Ironnet Cybersecurity, Inc.

James E Heath

Robert L Grossman

Keith B Alexander

Matthew C Swort

Randy Lynn Garrett

Russell D Richardson

System and methods for cross-domain training and updating of models to perform classification and scoring of network data/traffic are described. Information used to build deep machine learning models about traffic in one domain is used to improve the modeling in another domain. By using cross-domain learning, labeled data from another domain can be used to improve the detection rate and false positive rate of an analytic model in another domain. Because of the construction of the models, and because the models, and not the data are transferred, there is no disclosure of personally identifiable or otherwise restricted information.

Systems and methods for detecting malicious network traffic using multi-domain machine learning

Systems and methods for recording information at a granular level; checking and verifying that data is used and processed is consistent with an entity's internal policies and/or external regulations; and producing reports to authorized users (e.g., individuals and organizations) with information are provided. The system and methods capture required data in an immutable fashion so that users outside of an entity (e.g., public, third parties) can check and audit that internal policies and other regulatory policies and frameworks are followed.

Data block-based system and methods for predictive models

A cybersecurity system for managing cyber behavior associated with cyber actors such that the cyber behavior can be computed and predicted and cyber interactions between the cyber actors can be created. The system includes a cyber behavioral space management module configured to receive input data, and data from the interaction engine and the analytic workflow engine, and to generate a plurality of cyber behavioral spaces based on the received data. The system includes an interaction engine configured to process cyber actor data to facilitate interactions with the cyber behavioral space, a cyber scene, a cyber map, and another cyber actor. The system includes an analytic workflow engine configured to analyze the cyber behavioral spaces and update cyber data based on the analyzed data and the interaction engine data. The system includes a visualization engine configured to compute visualizations and transmit the visualizations for display.

Simulation and virtual reality based cyber behavioral systems

A cybersecurity system for processing events to produce scores, alerts, and mitigation actions. The system includes sensors for receiving and processing data to form events, distributed analytic platform for processing events to form analytic workflows, and scoring engines for processing events using analytic workflows to produce scoring engine messages. The system also includes real time analytic engine for processing scoring engine messages and distributed analytic platform messages using the analytic workflows and analytic workflow and event processing rules to form and transmit a threat intelligence message. Threat intelligence messages include broadcast messages, mitigation messages, and model update messages. The system also includes logical segments which associate an analytic model, a set of analytic models, or an analytic workflow; one or more sources of inputs about activity within the logical segment, and a set of actions for mitigating an impact of the anomalous activity occurring within the logical segment.

Growing community of inventors

Sugarloaf Key, FL, United States of America

James E Heath