Emc Corporation

Exabeam, Inc.

Emc IP Holding Company LLC

Pivotal Software, Inc.

Derek Lin

Domingo Mihovilovic

Sylvain Gil

Barry Steiman

Jin Yu

ChunSheng Fang

Alon Kaufman

Yael Villa

Chunsheng Fang

Anirudh Kondaveeti

Qiaona Hu

Teng Wang

Yedidya Dotan

William Duane

Roy Hodgman

Jidong Chen

John G Linn

Hulya Emir-Farinas

Ben Wu

Ryan Foltz

Deepesh Chaudhary

Lubomir P Petrov

Baoming Tang

Sagy Volkov

Anying Li

Joseph A Zadeh

Yoon Jung Hong

The present disclosure relates to a system, method, and computer program for graph-based multi-stage attack detection in which alerts are graphically visualized in the context of tactics in an attack framework. The method enables the detection of cybersecurity threats that span multiple users and sessions and provides for the display of threat information in the context of a framework of attack tactics. Alerts spanning an analysis window are grouped into tactic blocks. Each tactic block is associated with an attack tactic and a time window. A graph is created of the tactic blocks, and threat scenarios are identified from independent clusters of directionally connected tactic blocks in the graph. The threat information is visualized graphically in the context of a sequence of attack tactics in the attack framework. A user can toggle between graphical visualizations of a cluster as a whole and the individual threat scenario paths in the cluster.

Graph-based multi-staged attack detection and visualization in the context of an attack framework

The present disclosure relates to a system, method, and computer program for graph-based multi-stage attack detection in which alerts are displayed in the context of tactics in an attack framework, such as the MITRE ATT&CK framework. The method enables the detection of cybersecurity threats that span multiple users and sessions and provides for the display of threat information in the context of a framework of attack tactics. Alerts spanning an analysis window are grouped into tactic blocks. Each tactic block is associated with an attack tactic and a time window. A graph is created of the tactic blocks, and threat scenarios are identified from independent clusters of directionally connected tactic blocks in the graph. The threat information is presented in the context of a sequence of attack tactics in the attack framework.

Graph-based multi-staged attack detection in the context of an attack framework

The present disclosure describes a system, method, and computer program for automatically classifying user accounts within an entity's computer network, using machine-based-learning modeling and keys from an identity management system. A system uses supervised machine learning to create a statistical model that maps individual keys or sets of keys to a probability of being associated with a first type of user account (e.g., a service account). To classify an unclassified user account, the system identifies identity management keys associated with the unclassified user account. The system creates an N-dimensional vector from the keys (where N=the number of keys), and uses the vector and the statistical model to calculate a probability that the unclassified user account is the first type of user account. In response to the probability exceeding a first threshold, the system classifies the unclassified user account as the first type of user account.

System, method, and computer program for automatically classifying user accounts in a computer network using keys from an identity management system

The present disclosure relates to a machine-learning system, method, and computer program for ranking security alerts from multiple sources. The system self-learns risk levels associated with alerts by calculating risk probabilities for the alerts based on characteristics of the alerts and historical alert data. In response to receiving a security alert from one of a plurality of alert-generation sources, the alert-ranking system evaluates the security alert with respect to a plurality of feature indicators. The system creates a feature vector for the security alert based on the feature indicator values identified for the alert. The system then calculates a probability that the security alert relates to a cybersecurity risk in the computer network based on the created feature vector and historical alert data in the network. The system ranks alerts from a plurality of different sources based on the calculated cybersecurity risk probabilities.

Ranking cybersecurity alerts from multiple sources using machine learning

The present disclosure describes a system, method, and computer program for detecting unmanaged and unauthorized assets on an IT network by identifying anomalously-named assets. A recurrent neural network (RNN) is trained to identify patterns in asset names in a network. The RNN learns the character distribution patterns of the names of all observed assets in the training data, effectively capturing the hidden naming structures followed by a majority of assets on the network. The RNN is then used to identify assets with names that deviate from the hidden naming structures. Specifically, the RNN is used to measure the reconstruction errors of input asset name strings. Asset names with high reconstruction errors are anomalous since they cannot be explained by learned naming structures. After filtering for attributes or circumstances that mitigate risk, such assets are associated with a higher cybersecurity risk.

Detecting unmanaged and unauthorized assets in an information technology network with a recurrent neural network that identifies anomalously-named assets

A cybersecurity system, method, and computer program is provided for detecting whether an entity's collection of processes during an interval is abnormal compared to the historical collection of processes observed for the entity during previous intervals of the same length. Logs from a training period are used to calculate global and local risk probabilities for each process based on the process's execution history during the training period. Risk probabilities may be computed using a Bayesian framework. For each entity in a network, an entity risk score is calculated by summing the applicable risk probabilities of the unique processes executed by the entity during an interval. An entity's historical risk scores form a score distribution. If an entity's current score is an outlier on the historical score distribution, an alert of potentially malicious behavior is generated with respect to the entity. Additional post-processing may be performed to reduce false positives.

Anomaly detection based on processes executed within a network

The present disclosure describes a self-learning system, method, and computer program for detecting cybersecurity threats in a computer network based on anomalous user behavior and multi-domain data. A computer system tracks user behavior during a user session across multiple data domains. For each domain observed in a user session, a domain risk is calculated. The user's session risk is then calculated as the weighted sum of the domain risks. A domain risk is based on individual event-level risk probabilities and a session-level risk probability from the domain. The individual event-level risk probabilities and a session-level risk probability for a domain are derived from user events of the domain during the session and are based on event-feature indicators and session-feature indicators for the domain.

Self-learning cybersecurity threat detection system, method, and computer program for multi-domain data

The present disclosure relates a system, method, and computer program for detecting anomalous user network activity based on multiple data sources. The system extracts user event data for n days from multiple data sources to create a baseline behavior model that reflects the user's daily volume and type of IT events. In creating the model, the system addresses data heterogeneity in multi-source logs by categorizing raw events into meta events. Thus, baseline behavior model captures the user's daily meta-event pattern and volume of IT meta events over n days. The model is created using a dimension reduction technique. The system detects any anomalous pattern and volume changes in a user's IT behavior on day n by comparing user meta-event activity on day n to the baseline behavior model. A score normalization scheme allows identification of a global threshold to flag current anomalous activity in the user population.

System, method, and computer program for detection of anomalous user network activity based on multiple data sources

The present disclosure describes a system, method, and computer program for determining the cybersecurity risk associated with a first-time access event in a computer network. In response to receiving an alert that a user has accessed a network entity for the first time, a user behavior analytics system uses a factorization machine to determine the affinity between the accessing user and the accessed entity. The affinity measure is based on the accessing user's historical access patterns in the network, as wells as context data for both the accessing user and the accessed entity. The affinity score for an access event may be used to filter first-time access alerts or weight first-time access alerts in performing a risk assessment of the accessing user's network activity. The result is that many false-positive first-time access alerts are suppressed and not factored (or not factored heavily) into cybersecurity risk assessments.

Behavior analytics system for determining the cybersecurity risk associated with first-time, user-to-entity access alerts

The present disclosure relates to a cybersecurity-monitoring system, method, and computer program for dynamically determining a rule's risk score based on the network and user for which the rule triggered. The methods described herein addresses score inflation problems associated with the fact that rules have different false positive rates in different networks and for different users, even within the same network. In response to a rule triggering, the system dynamically adjusts the default risk points associated with the triggered rule based on a per-rule and per-user probability that the rule triggered due to malicious behavior. In certain embodiments, network context is also a factor in customizing the risk points for a triggered rule.

Dynamic rule risk score determination in a cybersecurity monitoring system

The present disclosure describes a system, method, and computer program for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on said classifications. Machine-learning-based modeling is used to classify one or more types of monitored assets with a select user label. A data model is created that reflects monitored assets used by users associated with the select user label. Each a time a user with the select user label accesses an applicable type of monitored asset, the data model is updated to reflect the event. The data model is used to classify one or more monitored assets with the select user label. If a user without the select user label uses a monitored asset classified with the select user label, a potential misuse of the monitored asset is detected.

System, method, and computer program for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on the classifications

Techniques to detect backup-related anomalies are disclosed. In various embodiments, a processor is used to generate based at least in part on backup log data associated with a training period a predictive model. The predictive model is to detect, using the processor, anomalies in corresponding backup log data associated with a detection period.

Scalable predictive early warning system for data backup event log

The present disclosure describes a system, method, and computer program for identifying and classifying service accounts in a network based on account behavior. For each evaluated account in the network, a plurality of behavior indicators are calculated. The behavior indicators correspond to service account behaviors and, for each account, are calculated based on network events associated with the account. Each behavior indicator is compared to a threshold specific to the corresponding behavior. If one or more behavior indicators for an account satisfies the applicable threshold, the account is deemed to display service account behavior. Consistency in which an account displays service account behavior is factored into classifying accounts as service accounts.

Growing community of inventors

San Mateo, CA, United States of America

Derek Lin