Qomplx, Inc.

Fractal Industries, Inc.

Jason Crabtree

Andrew Sellers

Richard Kelley

Ian MacLeod

Luka Jurukovski

Angadbir Singh Salaria

Randy Clayton

Michael James

Farooq Shaikh

Jason Hopper

Bhashit Parikh

David Park

Anant Borole

Bharat Amin

Farooq Israr Ahmed Shaikh

Raveem Ismail

Joe Gray

Marian Trnkus

John Uchiyama

Jeffrey Chung

Artem Panasenkov

Angad Salaria

Daniel Fricano

Gandhi Balasubramaniam

Paolo Angioletti

Antony Pegg

Rajat Gupta

Nhan Tran

Stuart Baurmann

Sethan Arja

Mike Chasman

Shadrack Antwi

Penelope Brooks

Tomas Fornara

Alejandro Caceres

A system and method for scoring and enforcing authentication standards that actually enable zero trust network security principles when combined with stateful authentication object tracking, authentication object manipulation and forgery detection, and assessment of authentication and identity attack surface. The methodology involves gathering all authentication objects issued by a network, storing the authentication objects in a centralized location for use in stateful deterministic authentication object tracking, scoring the completeness of the authentication observations, assessing the quality of the authentication observations, and assigning organization-specific penalty functions.

Network authentication toxicity assessment

A system and method for network cybersecurity analysis that uses user and entity behavioral analysis combined with network topology information and trigger-based network remediation to provide improved cybersecurity. The system and method involve gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Triggers may be based on risks or anomalous behavior and associated with a remediation action executed on the network by a security mitigation engine. The system and method may also dynamically adjust monitoring characteristics based on trigger events.

System and methods for cybersecurity analysis using UEBA and network topology data and trigger-based network remediation

A system and method for cyber exploitation path analysis and response using federated networks to minimize network exposure and maximize network resilience, with the ability to simulate complex and large scale network traffic through the use of federated training networks, by gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Lastly, network attack path analysis and automated task planning for minimizing network exposure and maximizing resiliency is performed with machine learning, generative adversarial networks, hierarchical task networks, and Monte Carlo search trees.

Computer-implemented system and method for cybersecurity threat analysis using federated machine learning and hierarchical task networks

A system and method for the dynamic authentication revocation using privilege assurance of enterprise computer network environments using lateral movement detection and prevention. The system uses local session monitors to monitor logon sessions within a network, generating and verifying event logs and authentication records to ensure the legitimacy of authenticated user sessions and to revoke credentials when an illicit session is detected and further removing potentially compromised network components from the network, halting lateral movement in real-time.

Dynamic authentication revocation utilizing privilege assurance

A system and method for operational and cyber risk assessment that utilizes a data-driven approach to evaluate the current security posture and identify areas for improvement based on the user's desired target profile. This process involves estimating the costs and benefits associated with various security program enhancements, increased, hiring, and control uplifts. The system and method then quantify these benefits in terms of reduction in tail value at risk, expected losses, cyber insurance premiums, and the amount of risk capital set aside. The system simulates attack paths associated with various risk scenarios and uses a risk scenario model to compute losses associated with each attack path for each risk scenario. The results of the simulation may be used to determine one or more business outcomes associated with the costs and benefits of implementing security enhancements.

Dynamic cybersecurity scoring and operational risk reduction assessment

A system and method for detection and prevention of ticket forgery cyberattacks by improving host-level analytics and monitoring and extending the improved host-level analytics and monitoring to endpoints of a network. The methodology described herein comprises the use of a ticket-granting log extension utility which stores every logon session on a network, queries the local ticket cache, and generates additional custom data as a part of an event log stream such as a start time, end time, renew time, and related session data. This comprehensive log extension data can be used to identify certain types of ticket forgery cyberattacks by comparing the user session name with the client name identified in the ticket presented for access to network resources and other means. This host-level ticket forgery detection can be extended to network endpoints for additional security.

Host-level ticket forgery detection and extension to network endpoints

A system and methods for Kerberos protocol collection, interdiction and decryption for real-time analysis to aid in both operational and security functions in SSO-enabled networks, using agent processes that intercept and decrypt Kerberos traffic to identify compromised credentials and accounts in real-time without exposing sensitive information.

Kerberos interdiction and decryption for real-time analysis

A system for network traffic classification using distributed sensor nodes is provided, comprising a plurality of network traffic sensors each configured to monitor visible network traffic, analyze the monitored traffic to identify patterns, communicate with other network sensors to correlate their respective traffic data, produce a threat landscape based on the correlated traffic data, identify a potential cybersecurity threat based on the threat landscape, and export the analyzed traffic and threat landscape for use by external systems.

Network action classification and analysis using widely distributed and selectively attributed sensor nodes and cloud-based processing

A system and method for generating multimedia artifacts with managed scene continuity in visual and multimedia using an AI-based and scene continuity aware media generation platform. The system receives a user or AI agent specification or simulation result(s), selects or trains generative models based on the specification, preprocesses relevant data, and generates scene narrative or frame-specific, sequence specific or broader continuity aware content using the selected or trained model(s). The generated content may be further enhanced using frame interpolation and view synthesis techniques to create smooth transitions or novel viewpoints or to aid in more efficient transmission or viewing or persistence of resultant content. The system enables efficient and customizable generation of high-quality scene continuity aware content for various applications in visual and multimedia production using neuro-symbolic and simulation enhanced compression, representation and generation processes.

System and method for efficient scene continuity in visual and multimedia using generative artificial intelligence

A system and method for comprehensive data utilization and tracking comprising an ontological engine which in some embodiments is configured to create and curate various industry-specific ontologies which can be used to provide deeper context to an enterprise's network traffic and data transmission. The system and method further comprise a tagging and tracking engine configured to inspect network packets, apply a first tag associated with an authentication object, apply a second tag associated with an identified ontology, and track the tagged packets as they traverse the enterprise network, generating data utilization tracking information as the packets move through the network. A scoring engine may leverage the data utilization tracking information in combination with user entity and behavior data to compute a risk score associated with data utilization on the enterprise network.

System and method for enterprise-wide data utilization tracking and risk reporting

A reconnaissance engine gathers data about a client's computer network from the client, from devices and systems on the client's network, and from the Internet regarding various aspects of cybersecurity. Each of these aspects is evaluated independently, weighted, and cross-referenced to generate a cybersecurity score by aggregating individual vulnerability and risk factors together to provide a comprehensive characterization of cybersecurity risk using a transparent and traceable methodology. The scoring system itself can be used as a state machine with the cybersecurity score acting as a feedback mechanism, in which a cybersecurity score can be set at a level appropriate for a given organization, and data from clients or groups of clients with more extensive reporting can be used to supplement data for clients or groups of clients with less extensive reporting to enhance cybersecurity analysis and scoring.

System and method for self-adjusting cybersecurity analysis and score generation

A system and method for providing a cloud identity verification exchange service which ingests a plurality of identity assertion data from various Identity Providers and/or Service Providers and aggregates the ingested plurality of data into a master global authentication ledger. The system and method comprise: a data ingestion engine configured for acquiring, extracting, and loading data into the system as well as providing hashing capabilities; a metadata manager for collecting, organizing, and cataloguing ingested data based on collected metadata; and database for storing the master global authentication ledger. The master ledger acts as a central repository that consolidates authentication objects from various Identity Providers, allowing for centralized authentication management, auditing, reporting, and analysis. It provides a comprehensive view of authentication activities across multiple systems and enables the tracking of user authentication events across different identity providers.

Collaborative cloud identity and credential forgery and abuse defense

A system and method for large-scale internet health forecasting and internet noise analysis. The system and method feature the ability to scan for, ingest and process, and then use various data stores for capturing entity data, their relationships, and actions associated with them. This data forms the basis for cyber enrichment service databases which can used to provide information responsive to user submitted queries as well as to produce large-scale (e.g., Internet scale) simulation models using statistical models, generative ML models, massively multiplayer online gaming simulation systems, or full discrete event simulation engines or some combination. User submitted queries can be ran against the raw data or against simulations to provide simulation results that can be used improve cybersecurity for an organization against actual observed behaviors or simulations.

System and method for internet activity and health forecasting and internet noise analysis

Fully integrated collection of relevant data, analysis of that data and generation of both analysis-driven decisions and analysis driven simulations of alternate candidate actions. This organizational operating system may be used predict the outcome of enacting candidate decisions based upon past and current data retrieved from both within the corporation and from a plurality of external sources pre-programmed into the system. Simulations using this data and predefined parameters to create models of actors are then run. Risk to value estimates of candidate decisions are also calculated.

System and method for modeling complex systems with distributed actor-based simulation

A system for dynamic cybersecurity scoring using traffic fingerprinting and score improvement, that uses a web crawler that sends message prompts to external hosts and receives responses from external hosts, a time-series data store that produces time-series data from the message responses, and a directed computational graph module that analyzes the time-series data to produce a weighted score representing the overall cybersecurity state of an organization.

Growing community of inventors

Vienna, VA, United States of America

Jason Crabtree