Salesforce Com, Inc.

Steelcloud, LLC

Cem Gurkok

Arun Kumar Jagota

Christopher Day

Navin Kumar Ramineni

System receives inputs, each input associated with a label and having features, creates a rule for each feature, each rule including a feature and a label, each rule stored in a hierarchy, and distributes each rule into a partition associated with a label or another partition associated with another label. System identifies a number of inputs that include a feature for a rule in the rule partition, and identifies another number of inputs that include both the feature for the rule and another feature for another rule in the rule partition. System deletes the rule from the hierarchy if the ratio of the other number of inputs to the number of inputs satisfies a threshold and an additional number of inputs that includes the other antecedent feature is at least as much as the number. System predicts a label for an input including features by applying each remaining rule to the input.

Rule set induction

A system determines a first volume of out-calls of a first out-call type made by a software container that is executing an application during a time period. The system determines a second volume of out-calls of a second out-call type made by the software container. The system determines a first ratio of the first volume to a combined volume of out-calls of all out-call types made by the software container. The system determines a second ratio of the second volume to the combined volume of out-calls of all out-call types made by the software container. The system determines a measure by comparing the first ratio to a third ratio associated with the first out-call type, and by comparing the second ratio to a fourth ratio associated with the second out-call type. The system identifies any behavior or any application type associated with the application, based on the measure.

Software container modeling

An attempt by a user to login to a destination server is identified from a source server. A destination score is determined based on the count of attempts by the user to login to the destination server and the count of attempts by the user to login to all destination servers. A source given destination score is determined based on the count of attempts by the user to login from the source server to the destination server, and the count of attempts by the user to login to the destination server. An outlier score is determined based on values associated with the destination score and the source given destination score. An alert is output if the outlier score satisfies a threshold.

Intrusion detection based on login attempts

An information security auditing and incident investigation method can include applying a correlation template to query different audit targets in an enterprise system to provide a complete result set for the query across different audit targets, receiving audit data provided in response to the query and rendering the audit data to produce an audit report. The applying step can include distributing one or more distributed audit and response tools to each of the targets in the enterprise and communicating with the targets in the enterprise to acquire audit data from each of the targets. The receiving step can include organizing the audit data in a hierarchy, and recursively walking the hierarchy as a directed, cyclic graph noting memberships and paths. Finally, the rendering step can include generating a graphical visualization interface, disposing a real-time object browser within the interface, and further disposing a differential report in the interface.

Growing community of inventors

Coral Gables, FL, United States of America

Cem Gurkok