Morgan Stanley Services Group Inc.

Joseph Edmonds

Russell Moriarty

Alec R Kerr

Eric Mudge

Jonathan Oakley

Patrick St John

A method of handling a failure in a pipeline between a source of alerts and a Security Incident & Event Management (SIEM) platform involves: deserializing data from at least one error state object in an error log; transferring the deserialized data to an offline environment; reconstituting at least some tasks of the pipeline, including the failed task, using contents of the error log and contents from a task log; re-running the at least some tasks of the pipeline; identifying a cause of the failed task; based upon the cause of the failed task, transferring at least one of a modified task or replacement task for use in the pipeline; instantiating a new version of the pipeline incorporating the at least one of the modified task or the replacement task; and re-executing the new version of the pipeline to process alerts and provide the processed alerts to the SIEM platform.

Method of handling a failure in a task pipeline between a source of alerts and a security incident and event management (SIEM) system

A system and method for detecting cyberattacks involves monitoring and analyzing incoming email received over the internet using enterprise telemetry; extracting observations from an enterprise telemetry data feeds and transmitting to a summarization module for summarizing a potential indicator of compromise pertaining to the email monitored and analyzed by the network telemetry; storing the observation summarization data in a graph database; querying over the internet an external cybersecurity threat intelligence provider, upon identification of a true-positive network threat, for enriching information and artifacts contained within the true-positive network threat, receiving over the internet enriching information and artifacts from the external cybersecurity threat intelligence provider, and storing the received enriching information and artifacts in the graph database; and identifying a new indicator of compromise using data stored in the graph database.

System for cybersecurity campaign artifact discovery and tasking

A system for improving efficiency of processing alerts by a Security Incident & Event Management (SIEM) platform involves a pipeline, and an error log associated with the pipeline, wherein the pipeline is coupled to a source of alerts and to an SIEM platform, the pipeline including a source task, at least one process task and at least one sink task, wherein the at least one sink task is configured to publish cases to the SIEM platform and wherein the error log is configured such that, when an exception occurs in a particular task in the pipeline, an object relating to the particular task and the exception will be stored in the error log.

Security incident and event management case creation system and method

A method of improving efficiency of processing alerts by a Security Incident & Event Management (SIEM) platform involves a SIEM case creation platform made up of at least one pipeline, made up of multiple tasks, and is interposed between an alerts database and the SIEM platform.

A method for generating hashes associated with web domains and reacting to transmissions from those web domains is disclosed. When artifacts from a first web domain and artifacts from a second web domain have been transmitted over a network, a system generates, via a hashing or fingerprinting function that uses registry information, a first hash for the first web domain and a second hash for the second web domain and identifies a correlation between the first web domain and the second web domain based on shared subsets of the first hash and second hash. Upon receiving a notification that artifacts from the first web domain had been determined to negatively impact the functioning of a secondary computing system, based on the identified correlation between the first web domain and the second web domain, the system automatically quarantines artifacts from the second web domain from interacting with the secondary computing system.

Web domain correlation hashing method

A computer-implemented method of analyzing the contents of a file in a visual document format to identify a potentially-fraudulent overlay is disclosed. The method includes receiving the file, iterating over a set of visually rendered elements within the file, and calculating, for each element in the set, a bounding box. Based on identifying a pair of elements having at least partially overlapping bounding boxes, such that a visible item in an overlaid element at least partially obscures an item in an underlying element that would otherwise be visible, an attack vector ontology is updated to include information on the overlaid and underlying element. This attack vector ontology may be used in training an automatic system to identify fraudulent documents and prevent their being printed, signed, and/or further used.

Fraudulent overlay detection in electronic documents

A system for receiving and deduplicating data strings transmitted over a network is disclosed. The system comprises one or more network sensors detecting data strings while in transit on the network; and non-transitory memory comprising instructions. When the instructions are executed by one or more processors, the one or more processors establish a plurality of Bloom filters, receive a first data string, perform a first insertion operation into each Bloom filter; determine, for each of one or more Bloom filters, a set of bits, whether presently set or cleared, to be unset; and unset each determined set of bits in the one or more Bloom filters. At a later moment in time, the first data string is received again, and each Bloom filter is queried to determine whether the first data string has been inserted, based on a current state of that Bloom filter.

Network file deduplication using decaying bloom filters

A method for generating fingerprints of web domains and reacting to artifacts electronically received from those web domains is disclosed. When artifacts from a first web domain and artifacts from a second web domain have been transmitted over a network, a system generates, via a hashing function that consults registry information, a first hash for the first web domain and a second hash for the second web domain and identifies a correlation between the first web domain and the second web domain based on shared subsets of the first hash and second hash. Upon receiving a notification that artifacts from the first web domain had been determined to negatively impact the functioning of a secondary computing system; and based on the identified correlation between the first web domain and the second web domain, the system automatically quarantines artifacts from the second web domain from interacting with the secondary computing system.

A system for collecting data artifacts from a production environment, storing them, and replaying them in a testing environment is disclosed. One or more processors receive a data artifact from a sensor in a production environment, and store the data artifact in a first storage with a unique identifier, while also storing in a second storage record(s) associating the unique identifier with a tag. A clone of at least a portion of the production environment is created within the testing environment, and an analytic targeting the data artifact is incorporated into the clone. Upon receiving a request to replay the data artifact, referencing the tag associated with the data artifact's unique identifier, the data artifact is replayed by causing the clone to receive the data artifact as if it were presently encountered. Logs of output from the clone's response are stored in a third storage for future analysis.

System for analytic data memorialization, data science, and validation

A computer-implemented method for indexing a stream of files is disclosed. The method comprises receiving a file; generating a set of atomic indexes based on the file contents; storing the atomic indexes in a current index; and if the current index reaches a threshold criterion, freezing the current index into a read-only form, propagating the current index to one or more distributed databases, and generating a new index for future insertions. In some embodiments, the method further comprises one or more of providing an interface to query the databases for files matching a particular signature; searching the databases using a YARA-specified signature; converting a user-provided signature in the YARA format to an index-acceleratable format; retrieving a set of files that are possible matches of the particular signature; verifying that each file of the set of files is a match of the particular signature; and providing the files through the interface.

File indexing and retrospective malware detection system

A computer-implemented method for collecting files transmitted on a network for subsequent malware analysis is disclosed. The method comprises determining, by a sensor, that a file has been transmitted on the network; transmitting, from the sensor to an intermediate agent, the file; storing, by the intermediate agent, the file, pending a determination whether metadata of the file indicates an identical copy of the file has likely already been stored by a source collection subsystem; responsive to a determination that the file has not likely already been stored by the source collection subsystem, transmitting the file from the intermediate agent to the source collection subsystem; verifying, by the source collection subsystem, that the file has not likely already been stored by the source collection subsystem; and storing the file for future analysis.

File collection method for subsequent malware detection

A system for receiving and indexing files transmitted on a network, comprising one or more intermediate agents, each connecting a network sensor to a source collection subsystem, an analysis subsystem, an indexing subsystem, and one or more databases. The system detects that a file has been transmitted via the network, offers transmission from an intermediate agent to the source collection subsystem after a deduplication process at the intermediate agent, transmits the file from the intermediate agent to the source collection subsystem after another deduplication process at the source collection subsystem, transmits the file from the source collection subsystem to the analysis subsystem, performs structural analysis of characteristics of the file within the analysis subsystem; and stores the file and results of the structural analysis in an indexed form in the one or more databases.

Growing community of inventors

Ellicott City, MD, United States of America

Joseph Edmonds