Microsoft Technology Licensing, LLC

Hani Hana Neuvirth

Tomer Koren

Yotam Livny

Royi Ronen

Ram Haim Pliskin

Dotan Patrich

Josef Weizman

Omer Karin

Dawn Antonette Burns

Gueorgui Chkodrov

Elad Yom-Tov

Efim Hudis

Moshe Israel

Daniel Alon

Tomer Weinberger

Andrey Karpovsky

Yuri Gurevich

Philip Newman

Ron Matchoro

Julian Federico Gonzalez

Jonathan Gazit

Zhipeng Zhao

William Kendall Hollis

Yaniv Zohar

Sangeetha Madderla

Scott Elliott Gorlick

Ori Kashi

Amir Keren

Andrew E Johnson

Karl William Reinsch

Craig A Nelson

Larry J Matuska

Nir Rosenfeld

Michal Braverman-Blumenstyk

Owen Joseph Davis

Roey Vilnai

Yaakov Garyani

Ishai Wertheimer

Ely Abramovitch

Yaron David Fruchtmann

Timothy William Burrell

William K Hollis

Methods, systems, and media are shown for creating and deploying honey tokens for intrusion detection in a remote computing resource system. Resource modules provisioned for a tenant are identified for intrusion detection. For each identified resource modules, a provisioned resource having a corresponding access credential is allocated and the access credential is deployed in the identified resource module. A data entry is created in a token mapping store that identifies the access credential and the resource module. Access logs are scanned to detect access attempts. For each access attempt, the token mapping store is searched for a data entry with an access credential that matches the access credential of the access attempt. If found, an alert is generated that includes the identified resource module of the matching data entry.

Automated generation and deployment of honey tokens in provisioned resources on a remote computer resource platform

An indication of a security alert and a context for the security alert is received. The context includes one or more entities related to the context and a timestamp for the security alert. Data sources for the one or more entities are searched during a time window around the timestamp. One or more anomaly detection models are executed to identify anomalies that are related to the security alert based on the context. Identified anomalies for investigation of the security alert are output.

Detection of anomalous count of new entities

Performing anomaly lookup on data sources that include an entity related to an alert. One or more entities related to an alert and a date when the alert occurred are received. The alert may indicate that an anomaly in data collected from a various data sources may be present in at least one of the data sources. The various data sources are searched for the one or more entities around the alert date to determine which of the data sources include the one or more entities. For those data sources including the one or more entities, an anomaly lookup procedure is performed on the data sources during a first time window to determine an initial set of suspicious anomalies.

Anomaly lookup for cyber security hunting

Using a set of anomalies indicative of a malicious pattern of behavior collected from data to determine new alerts for anomalies included in subsequently collected data. A set of anomalies found in data collected from data sources is accessed. The set of anomalies is determined by a prior analysis to be indicative of a malicious pattern of behavior by entities associated with the set of anomalies. Data that is subsequently collected from the data sources is searched to determine if any of the data includes the set of anomalies. Alerts are generated for any of the subsequently collected data that includes the set of anomalies.

Automatic generation of detection alerts

A previously-unknown type of attack on a web application can be detected dynamically using server logs. An alert can be raised for an application that returns a valid response to the potential attacker (e.g., when an http (hypertext transfer protocol) status code of 200 is returned to the requestor). Server logs can be analyzed to identify an external computer that uses the same attack methodology on multiple targets. The external computer may attempt to access the same Uniform Resource Identifier (URI) on various web sites. In many cases, the http status code that is returned is an error code. Characteristics such as but not limited to fast crawling and numerous error status codes being returned to a particular requestor can be used by a machine learning (ML) system to identify potentially malicious external computing devices and/or vulnerable URIs.

Detecting attacks on web applications using server logs

Methods, systems, apparatuses, and computer program products are provided for evaluating security detections. A detection instance obtainer obtains detection instances from a pool, such as a security detections pool. The detection instances may be obtained for detections that meet a predetermined criterion, such as detections that have not been onboarded or rejected, or detections that have generated detection instances for a threshold time period. The detection may be onboarded or rejected automatically based on a volume thresholder and/or a detection performance evaluator. For instance, the volume thresholder may be configured to automatically onboard the detection if the volume of the detection instances is below a first threshold, and reject the detection if the volume is above a second threshold. The detection performance evaluator may be configured to onboard or reject the detection based on an efficacy of the detection (e.g., based on a true positive rate of the detection instances).

Automated onboarding of detections for security operations center monitoring

'Sensitive' URIs for a website can be determined. Access attempts to a sensitive URI can be extracted from server logs. As used herein, sensitive URIs are URIs which if breached are likely to result in harm to the website owner. Access to sensitive URIs can be restricted to trusted accessors. Trusted accessors can be determined by filtering out untrusted accessors using thresholds and/or machine learning techniques. After filtering out untrusted accessors, any remaining accessors can be identified as trusted accessors. Trusted accessors can be added to a whitelist. Access requests to access-restricted URIs by an accessor not in the whitelist can be denied and an alert can be generated. Access requests to access-restricted URIs by an accessor in the whitelist can be granted.

Whitelisting of trusted accessors to restricted web pages

A method for detecting machine logon attacks within a cloud service. The method can include accessing a collection of network traffic protocol monitoring data. The network traffic protocol monitoring data can be network traffic protocol monitoring data across a cloud service. The method can also include analyzing the collection of network traffic protocol monitoring data to identify anomalous behavior by attacker entities associated with IP addresses indicating a brute force attack by the attacker entities associated with the IP addresses. Then, based on the anomalous behavior, the method can comprise identifying the IP addresses associated with the attacker entities, and at least one of attack patterns or campaign attack characteristics. Finally, the method can include compiling IP addresses associated with the attacker entities and the at least one of attack patterns or campaign attack characteristics into a reference data structure.

Cloud view detection of virtual machine brute force attacks

Systems, methods, and apparatuses are provided for restricting access to a web resource. Website access information is obtained by monitoring accesses to a plurality of websites for each access, which may include a network identifier of an access requestor, a website identifier, and an access time for each request. Based on at least the website access information, it may be determined that a particular access requestor has accessed a number of different websites in a given time period. As a result, the particular access requestor may be classified as a web robot. A request to permit access to a web resource is received by the particular access requestor. In response to receiving the request to permit access to the web resource, the particular access requestor is prevented from accessing the web resource and/or a notification is generated that the particular access requestor is attempting to access the web resource.

System and method for restricting access to web resources

Disclosed herein is a system for generating and displaying information useful to help a security analyst understand a scale and a root cause of a potential security issue associated with a resource. The resource can include a server, a storage device, a user device (e.g., a personal computer, a tablet computer, a smartphone, etc.), a virtual machine, networking equipment, etc. The resource may be one that is under control of an entity operating a security operations center. Additionally or alternatively, the resource may be one that is configured to be monitored by the security operations center. The information provides the security analyst with a broader context of the potential security issue based on relationships between the potential security issues and other security issues. Consequently, the information enables the security analyst to implement more efficient and effective actions to handle the potential security issue.

Providing context associated with a potential security issue for an analyst

A system includes identification of a data source of a production environment, the data source storing authentic data, generation of simulated data of the data source, reception of a request for data of the data source from a requesting system in the production environment and, in response to the received request, providing of the simulated data to the requesting system. In some aspects, the simulated data is provided to the requesting system if it is determined that the request is related to an electronic attack, and the authentic data of the data source is provided to the requesting system if it is not determined that the request is related to an electronic attack.

Data generation for data protection

A method includes obtaining a dictionary, data for a set of web requests, and definitions of a first set of clusters associated with vulnerability scanners. The method includes identifying a set of clients that transmitted the second set of web requests. The method includes generating a second set of feature vectors, which each corresponds to one of the clients. Each element in each feature vector corresponds respectively to an entry in the dictionary. The method includes clustering the second set of feature vectors into a second set of clusters. The method includes, in response to a first distance between a selected cluster of the second set of clusters and one of the first set of clusters being less than a first predetermined distance, (i) identifying one of the set of web services that received web requests corresponding to feature vectors in the selected cluster and (ii) generating a scanning alert.

Distributed system for adaptive protection against web-service- targeted vulnerability scanners

Systems and methods for analyzing security alerts within an enterprise are provided. An enterprise graph is generated based on information such as operational intelligence regarding the enterprise. The enterprise graph identifies relationships between entities of the enterprise and a plurality of security alerts are produced by a plurality of security components of the enterprise. One or more significant relationships are identified between two or more of the plurality of security alerts based on a strength of a relationship identified in the enterprise graph. A significant relationship is utilized to identify a potential security incident between two or more of the security alerts.

Enterprise graph method of threat detection

A system for detecting a non-targeted attack by a first machine on a second machine is provided. The system includes an application that includes instructions configured to: extract network data corresponding to traffic flow between the first and second machines, where the second machine is implemented in a cloud-based network; identify a first suspect external IP address based on the network data; calculate features for the first suspect external IP address, where the features include exploration type features and exploitation type features; train a classifier based on predetermined examples and the features to generate and update a model; classify the first suspect external IP address based on the model and at least some of the features; and perform a countermeasure if a classification provided from classifying the first suspect external IP address indicates that the first suspect external IP address is associated with a malicious attack on the second machine.

Non-protocol specific system and method for classifying suspect IP addresses as sources of non-targeted attacks on cloud based machines

In an example embodiment, a computer-implemented method comprises obtaining labels from messages associated with an email service provider, wherein the labels indicate for each message IP how many spam and non-spam messages have been received; obtaining network data features from a cloud service provider; providing the labels and network data features to a machine learning application; generating a prediction model representing an algorithm for determining whether a particular set of network data features are spam or not; applying the prediction model to network data features for an unlabeled message; and generating an output of the prediction model indicating a likelihood that the unlabeled message is spam.

Growing community of inventors

Redmond, WA, United States of America

Hani Hana Neuvirth