Secureworks, Inc.

Dell Products Inc.

Secureworkscorp.

Dell Secureworks, Inc.

Jon R Ramsey

Timothy M Vidas

Ross Rowland Kinder

Robert W Danford

Aaron Hackworth

William M Urbanski

Wayne Howard Haber

Uday Banerjee

Kevin Ketts

Michael Joseph Hubbard

Mukund Purshottam Khatri

Jacqueline Hegedus Wilson

Theodore Stratton Webb

Lewis I McLean

Matthew K Geiger

Kevin R Moore

Ashley Thomas

Nash Borges

Ryan James Leavengood

Andy Davenport

Hunter King

Jyotish S Varma

Kevin J Schmidt

Joseph Neal Stewart

Oliver J Palmer

Rudy Alexander Ristich

Matt J McCormack

Joan Pepin

Steve Buer

Kyle Soeder

Robert William Danford

Bill Guerry

Systems and methods for reversibly remediating security risks, which monitor a network or system for security risks, and upon detection of one or more of risks, apply a remedial action applicable to at least partially remedy or mitigate the one or more detected risk. The network or system is monitored for a change to the detected risk(s), and upon detection of a change to the detected risk(s), the applied remediation action is automatically reversed.

Computer implemented system and method, and computer program product for reversibly remediating a security risk

Methods and systems for building security applications can be provided. Data policies for accessing security data can be set, and a module pipeline including one or more modules selected from a plurality of modules can be generated. The modules can include at least one module operable to apply a predictive security application or model for detection or identification of security threats. Module execution policies governing execution of the one or more modules in the module pipeline also can be set. Upon receipt of a request to initiate execution of the module pipeline, it can be determined if the execution thereof would violate the data policies or the module execution policies. If so, execution of the module pipeline can be blocked, otherwise the module pipeline can be executed to process the portion of the security data.

Systems and methods for sharing, distributing, or accessing security data and/or security applications, models, or analytics

The present disclosure provides systems and methods for detection of one or more security threats or malicious actions. According to the present disclosure, data can be received from one or more data producers and provided to a behavior processor. The behavior processor extracts, identifies, or detects one or more behaviors from the data based on one or more datum, features, or characteristics included therein, and provides the one or more identified behaviors to a tactic processor. The tactic processor extracts, identifies, or detects one or more tactics based on the one or more identified behaviors, and submits the one or more identified tactics to a tactic classifier to determine whether the one or more identified tactics are indicative of the one or more security threats or malicious actions. Other aspects are also described.

Systems and methods of hierarchical behavior activity modeling and detection for systems-level security

The present disclosure provides systems and methods for organizations to use security date to generate a risk scores associated with potential compromise based on clustering and/or similarities with other organizations that have or may have been compromised. For example, indicators of compromise can be used to create a similarity score rank over time that may be used as a similarity and risk measurement to generate a continual/dynamic score, which can change and/or be updated as new data is created or arrives to detect or prevent threats and/or malicious attacks.

Systems and methods for threat discovery across distinct organizations

The present disclosure provides systems and methods for organizations to use forensic to generate a risk scores associated with potential compromise based on clustering and/or similarities with other organizations that have or may have been compromised. For example, specific attributes or marks, such as low fidelity indicators of compromise can be used to create a similarity score rank over time that may be used as a similarity and risk measurement to generate a continual/dynamic score, which can change and/or be updated as new data is created or arrives to detect or prevent threats and/or malicious attacks.

Methods and systems for developing and distributing applications and data for building security applications can be provided. A plurality of data policies can be set for access and/or filtering security data based on selected parameters. One or more modules can be generated for processing the security data, with each of the modules governed by one or more module policies. Upon receipt of a request to initiate execution of the one or more modules to access and process a selected portion or filtered set of the security data, it can be determined if the request violates the data policies and/or the module policies applicable for processing the selected portion or filtered set of the security data, and if the data policies and/or the module policies are not violated, the one or more modules can be executed to process the selected portion or filtered set of the security data.

A method of configuring a network security device includes receiving a changed set of network rules to replace a current set of network rules; using a plurality of network traffic events to perform a first simulation of according to the current set of network rules and a second simulation according to the changed set of network rules; comparing the results of the first and second simulation to identify changes in network traffic allowed and denied between the current set and the changed set of network rules; displaying the changes in allowed and denied traffic for review of the changed set of network rules; receiving an instruction to implement the changed set of network rules based on the review; and filtering network traffic according to the changed set of network rules.

Systems and methods for security configuration

A system for collection and analysis of forensic and event data comprising a server and an endpoint agent operating on a remote system. The server is configured to receive event data including process creation data, persistent process data, thread injection data, network connection data, memory pattern data, or any combination thereof, and analyze the event data to detect compromises of a remote system. The endpoint agent is configured to acquire event data, and communicate the event data to the server.

System and method for collection of forensic and event data

A method of assessing the quality of a network filter rule containing a wildcard includes determine an instantaneous entropy for the network filter rule based on string distances or instantaneous entropy between a plurality of wildcard matches for the network filter rule. The method further includes performing an action if the string distance or instantaneous entropy for the network filter rule crosses a threshold. The action being selected from disabling the network filter rule, flagging the rule as a low quality rule, generating a candidate rule based on a portion of the match having low entropy and a portion of the match having high entropy, or a combination thereof.

Systems and methods for rule quality estimation

System and method for collection and analysis of endpoint forensic and event data

A method for operating a secure man-in-the-middle proxy includes intercepting an attempt to establish a connection between an application and a network server associated with a whitelisted hostname, establishing a secure connection to the network server, checking the secure connection against the stored combination of certificate, encryption protocol, and encryption cipher for the whitelisted hostname, and forwarding traffic between the application and the network server at the whitelisted hostname if the secure connection matches the stored combination of certificate, encryption protocol, and encryption cipher for the whitelisted hostname.

Systems and methods for providing a man-in-the-middle proxy

A method for provisioning a secure container for running an application includes routing traffic between the application and a secure container service over a virtual private network, and restricting the flow of traffic to or from the application other than traffic to or from the secure container service. The method further includes providing limited name resolution for the secure container with a customized domain name system server, establishing network proxy services to filter and route approved inbound traffic to the application, and establishing outbound network proxy services to filter and route approved outbound traffic from the application.

Systems and methods for secure containerization

Network traffic can be prevented from entering a protected network. An alert can be received that can be triggered by network traffic that matches at least one signature that is associated with undesired network behavior. A source of the network traffic that triggered the alert can be determined, and network traffic that originates from the source can be blocked. Blocking the source can include assigning a determination to the alert. It can then be determined whether network traffic from the source should be blocked based on the determination. The source can then be provided to the protected network such that a network device coupled to the protected network can be configured to block network traffic that originates from the source.

Growing community of inventors

Athens, GA, United States of America

Jon R Ramsey