Microsoft Technology Licensing, LLC

Efim Hudis

Yair Helman

Uri Barash

David Steeves

Yigal Mordechai Edery

Gregory D Hartrell

Elad Ziklik

Lior Arzi

Joseph Malka

Royi Ronen

John Eugene Neystadt

Shai Rubin

Yosef Dinerstein

Gad Peleg

Nir Nice

Yuri Gurevich

Arie Friedman

Oleg Ananiev

John F Wohlfert

Surajit J Chaudhuri

Henricus Johannes Maria Meijer

Lev Novik

John Carlton Platt

Michael Todd Kramer

Pradeep Bahl

Kunal Mukerjee

Christopher Alan Hays

Mihai Costea

Arthur Zavalkovsky

Anil Francis Thomas

Khaja Ehteshamuddin Ahmed

Hani Hana Neuvirth

Tomer Weisberg

Rajesh K Dadhia

Daniel Alon

Edward Wilkins Hardy

Igal Figlin

Jeffrey S Williams

Yaron Zinar

Robert Eric Fitzgerald

Gilad Michael Elyashar

Alexandra Faynburd

Yifat Orlin

Ziv Rafalovich

Gal Novik

Meir Raviv

Gadi Peleg

David Faibish

Neta Haiby

Moshe Israel

Ram Haim Pliskin

Josef Weizman

Mark Wahl

Ben Kliger

Michael Zeev Bargury

Ron Jack Karidi

Yair Tor

Tomer Koren

Oren Yossef

Shay Kels

Steven Jay Lieberman

Jennifer Lemond

Gal Malka

Corina Feuerstein

Moshe Sapir

Tomer Brand

Christopher Eakins

Eyal Zangi

Yigal Edery

Ellen McDermott

Hani-Hana Neuvirth

Pnina Weiss

Jennifer R LeMond

Michal Braverman-Blumenstyk

Karl William Reinsch

John Neystadt

An automatic code analysis tool is disclosed. The automatic code analysis tool can automatically analyze an application code of a subject application and application-specific additional information of a resource used by the subject application. The automatic code analysis tool can implement a method to receive the application code for analysis. A determination is made as to how application-specific information from resources operably coupled to the application code is implemented via the application code. The determination is performed with an automatic analysis without running the application code.

Automated code analysis tool

A recommendation system for recommending a target feature value for a target feature for a target deployment is provided. The recommendation system, for each of a plurality of deployments, collects feature values for the features of that deployment. The recommendation system then generates a model for recommending a target feature value for the target feature based on the collected feature values of the features for the deployments. The recommendation system applies the model to the features of the target deployment to identify a target feature value for the target feature. The recommendation system then provides the identified target feature value as a recommendation for the target feature for the target deployment.

Automatic recommendations for deployments in a data center

A previously-unknown type of attack on a web application can be detected dynamically using server logs. An alert can be raised for an application that returns a valid response to the potential attacker (e.g., when an http (hypertext transfer protocol) status code of 200 is returned to the requestor). Server logs can be analyzed to identify an external computer that uses the same attack methodology on multiple targets. The external computer may attempt to access the same Uniform Resource Identifier (URI) on various web sites. In many cases, the http status code that is returned is an error code. Characteristics such as but not limited to fast crawling and numerous error status codes being returned to a particular requestor can be used by a machine learning (ML) system to identify potentially malicious external computing devices and/or vulnerable URIs.

Detecting attacks on web applications using server logs

Systems and methods for analyzing security alerts within an enterprise are provided. An enterprise graph is generated based on information such as operational intelligence regarding the enterprise. The enterprise graph identifies relationships between entities of the enterprise and a plurality of security alerts are produced by a plurality of security components of the enterprise. One or more significant relationships are identified between two or more of the plurality of security alerts based on a strength of a relationship identified in the enterprise graph. A significant relationship is utilized to identify a potential security incident between two or more of the security alerts.

Enterprise graph method of threat detection

An access configuration for an access control manager is generated. Access data including users, resources, and actions the users performed on the resources is received into a matrix. Clusters of the matrix are formed to produce ranges of the users and ranges of the resources having selected permission levels based on the actions. Administrator-modifiable security groups are created based on the ranges of users and administrator-modifiable resources groups based on the ranges of resources.

Access control manager

A method and a computing system for allowing just-in-time ('JIT') access to a machine is provided. A system receives a request to allow JIT access to the machine. The system directs a port of the machine to be opened for a JIT access period. The system also directs the machine to alter security relating to applications allowed to execute on the machine for the JIT access period. During the JIT access period, the machine can be accessed via the port with the altered security relating to applications. After the JIT access period, the system directs the port to be closed and directs the security to return to the unaltered security.

Altering application security to support just-in-time access

In one embodiment, datasets are stored in a catalog. The datasets are enriched by establishing relationships among the domains in different datasets. A user searches for relevant datasets by providing examples of the domains of interest. The system identifies datasets corresponding to the user-provided examples. The system them identifies connected subsets of the datasets that are directly linked or indirectly linked through other domains. The user provides known relationship examples to filter the connected subsets and to identify the connected subsets that are most relevant to the user's query. The selected connected subsets may be further analyzed by business intelligence/analytics to create pivot tables or to process the data.

Finding data in connected corpuses using examples

A malware analysis system for automating cause and effect analysis of malware infections is provided. The malware analysis system monitors and records computer system activities. Upon being informed of a suspected malware infection, the malware analysis system creates a time-bounded snapshot of the monitored activities that were conducted within a time frame prior to the notification of the suspected malware infection. The malware analysis system may also create a time-bounded snapshot of the monitored activities that are conducted within a time frame subsequent to the notification of the suspected malware infection. The malware analysis system provides the created snapshot or snapshots for further analysis.

Malicious code infection cause-and-effect analysis

A network security system employing multiple levels of processing to identify security threats. Multiple host machines may each contain an agent that detects possibilities of security threats based on raw data sensed locally at that host. The hosts may share information obtained from local analysis and each host may use information generated at one or more other hosts, in combination with information generated locally, to identify a security concern, indicating with greater certainty that a security threat exists. Based on security concerns generated by multiple hosts, a security threat may be to indicated and protective action may be taken.

Network intrusion detection with distributed correlation

The present invention extends to methods, systems, and computer program products for selecting candidate records for deduplication from a table. A table can be processed to compute an inverse index for each field of the table. A deduplication algorithm can traverse the inverse indices in accordance with a flexible user-defined policy to identify candidate records for deduplication. Both exact matches and approximate matches can be found.

Selecting candidate rows for deduplication

Systems, methods, and computer program products are described for controlling malicious activity detection with respect to information technology assets based on behavioral models associated with the respective information technology assets. Protection rules and corresponding sensitivities associated with the behavioral models are applied by protection services to detect malicious activity with respect to the information technology assets.

Controlling malicious activity detection using behavioral models

The subject disclosure relates to a knowledge-driven data quality solution that is based on a rich knowledge base. The data quality solution can provide continuous improvement and can be based on continuous (or on-going) knowledge acquisition. The data quality solution can be built once and can be reused for multiple data quality improvements, which can be for the same data or for similar data. The disclosed aspects are easy to use and focus on productivity and user experience. Further, the disclosed aspects are open and extendible and can be applied to cloud-based reference data (e.g., a third party data source) and/or user generated knowledge. According to some aspects, the disclosed aspects can be integrated with data integration services.

Domains for knowledge-based data quality solution

Disclosed herein is a system and method for automatically identifying potential malware files or benign files in files that are not known to be malware. Vector distances for select features of the files are compared to vectors both known malware files and benign files. Based on the distance measures a malware score is obtained for the unknown file. If the malware score exceeds a threshold a researcher may be notified of the potential malware, or the file may be automatically classified as malware if the score is significantly high.

Matrix factorization for automated malware detection

Growing community of inventors

Bellevue, WA, United States of America

Efim Hudis