Pivotal Software, Inc.

Emc IP Holding Company LLC

Jin Yu

Anirudh Kondaveeti

Regunathan Radhakrishnan

Derek Lin

Rashmi Raghu

Derek Chin-Teh Lin

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.

Classifying user behavior as anomalous

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for clustering and visualizing textual data. A data clustering and visualization system clusters large volumes of semi-structured and unstructured textual data into categories. Each category can include a group of similar alerts and incidents. The categories are then graphically presented.

Clustering and visualizing alerts and incidents

One or more proxy logs are processed in order to generate a plurality of domain sequences. One or more domain sequences which have low support and high confidence within the plurality of domain sequences are identified. The identified domain sequences are flagged as including one or more of the following: an infected watering hole domain or an exploit kit host.

Discovering domain associations for watering hole attack detection

One or more proxy logs are processed in order to generate a graph of domains, wherein those domain pairs in the graph that are connected have low support and high confidence. One or more domains within the graph that are highly connected to other domains in the graph are identified. The identified domains are flagged as suspicious domains.

Graph-based techniques for detecting coordinated network attacks

Methods, systems, and apparatus, including computer programs encoded on computer storage media for identifying malware attacks collects data traffic information. A system receives data traffic information indicative of communications between computers within a network and computers external to the network. The system parses the data traffic information to identify communication links between the computers within the network and computers external to the network. The system can generate communication link profiles for each of the computers within the network. The system can then group computers within the network into computer clusters based on similarities between the communication link profiles for each computer. The system can identify computer clusters having anomalous communication patterns as being indicative of a malware attack.

Growing community of inventors

Melbourne, Australia

Jin Yu