Mcafee, Inc.

Gerard Donal Murphy

Sorcha Bairbre Healy

Steven L Grobman

Niall Fitzgerald

Cedric Cochin

Jonathan B King

David McCormack

Sandeep Thakur

Brian Gaither

Niamh Minihane

Catherine Costigan

Jillian Anne Daly

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor circuit and a memory circuit; first means for accessing a machine learning engine; second means for accessing a user interface; and instructions encoded within the memory to instruct the processor to: load into the machine learning engine via the first means an object prevalence model, including an enterprise-specific prevalence model; provide to the machine learning engine an object set from the enterprise; identify an enterprise-novel object from the object set; solicit and receive via the second means user-sourced feedback for the enterprise-novel object; and act according to the user-sourced feedback.

User-sourced object reputations

Methods, apparatus, systems, and articles of manufacture to provide and monitor efficacy of artificial intelligence models are disclosed. An example apparatus includes a model trainer to train an artificial intelligence (AI) model to classify malware using first training data; an interface to deploy the AI model to a processing device; a model implementor to locally apply second training data to the AI model to generate output classifications, the second training data generated after generation of the first training data; and a report generator to generate a report including an efficacy of the AI model based on the output classifications.

Methods and apparatus to provide and monitor efficacy of artificial intelligence models

There is disclosed in one example a computing apparatus, including: a processor and a memory; a data store having stored thereon trained models Mand M, wherein model Mincludes a clustering model of proximity and prevalence of a first body of computing objects, and Mincludes a clustering model of proximity and prevalence of a second body of computing object; and instructions encoded within the memory to instruct the processor to: receive an object under analysis; apply a machine learning model to compute a global variance score between the object under analysis and M; apply the machine learning model to compute an enterprise variance score between the object under analysis and M; compute from the global variance score and the enterprise variance score a cross-sectional variance score; and assign the object under analysis an analysis priority according to the cross-sectional variance score.

Analysis priority of objects from cross-sectional variance

There is disclosed in one example a computer-implemented method of detecting a statistically-significant security event and automating a response thereto, including: querying, or causing to be queried, a security intelligence database for sector-wise historical norms for an indicator of compromise (IoC); obtaining sector-wise expected prevalence data for the IoC; receiving observed sector-wise prevalence data for the IoC; computing a first test statistic from a goodness-of-fit test between the observed and expected prevalences; from the observed sector-wise prevalence data, computing a second test statistic from a difference between a highest prevalence and a next-highest prevalence; computing a third test statistic from a difference between the observed prevalence of a highest prevalence sector and the expected prevalence for the highest prevalence sector; selecting a least significant statistic from among the first, second, and third test statistics; and determining from the least significant statistic whether to notify a subscriber.

Skewness in indicators of compromise

Growing community of inventors

County Cork, Ireland

Gerard Donal Murphy