the pipeline orchestrator.

Dynamic predictive analysis of data sets using an actor-driven distributed computational graph

Automatically computing and managing a cybersecurity risk score. The cybersecurity risk score and cyber-physical graph for a network are retrieved and analyzed to identify potential improvements that can be made to network topography and device configurations, changes are applied automatically and an updated cyber-physical graph reflecting the applied changes is produced, and the updated cyber-physical graph is reassessed to determine the effect of the changes that were applied.

Automatically computing and improving a cybersecurity risk score

A system and method for correlating network event anomalies to identify attack information, that identifies anomalous events within the network, identifies correlations between anomalies and other network events and resources, generates a behavior graph describing an attack pathway derived from the correlations, and determines an attack point of origin using the behavior graph.

Correlating network event anomalies using active and passive external reconnaissance to identify attack information

A system and method that detects and mitigates zero-day exploits and other vulnerabilities by analyzing event logs and external databases, forcing reauthentication of at-risk and comprised systems and accounts during an identified threat or potential security risk.

Event-triggered reauthentication of at-risk and compromised systems and accounts

A reconnaissance engine gathers data about a client's computer network from the client, from devices and systems on the client's network, and from the Internet regarding various aspects of cybersecurity. Each of these aspects is evaluated independently, weighted, and cross-referenced to generate a cybersecurity score by aggregating individual vulnerability and risk factors together to provide a comprehensive characterization of cybersecurity risk using a transparent and traceable methodology. The scoring system itself can be used as a state machine with the cybersecurity score acting as a feedback mechanism, in which a cybersecurity score can be set at a level appropriate for a given organization, and data from clients or groups of clients with more extensive reporting can be used to supplement data for clients or groups of clients with less extensive reporting to enhance cybersecurity analysis and scoring.

Growing community of inventors

Monument, CO, United States of America

Andrew Sellers