Royal Bank of Canada

Cathal Smyth

Yik Chau Lui

Amit Kumar Tiwari

Yanshuai Cao

Nariman Mammadli

Sahar Rahmani

Cory Fong

Vikash Yadav

Ramanpreet Singh

Dhanya Jothimani

Felix Kurmish

Jaspreet Sahota

Janahan Mathuran Ramanan

Yuanqiao Wu

Bijan Borzou

Payam Pakarha

Sylvester King Chun Chiang

Tung-Lin Wu

Zhengyi Qin

Ashkan Amiri

Mahsa Golkar

Niloufar Afsariardchi

James Ross

Bryce Croll

Laureline Arnaud

Venkata Sai Pavan Kumar Kosaraju

Athinthra Krishnaswamy Sethurajan

Lindsey Peng

Systems and methods for generating access entitlements to networked computing resources. Systems may be configured to: receive an input data set representing an entitlement request associated with a user identifier; generate an entitlement prediction associated with the user identifier based on an entitlement model and at least one hierarchical level, the entitlement model defining a cluster representation of entitlement similarity, and wherein the entitlement prediction is based on one or more similarity relationships corresponding to the at least one hierarchical level; and transmit a signal representing the entitlement prediction for granting downstream access to a networked computing resource.

System and method for electronic identity and access management

Methods, systems, and techniques for detecting a cybersecurity breach. The cybersecurity breach may be a synthetic account or an account having been subjected to an account takeover. Electronic account data representative of accounts is obtained in which a first group of the accounts includes accounts flagged as being associated with the breach, and a second group of the accounts includes a remainder of the accounts. The computer system generates from the account data nodes representing the accounts and edges based on account metadata that connect the nodes. The computer system determines, such as by applying a link analysis method to the nodes and edges, a ranking of the accounts of at least part of the second group indicative of a likelihood that those accounts are also associated with the cybersecurity breach. That ranking may be used to identify which of those accounts is also identified with the cybersecurity breach.

Method and system for detecting a cybersecurity breach

Methods, systems, and techniques for facilitating identification of electronic data exfiltration. A message transmission log and screenshot metadata are obtained. A screenshot corresponding to the screenshot metadata is matched to a sent electronic message, such as an email, having a file attachment represented in the message transmission log to generate an event. The screenshot metadata indicates that the screenshot was captured prior to when the message transmission log indicates the electronic message was sent. An anomaly score is determined for the sent electronic message is determined by applying unsupervised machine learning, such as by applying an isolation forest, to score the sent electronic message relative to a baseline. The anomaly score meeting or exceeding an anomaly threshold is treated as potentially being indicative of electronic data exfiltration.

Method and system for facilitating identification of electronic data exfiltration

A system receives transaction data over time, and creates structured data based on the received transaction data. Purchase transactions that are associated with a purchase category are identified in the structured data and labeled. A recurrent neural network such as a long short-term memory (LSTM) network, in particular, a k-LSTM architecture using weighted averages to update hidden states and cell states, is trained to build a model. The model is used to predict the likelihood of a purchase transaction.

K-LSTM architecture for purchase prediction

There is provided a neural network system for detection of domain generation algorithm generated domain names, the neural network system comprising: an input receiver configured for receiving domain names from one or more input sources; a convolutional neural network unit including one or more convolutional layers, the convolutional unit configured for receiving the input text and processing the input text through the one or more convolutional layers; a recurrent neural network unit including one or more long short term memory layers, the recurrent neural network unit configured to process the output from the convolutional neural network unit to perform pattern recognition; and a classification unit including one or more classification layers, the classification unit configured to receive output data from the recurrent neural network unit to perform a determination of whether the input text or portions of the input text are DGA-generated or benign domain names.

Systems and methods for cyberbot network detection

There is provided a neural network system for detection of malicious code, the neural network system comprising: an input receiver configured for receiving input text from one or more code input sources; a convolutional neural network unit including one or more convolutional layers, the convolutional unit configured for receiving the input text and processing the input text through the one or more convolutional layers; a recurrent neural network unit including one or more long short term memory layers, the recurrent neural network unit configured to process the output from the convolutional neural network unit to perform pattern recognition; and a classification unit including one or more classification layers, the classification unit configured to receive output data from the recurrent neural network unit to perform a determination of whether the input text or portions of the input text are malicious code or benign code.

Systems and methods for malicious code detection

Growing community of inventors

Toronto, Canada

Cathal Smyth