Microsoft Technology Licensing, LLC

Daniel L Mace

Yogesh Kant Roy

Seetharaman Harikrishnan

Ram Shankar Siva Kumar

Anisha Mazumder

Haijun Zhai

Craig Henry Wittenberg

Benjamin E Nick

Jugal Parikh

Richard P Lewis

Wing Kwong Wan

Leo Moreno Betthauser

William Blum

Edir Vinicio Garcia Lazo

Nicholas Becker

Amir Rubin

Eric Paul Douglas

Aditi Kamlesh Shah

Jeremias Eichelbaum

Nihal Irmak Pakis

Peter A Bryan

Arvindnarayanan Ravi

Mario Davis Goertzel

Jordan Wesley Rogers

Lloyd Geoffrey Greenwald

Manas George

In some examples, a method of generating a security report is provided. The method includes receiving a user query and security data, and providing the user query and security data to a semantic model. The semantic model generates one or more first embeddings. The method further includes receiving, from a data model, one or more second embeddings. The data model is generated based on historical threat intelligence data. The model further includes generating an execution plan based on the one or more first embeddings and the one or more second embeddings, and returning a report that corresponds to the execution plan.

Generating security reports

A computer-implemented method of generating a security language query from a user input query includes receiving, at a computer system, an input security hunting user query indicating a user intention; selecting, using a trained machine learning model and based on the input security hunting query, an example user security hunting query and corresponding example security language query; generating, using the trained machine learning model, query metadata from the input security hunting query; generating a prompt, the prompt comprising: the input security hunting user query; the selected example user security hunting query and the corresponding example security language query; and the generated query metadata; inputting the prompt to a large language model; receiving a security language query from the large language model corresponding to the input security hunting query reflective of the user intention.

Generating security language queries

Techniques are described herein that are capable of performing automatic graph-based detection of potential security threats. A Bayesian network is initialized using an association graph to establish connections among network nodes in the Bayesian network. The network nodes are grouped among clusters that correspond to respective intents. Patterns in the Bayesian network are identified. At least one redundant connection, which is redundant with regard to one or more other connections, is removed from the patterns. Scores are assigned to the respective patterns in the Bayesian network, based on knowledge of historical patterns and historical security threats, such that each score indicates a likelihood of the respective pattern to indicate a security threat. An output graph is automatically generated. The output graph includes each pattern that has a score that is greater than or equal to a score threshold. Each pattern in the output graph represents a potential security threat.

Automatic graph-based detection of potential security threats

Provided herein are methods, systems, and computer program products for intelligent detection of multistage attacks which may arise in computer environments. Embodiments herein leverage adaptive graph-based machine-learning solutions that can incorporate rules as well as supervised learning for detecting multistage attacks. Multistage attacks and attack chains may be detected or identified by collecting data representing events, detections, and behaviors, determining relationships among various data, and analyzing the data and associated relationships. A graph of events, detections, and behaviors which are connected by edges representing relationships between nodes of the graph may be constructed and then subgraphs of the possibly enormous initial graph may be identified which represent likely attacks.

Intelligent system for detecting multistage attacks

The described technologies leverage a trained evaluation function to analyze an email message to determine if a password is included in the text of the email message. The text of the email message may be vectorized using a character lookup table including vector values for each ASCII character. The trained evaluation function analyzes the vectorized text to determine if a password is included in the text of the mail message. An email message found to include a password may be placed in a quarantine storage to at least temporality prevent the email message from being disseminated to a recipient.

Sensitive data detection in communication data

Growing community of inventors

Bellevue, WA, United States of America

Daniel L Mace