Accenture Global Solutions Limited

Chien An Chen

Azzedine Benameur

Amin Hassanzadeh

Robin Lynn Burkett

Lei Ding

Nahid Farhady Ghalaty

Apoorv Krishak

Malek Ben Salem

Shaan Mulchandani

Implementations are directed to methods for detecting and identifying advanced persistent threats (APTs) in networks, including receiving first domain activity data from a first network domain and second domain activity data from a second network domain, including multiple alerts from the respective first and second network domains and where each alert of the multiple alerts results from one or more detected events in the respective first or second network domains. A classification determined for each alert of the multiple alerts with respect to a cyber kill chain. A dependency is then determined for each of one or more pairs of alerts and a graphical visualization of the multiple alerts is generated, where the graphical visualization includes multiple nodes and edges between the nodes, each node corresponding to the cyber kill chain and representing at least one alert, and each edge representing a dependency between alerts.

Detection of adversary lateral movement in multi-domain IIOT environments

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for container image vulnerability reduction. In one aspect, a method includes obtaining a first container image that is formed from a set of files, determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in a first container instantiated with the first container image, in response generating a second container image from the first particular file and not from the second particular file, and executing the application in a second container instantiated with the second container image.

Container image vulnerability reduction

A device processes, with a model, an application to identify a set of file paths with process identifiers. The device identifies patterns associated with the set of file paths with process identifiers, and determines positions of random elements in each file path of the set of file paths with process identifiers. The device processes the patterns and the positions of the random elements to train a machine learning model, and utilizes the machine learning model to generate a first set of rules to identify files required for execution of the application, and a second set of rules to identify files not required for execution of the application. The device generates a mandatory access control policy based on the first set of rules and the second set of rules, and provides the mandatory access control policy to be implemented by an operating system of a client device.

Utilizing heuristic and machine learning models to generate a mandatory access control policy for an application

Systems, methods, and apparatus, including computer programs encoded on computer storage media, for analyzing telemetry data from physical process sensors to detect anomalies within the physical process. A telemetry analytics system is disclosed as a process level anomaly detection system based on operational telemetrics and domain-specific knowledge that protects cyber physical system (CPS) devices against zero-day exploits not detectable through traditional system log or network packet inspection. The telemetry analytics system operates as a security component comparable to intrusion detection or anti-virus/anti-malware that generates alerts upon detecting anomalies in the sensor and/or activity data ingested from system or network data sources.

Growing community of inventors

Fairfax Station, VA, United States of America

Chien An Chen