Ben-Gurion University of the Negev Research and Development Authority

Deutschetelekom Ag

Nec Corporation

B.g. Negev Technologies and Applications Ltd.

Other

Verint Systems, Inc.

Nec Corporation of America

Asaf Shabtai

Yuval Elovici

Rami Puzis

Ron Bitton

Masaki Inokuchi

Yoshinobu Ohta

Yisroel Avraham Mirsky

Lior Rokach

Ziv Katzir

Liran Orevi

David Mimran

Genady Malinsky

Orly Stan

Yoshiyuki Yamada

Barak Chizi

Tobias Martin

Christoph Peylo

Dudu Mimran

Alexandra Mikityuk

Asaf Nadler

Gil Tahan

Gilad Katz

Naor Kalbo

Oleg Brodt

Manuel Kamp

Dvir Cohen

Yoni Birman

Ziv Ido

Tomer Gluck

Mehran Roshandel

Tobias Glemser

Barak Zacharish

Idan Habler

Masayuki Nakae

Gil Tachan

Amir Harel

Ma'ayan Gafny

Genady Malinksy

Yechiav Yzhak

Shimon Silberschlag

Sidik Bronislav

Puzis Rami

Sheremet Yaroslav

Lior Sidi

Yizhak Vaisman

Viktoria Anna Laufer

Guy Amit

Shay Alexander Geller

Ming Yin

Heiko Lehman

An optimized limited-area WiFi network includes a plurality of Internet connectable devices, a wireless router for facilitating Internet connectivity, and a dynamically positionable signal coverage enhancer configured with an onboard processor, a signal coverage enhancing element, and mobile means. The signal coverage enhancer is repositionable, by the mobile means in response to a command signal transmitted by the processor, to a determined location of the limited-area WiFi network that is sufficiently close to one or more of the devices, such that an amplified signal produced by the signal coverage enhancing element which amplifies a wireless signal transmitted by the router maintains uninterrupted Internet operation of the to one or more devices.

Optimized WiFi network

An information collection system includes: a side-channel information processing unit that derives load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data; an allow list generation unit that generates an allow list including a scan timing and a scan range in which the availability is not affected, the allow list generation unit generating the allow list based on the load information; and an allow list storage unit that stores the allow list. An active scan of the target machine is executed by referencing the allow list stored in the allow list storage unit to collect asset information of the target machine.

Information collection system, information collection method, medium, and information collection program

A security assessment system is configured to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components. The security assessment system includes a duplicated environment design circuitry and a duplicated environment construction circuitry. The duplicated environment design circuitry is configured to select a duplication level based on constraints specified by a user in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design. The duplication level is indicative of any one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system. The duplicated environment construction circuitry is configured to construct the duplicated environment based on the designed result. The duplicated environment includes components which are duplicated by one of the duplication level.

Security assessment system

A security assessment system is configured to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components. The security assessment system includes a duplicated environment design circuitry and a duplicated environment construction circuitry. The duplicated environment design circuitry is configured to select a duplication level based on constraints specified by a user and effects associated with the physical components in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design. The duplication level is indicative of any one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system. The duplicated environment construction circuitry is configured to construct the duplicated environment based on the designed result. The duplicated environment includes components which are duplicated by one of the duplication level.

A system for analyzing and clustering darknet traffic streams with word embeddings, comprising a data processing module which collects packets that are sent to non-existing IP addresses that belong to darknet's taps (blackholes) that are deployed over the internet: a port embedding module for performing port sequence embeddings by using a word embedding algorithm on the port sequences extracted from the data processing module while transforming the port sequences into a meaningful numerical feature vectors: a clustering module for performing temporal clustering of the feature vectors over time; and an alert logic and visualization module visualizes the data and provides alerts regarding a cluster that an analyst classified as malicious in the past.

Method and system for clustering darknet traffic streams with word embeddings

A master-slave scheduling system, comprising (a) a master DRL unit comprising: (i) a queue containing a plurality of item-representations; (ii) a master policy module configured to select a single item-representation from the queue and submit to the slave unit; (iii) a master DRL agent configured to (a) train the master policy module; and (b) receive an updated item-representation from the slave unit, and update the queue; (b) The slave DRL unit comprising: (i) a slave policy module receiving a single item-representation, selecting a single task entry and submitting to a slave environment for performance; (ii) a slave DRL agent configured to: (a) train the slave policy module; (b) receive an item-representation from the master DRL unit, and submit to the slave policy module; (c) receive an updated item-representation from the slave's environment, and submit the same to the master DRL unit; and (iii) the slave DRL agent.

Multi-objective scheduling system and method

Described embodiments include a system that includes a monitoring agent, configured to automatically monitor usage of a computing device by a user, and a processor. The processor is configured to compute, based on the monitoring, a score indicative of a cyber-security awareness of the user, and to generate an output indicative of the score.

System and method for assessing cybersecurity awareness

Systems and methods are provided for detecting anomalous messages on a multipoint serial communications bus by extracting features from a first and a second message, including a time delay between the first and the second messages and, for each message, a sender address, a recipient address, a bus number, and a word count. A message transition pattern including the extracted features is generated. A probability of occurrence of the message transition pattern is determined by comparing the message transition pattern to a pattern dictionary, and the second message is determined to be anomalous when the probability is less than a predetermined threshold.

Echo detection of Man-in-the-Middle LAN attacks

A method of monitoring network traffic in a communication network with a sentinel module to detect malicious activity is described. A gateway sentinel module receives network traffic directed through a gateway installed for a local distribution of the network, the gateway connecting the local distribution of the network to a core of the network. Malicious activity in the local distribution is detected based on a combination of: a local machine-learning model for identifying malicious activity in the local distribution, the local machine-learning model modelling network traffic from the local distribution; and a global machine-learning model. The global machine-learning model models network traffic from a plurality of local distributions of the network based training data from a plurality of local sentinel modules executed on a respective plurality of computing nodes. The computing nodes respectively receive network traffic from the plurality of location distributions. A corresponding device and system are also described.

Detection of malicious network activity

A method for detecting anomalous ADS-B messages in airplanes and air-traffic control system, comprising: extracting features from application level data, which is information broadcasted in said ADS-B messages, contextual data and flight plans; analyzing said extracted features and computing relative measures of a flight based on said extracted features; training a machine learning model to represent a benign ADS-B messages; applying said machine learning model on said extracted features thereby deriving a reputation score for said ADS-B message; issuing a decision based on said score, thereby recognizing an attack and issuing an alarm regarded said recognized attack.

Using LSTM encoder-decoder algorithm for detecting anomalous ADS-B messages

The present invention relates to a method and a framework that automatically and dynamically derives a misuseability score for every IT component (e.g., PC, laptop, server, router, smartphone, and user or any other element that can be connected to organization network or to the internet). The dynamic framework of the present invention supports the risk analysis process. The misuseability score encapsulates the potential damage that can be caused to the organization in case that an asset is compromised and misused, for example, as part of a cyber-attack.

Misuseability analysis for it infrastructure

A device for protecting a network environment from cyber security threats includes a processing unit and a non-transitory memory having processor-executable instructions stored thereon. The processing unit is configured to execute the processor-executable instructions to: (a) perform one or more auditing stages for examining and analyzing network devices by retrieving information, via a network adapter, from each of the network devices, so as to enable automatically monitoring, scanning and learning the network environment and its security configurations; (b) generate a cyber-security check report that reflects the results of the one or more auditing stages; and (c) give recommendations according to the report in order to increase a security level of the network.

Platform for protecting small and medium enterprises from cyber security threats

The invention is a method and system for detecting attackers that are interested in attacking an organization's infrastructure during the reconnaissance phase of an Advanced Persistent Threat (APT). APTs are very sophisticated attacks and incorporate advanced methods for evading current security mechanisms. Therefore, the present invention uses an innovative social network honeypot.

Social network honeypot

Method for the automatic generation of malware signatures from computer files. A common function library (CFL) created, wherein the CFL contains any functions identified as a part of the standard computer language used to write computer files which are known as not containing malware. The functions of a computer file which does contain a malware are extracted and the CFL is updated with any new common functions if necessary, such that the remaining functions are all considered as candidates for generating the malware signature. The remaining functions are divided into clusters according to their location in the file and the optimal cluster for generating the malware signature is determined. One or more of the functions in the optimal cluster is selected randomly, as the malware signature.

Automatic extraction of signatures for malware

Growing community of inventors

Hulda, Israel

Asaf Shabtai