Check Point Software Technologies Ltd.

Erez Israel

Natan Katz

Lior Goldman

Dan Karpati

Eitan Shterenbaum

Dor Livne

Daniel Cohen-sason

Avner Duchovni

Dmitry Zinkevich

Amit Elhelo

Ofek Dadush

Arie Blumin

Eliya Moreinis Adar

Michael Abramzon

Ori Joseph

Yosef Ben Shlomo

A device and method for classifying network devices based on their manufacturer (also referred to as vendor or brand) and function (e.g., printer, car, thermostat, etc.). This classification process utilizes a trained model that leverages parameters associated with the device's network activity as input.

Network device classification

A device and method for employing a machine learning model using processor circuitry to intelligently predict user permissions within a network environment and output a restriction recommendation for modifying user permissions.

Network user permission prediction

Methods and devices are provided for differentiating between benign DNS data and malicious DNS data included in DNS traffic using an autoencoder. The autoencoder receives input DNS data and is trained to successfully encode the input DNS data when the input DNS data is benign DNS data and to fail to encode the input DNS data when the input DNS data is malicious DNS data. The autoencoder is trained using a modified loss function having a large weight when successfully encoding malicious DNS data.

DNS tunneling detection and prevention

A device, system, and method are provided for generating a network security policy automatically based on network traffic. The network security policy is generated by building a directional graph from the network traffic, with the nodes of the graph representing network end points, and the edges representing communication between two nodes on a communication channel. A feature vector is generated for each of the nodes and a graph neural network is applied to the feature vectors to generate output vectors. The output vectors are clustered using a cost function based on a weighted combination of a distance-based cost function and a network functionality cost function. The clusters generated from the output vectors are used to assign network security rules to each of the clusters.

Autonomous network policy generator

A method and system are provided for detecting malicious code using graph neural networks. A call graph is created from the computer code by identifying functions in the computer code and vectorizing the identified functions using a stream of application programming interfaces (APIs) called by the functions and using tokens generated for the functions using a byte pair tokenizer. A trained graph neural network (GNN) and a trained attention neural network are applied to the call graph to generate an output graph with each node representing a function and each node assigned weights based on a probability distribution of the maliciousness of the corresponding function. A graph embedding is generated by calculating a weighted sum of the assigned weights and a trained deep neural network is applied to the graph embedding to generate a malicious score for the computer code identifying the computer code as malicious or benign.

Malicious VBA detection using graph representation

Growing community of inventors

Tel Aviv, Israel

Erez Israel