Rockwell Automation Technologies Incorporated

Wombat Security Technologies, Inc.

Other

Proofpoint, Inc.

John T Campbell

John Joseph Baier

Robert Joseph McGreevy

Robert J Herbst

Taryl Jon Jasper

Frank Anthony Palmieri, Jr

Norman Sadeh-Koniecpol

Kurt Wescoe

Trevor Tyler Hawthorn

Alan Himler

Joseph A Ferrara

Scott A Miller

David Thayer Sturrock

Mark Anson Glavach

Keith A Overstreet

Randall P Sadowski

Patrick H Veverka

Dustin D Brungart

Robert J Mcgreevy

An electronic device will identify an electronic message received by a messaging client that is associated with a first recipient, and it will analyze the electronic message to determine whether the electronic message is a simulated malicious message. Upon determining that electronic message is a simulated malicious message, the device will identify an actuatable element in the electronic message. The actuatable element will include a service address. The device will modify the electronic message by appending a user identifier of the first recipient to the service address of the actuatable element. Then, when the actuatable element is actuated, the system may determine whether the first recipient actuated the actuatable element or an alternate recipient did so based on whether the user identifier of the first recipient is still appended (or is the only user identifier appended) to the actuatable element.

Determining authenticity of reported user action in cybersecurity risk assessment

An electronic device will identify an electronic message received by a messaging client that is associated with a first recipient, and it will analyze the electronic message to determine whether the electronic message is a simulated malicious message. Upon determining that electronic message is a simulated malicious message, the device will identify an actuatable element in the electronic message. The actuatable element will include a service address. The device will modify the electronic message by appending a user identifier of the first recipient to the service address of the actuatable element. Then, when the actutable element is actuated, the system may determine whether the first recipient actuated the actuatable element or an alternate recipient did so based on whether the user identifier of the first recipient is still appended (or is the only user identifier appended) to the actuatable element.

A system manages computer security risks associated with message file attachments. When a user of an electronic device with a messaging client attempts to open an attachment to a message that is in the client's inbox, the system will analyze the message to determine whether the message is a legitimate message or a potentially malicious message without the need to actually process or analyze the attachment itself. If the system determines that the received message is a legitimate message, the system will permit the attachment to actuate on the client computing device. If the system determines that the received message is not or may not be a legitimate message, the system will continue preventing the attachment from actuating on the client computing device.

Advanced processing of electronic messages with attachments in a cybersecurity system

A client electronic device of an electronic message analysis system receives a user activation action indicating that a user has reported a message received at the client device a potentially malicious. The client device then determines whether to forward the message to a remote service for analysis by assessing whether the received message originated from a trusted sender. If and only if the client device determines that the received message originated from a trusted sender, it will permit the client device to take other action on the received message and not report the received message to a remote service for further analysis. If the client device does not determine that the received message originated from a trusted sender, it will report the received message to a remote service for further analysis.

Method and system for reducing reporting of non-malicious electronic messages in a cybersecurity system

An electronic message analysis system of a cybersecurity network assesses whether a received message is a mock malicious message in response to, receiving a user activation action that indicates that the user has reported the received message as a potentially malicious message. The system does this by determining whether any header field of a header section of the message starts with a predetermined key. For any header field that starts with the predetermined key, the system determines whether a value that follows the predetermined key satisfies a trusted sender rule. If the value that follows the predetermined key satisfies the trusted sender rule, the system determines that the received message originated from a trusted sender. If the value that immediately follows the predetermined key does not satisfy the trusted sender rule, the system determines that the received message did not originate from a trusted sender.

In a cybersecurity network, a system identifies and classifies non-malicious messages by receiving a user notification indicating that the user has reported a received message as potentially malicious message, and determining whether the received message is legitimate or potentially malicious. When the system determines that the message is a legitimate, it further analyzes the message to assign a class that may include trusted internal sender, trusted external sender, or training a simulated phishing message. It will then cause the user's device to provide the user with information corresponding to the assigned class. The system may also quarantine a received message and release the message from the quarantine only after determining that the message is legitimate and receiving a user acknowledgment.

Method and system for assessing and classifying reported potentially malicious messages in a cybersecurity system

Systems and methods that provide a historian integrated as part of an industrial unit and/or product manufactured by the industrial process. A historian integrated as part of the industrial unit itself, can increase data resolution and supply immediate and real time data regarding the industrial unit's operation&#x2014;while mitigating short comings of conventional PC historians. Moreover, a locator component can detect embedded historians that are distributed on the back plane of an industrial network, and integrated as part thereof.

Historians embedded in industrial units

Systems and methods that facilitate discovery of history data via a locator component associated with a plant embedded historian(s) of an industrial programmer (e.g., a controller device.) Such locator component can further detect micro historians that are distributed on the back plane of an industrial network. The locator component can be part of applications running on a control unit, which can function as a management control center for the industrial network system. A common data model can be employed to expose functionality and data of the organization to the embedded historian component.

Auto discovery of embedded historians in network

Systems and methods that provide for adaptive processes in an industrial setting. Historian data, in conjunction with current collected data, can be converted into decision making information that is subsequently employed for modifying a process in real time. A process trend component, which is associated with a controller, can access historian data (e.g., trends collected via historians) to determine/predict an outcome of a current industrial process. Such enables a tight control and short reaction time to correcting process parameters.

Adaptive industrial systems via embedded historian data

Systems and methods that can vary a data collection rate via a rate adjustment component, to collect data with different level of granularity. The rate adjustment component can further include an estimation component that can automatically predict a required sampling rate for a stage of an operation, based on statistical models and data collected for similar operations and/or history data. Such difference in the granularity level can initiate in part in response to fault detection, alert triggering, and the like. Accordingly, future trouble shooting efforts can be performed with respect to data that is typically collected at an adjustable rate.

Adjustable data collection rate for embedded historians

Systems and methods that discover relations and correlates among disparate pieces of data, to infer possible relationships between the industrial process and historian data/events to improve industrial operations. A correlation component can employ heuristic models to capture process data/event data, and can further include an implicit correlation component and an explicit correlation component. Accordingly, relations among various parameters can be discovered (e.g., dynamically) and proper corrective adjustments supplied to the industrial process.

Contextualization for historians in industrial systems

Systems and methods that supply direct access (e.g., bypassing the controller) to embedded historian via a subscription and notification component. By modeling the notification related information (e.g., subscription queries, subscriber information, event information . . . ) as data and leveraging the power of database systems to perform set-oriented manipulations on this data efficiently, the subject innovation enables for a highly scalable and efficient subscription and notification system for direct access to the historians.

Growing community of inventors

Bridgeville, PA, United States of America

John T Campbell