Imperva, Inc.

Intuit, Inc.

Deutschetelekom Ag

Guy Shtar

Shiri Margel

Itsik Mantin

Itay Margolin

Lior Rokach

Itsik Yizhak Mantin

Bracha Shapira

Yury Geiler

Henry Venturelli

Tsofit Efroni Zazon

Ron Bitton

Andrei Roskach

Yoni Rabin

Jonathan Rabin

Yael Mathov Gome

Idan Habler

Barak Chizi

A method including extracting a number of page features from a web page. The number of page features represent an executable logic of the web page. The method also includes embedding, by a page feature embedding model, the number of page features to generate a page vector data structure. The method also includes comparing, by a comparison model, the page vector data structure and a number of script vector data structures to identify a selected script. Each of the number of script vector data structures is generated by a script feature embedding model processing computer executable program code of a corresponding script for performing a computer function on a web page. The method also includes presenting the selected script.

Model ensemble for matching nearest script to a new script page

A method includes receiving, at a server from a user device, a user prompt segment to a large language model (LLM), obtaining an additional prompt segment from a prompt data source, identifying a electronic address in the prompt segment, replacing the electronic address with a placeholder to generate a updated prompt segment, generating a LLM prompt comprising the updated prompt segment and the user prompt segment, and sending the LLM prompt to the LLM. The method further includes receiving a response to the LLM prompt from the LLM, the response comprising the placeholder, replacing the placeholder with the electronic address to generate an updated response, and sending the updated response to the user device.

Malicious prompt management for large language models

Aspects of the present disclosure relate to dynamic token screening and enhanced response generation using machine learning models. Embodiments include determining, by a machine learning model, a baseline attention weight for each token of a plurality of tokens contained in a text string received as an input to the machine learning model. Embodiments include identifying one or more protected tokens of the plurality of tokens contained in the text string and generating a dropout probability for each protected token of the one or more protected tokens. Embodiments include determining, by the machine learning model, a revised attention weight for each token of the plurality of tokens based on the dropout probability for each protected token. Embodiments include generating, by the machine learning model, an output based on the text string and the revised attention weight for each token. Embodiments include providing the output in response to the input.

Machine learning model dynamic token screening and enhanced response generation

At least one processor may receive at least one document and generate at least one respective summary of each respective at least one document, the generating comprising omitting information originally included in the at least one document that is irrelevant to a computing task. The at least one processor may generate at least one respective embedding of each at least one respective summary and a retrieval augmented generation (RAG) database comprising the at least one respective embedding. The RAG database may be deployed so that the RAG database is configured to provide RAG data to a large language model (LLM) responsive to prompts generated through the computing task.

Selective content-aware embeddings for targeted information retrieval

Techniques for detecting suspicious data object access requests indicative of potential insider threats are described. A suspicious access detection module (SADM) determines, based on access data describing a access requests issued on behalf of multiple users, groups of the users having similar patterns of accesses to resource groups, a set of the resource groups accessed by each of the user groups, and ones of the user groups that are to be considered nearby others of the user groups based on having a threshold amount of resource group access similarities. The SADM causes an alert to be generated responsive to a determination that a subsequent access request is suspicious because it accesses a data object of a resource group that is not within the set of accessed resource groups of the issuing user's user group, and because the resource group is not within the sets of accessed resource groups of any nearby user groups.

Insider threat detection utilizing user group to data object and/or resource group access analysis

A method by a security system implemented by one or more electronic for detecting attacks on one or more databases. The method includes analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

Detecting attacks on databases based on transaction characteristics determined from analyzing database logs

Techniques for detecting suspicious file access requests indicative of potential insider threats are described. A suspicious access detection module (SADM) determines, based on access data describing a access requests issued on behalf of multiple users, groups of the users having similar patterns of accesses to folders, a set of the folders accessed by each of the user groups, and ones of the user groups that are to be considered nearby others of the user groups based on having a threshold amount of folder access similarities. The SADM causes an alert to be generated responsive to a determination that a subsequent access request is suspicious because it accesses a file of a folder that is not within the set of accessed folders of the issuing user's user group, and because the folder is not within the sets of accessed folders of any nearby user groups.

Growing community of inventors

Ness Ziona, Israel

Guy Shtar