Vmware, Inc.

Debessay Fesehaye Kassa

Zhen Mo

Lenin Singaravelu

Vijay Ganti

Amitabha Banerjee

Ruijin Zhou

Barak Raz

Xiaobo Huang

Honglei Li

Patrick Charles Upatham

A method of generating relevant security rules for a user includes the steps of: building a first tree data structure from paths within a pool of security rules; collecting process paths for the user; and compiling the relevant security rules for the user by traversing the first tree data structure according to the process paths of the user.

System and method for matching, grouping and recommending computer security rules

The disclosure provides an approach for detecting and preventing attacks in a network. Embodiments include determining a plurality of network behaviors of a process by monitoring the process. Embodiments include generating a plurality of intended states for the process based on subsets of the plurality of network behaviors. Embodiments include determining a plurality of intended state clusters by applying a clustering technique to the plurality of intended states. Embodiments include determining a state of the process. Embodiments include identifying a given cluster of the plurality of intended state clusters that corresponds to the state of the process. Embodiments include selecting a novelty detection technique based on a size of the given cluster. Embodiments include using the novelty detection technique to determine, based on the given cluster and the state of the process, whether to generate a security alert for the process.

Hierarchical novelty detection using intended states for network security

Certain embodiments described herein are generally directed to improving performance of one or more machines within a system by clustering multidimensional datasets relating to the performance of the machines using inter-group dissimilarities between groups of the dataset. The method for improving performance of one or more machines within a system, includes forming a multidimensional dataset having a plurality of groups using performance related data associated with one or more machines in the system, clustering the plurality of groups into one or more clusters based on intergroup dissimilarities between the plurality of groups, identifying one or more anomalous clusters from among the one or more clusters, identifying the one or more anomalous groups in the one or more anomalous clusters, and adjusting a configuration of the system to improve the performance of the one or more machines corresponding to the one or more anomalous groups.

Group clustering using inter-group dissimilarities

Growing community of inventors

Mountain View, CA, United States of America

Debessay Fesehaye Kassa