Here Global B.v.

Armis Security Ltd.

Evgeny Luk-Zilberman

Gil Ben Zvi

Yuval Friedlander

Tom Hanetz

Ron Shoham

Avi Avidan

A system and method for malicious lateral movement detection. A method includes identifying atomic tunnels in packets sent between devices; identifying tunnel constructs; determining a potentially malicious atomic tunnel among the atomic tunnels by comparing edges of each of the atomic tunnels to edges of previously observed tunnel constructs; determining a potentially malicious tunnel including the potentially malicious atomic tunnel; and mitigating the potentially malicious tunnel. Each atomic tunnel is a structure representing communications among the devices defined with respect to at least three nodes and at least two edges. Each node represents a respective device, and each edge represents a connection between two of the devices. Each atomic tunnel has two hops, where each hop is a level of communication in which a packet is sent from one device to another device. Each tunnel construct is a structure including at least one of the atomic tunnels.

Malicious lateral movement detection using remote system protocols

A system and method for vulnerability detection. A method includes: tokenizing device attribute data for a device into at least one set of first tokens, wherein each of the first tokens is formatted according to a token schema; creating at least one device attribute string, each device attribute string including one of the first tokens; matching each of the at least one device attribute string to combinations of device attributes stored in a vulnerabilities database in order to identify at least one matching combination of device attributes for the device, wherein the vulnerabilities database stores mappings between combinations of device attributes and vulnerabilities, wherein each combination of device attributes in the vulnerabilities database includes second tokens formatted according to the token schema; detecting at least one vulnerability of the device based on the at least one matching combination of device attributes and the mappings in the vulnerabilities database.

System and method for detecting cybersecurity vulnerabilities via device attribute resolution

A system and method for detecting abnormal device traffic behavior. The method includes creating a baseline clustering model for a device based on a training data set including traffic data for the device, wherein the baseline clustering model includes a plurality of clusters, each cluster representing a discrete state and including a plurality of first data points of the training data set; sampling a plurality of second data points with respect to windows of time in order to create at least one sample, each sample including at least a portion of the plurality of second data points, wherein the plurality of second data points are related to traffic involving the device; and detecting anomalous traffic behavior of the device based on the at least one sample and the baseline clustering model.

System and method for detection of abnormal device traffic behavior

An approach is provided for generating synthetic image data for machine learning. The approach, for instance, involves determining, by a processor, a set of parameters for indicating an action by one or more objects. The action is a dynamic movement of the one or more objects through a geographic space over a period of time. The approach also involves processing the set of parameters to generate synthetic image data. The synthetic image data includes a computer-generated image sequence of the one or more objects performing the action in the geographic space over the period of time. The approach further involves automatically labeling the synthetic image data with at least one label representing the action, the set of parameters, or a combination thereof. The approach further involves providing the labeled synthetic image data for training or evaluating a machine learning model to detect the action.

Method, apparatus, and system for generating synthetic image data for machine learning

A system, a method, and a computer program product are provided for determining emergency data in a region. The system may include a processor configured to execute computer program code instructions stored in a memory to obtain live video data associated with the vehicle in the region and determine the emergency data of the vehicle from the live video data using a three-dimensional convolution neural network (3D-CNN) model. The live video data may include one or more video clips. The 3D-CNN model may include a plurality of convolution layers, a plurality of pooling layers, and a plurality of fully connected layers. The processor is further configured to generate an emergency notification based on the emergency data and providing the emergency notification to one or more subjects.

Growing community of inventors

Herzliya, Israel

Evgeny Luk-Zilberman