Sophos Limited

Sonicwall Inc.

Symantec Corporation

Solera Networks, Inc.

Blue Coat Systems, Inc.

Dell Software Inc.

Ewinwin, Inc.

Joseph H Levy

Kenneth D Ray

Andrew James Thomas

Daniel Salvatore Schiappa

Matthew Scott Wood

Zhong Chen

David M Telehowski

Joshua Daniel Saxe

John Everett Gmuender

Huy Minh Nguyen

Michael B Massing

Russell Humphries

Simon Neil Reed

Paal Tveit

Brian Edginton

Steve Shillingford

James Brown

Daniel Arnold

Jin Shang

David Wells

Paul Kraus

Kenny Foisy

Dave Tubbs

McKay Marston

Shannon L Johnson

A threat management facility stores a number of entity models that characterize reportable events from one or more entities. A stream of events from compute instances within an enterprise network can then be analyzed using these entity models to detect behavior that is inconsistent or anomalous for one or more of the entities that are currently active within the enterprise network.

Centralized event detection

A compute instance stores a programmable feature extractor associated with a machine learning model maintained by a server-based computing system configured to communicate with the compute instance by way of a network. The machine learning model is based on a feature set that includes a plurality of features. The compute instance executes the programmable feature extractor to generate a feature vector corresponding to a data instance accessed by the compute instance, where the feature vector includes a feature value specific to the data instance for each feature included in the feature set. The compute instance transmits the feature vector corresponding to the data instance to the server-based computing system for use as a training input to the machine learning model.

Programmable feature extractor

An automated system attempts to characterize code as safe or unsafe. For intermediate code samples not placed with sufficient confidence in either category, human-readable analysis is automatically generated to assist a human reviewer in reaching a final disposition. For example, a random forest over human-interpretable features may be created and used to identify suspicious features in a manner that is understandable to, and actionable by, a human reviewer. Similarly, a k-nearest neighbor algorithm may be used to identify similar samples of known safe and unsafe code based on a model for, e.g., a file path, a URL, an executable, and so forth. Similar code may then be displayed (with other information) to a user for evaluation in a user interface. This comparative information can improve the speed and accuracy of human interventions by providing richer context for human review of potential threats.

Computer augmented threat evaluation

A compute instance may be configured to extract a feature of a data instance accessed by the compute instance, generate an anonymized feature value for the feature of the data instance, include the anonymized feature value in a feature vector corresponding to the data instance, and transmit the feature vector to a server-based computing system.

Programmable feature extractor with anonymization

An authentication model dynamically adjusts authentication factors required for access to a remote resource based on changes to a risk score for a user, a device, or some combination of these. For example, the authentication model may conditionally specify the number and type of authentication factors required by a user/device pair, and may dynamically alter authentication requirements based on changes to a current risk assessment for the user/device while the remote resource is in use.

Dynamic multi-factor authentication

Synthetic training sets for machine learning are created by identifying and modifying functional features of code in an existing malware training set. By filtering the resulting synthetic code to measure malware impact and novelty, training sets can be created that predict novel malware and to seek to preemptively exhaust the space of new malware. These synthesized training sets can be used in turn to improve training of machine learning models. Furthermore, by repeating the process of new code generation, filtering and training, an iterative machine learning process may be created that continuously narrows the window of vulnerabilities to new malicious actions.

Malware detection using machine learning

Entity models are used to evaluate potential risk of entities, either individually or in groups, in order to evaluate suspiciousness within an enterprise network. These individual or aggregated risk assessments can be used to adjust the security policy for compute instances within the enterprise network. A security policy may specify security settings such as network speed, filtering levels, network isolation, levels of privilege, and the like.

Dynamic policy based on user experience

An interface for a threat management facility of an enterprise network supports the use of third-party security products within the enterprise network by providing access to relevant internal instrumentation and/or a programmatic interface for direct or indirect access to local security agents on compute instances within the enterprise network.

Interface for network security marketplace

A security platform uses a sensor-event-analysis-response methodology to iteratively adapt to a changing security environment by continuously creating and updating entity models based on observed activities and detecting patterns of events that deviate from these entity models.

Threat response using event vectors

An ensemble of detection techniques are used to identify code that presents intermediate levels of threat. For example, an ensemble of machine learning techniques may be used to evaluate suspiciousness based on binaries, file paths, behaviors, reputations, and so forth, and code may be sorted into safe, unsafe, intermediate, or any similar categories. By filtering and prioritizing intermediate threats with these tools, human threat intervention can advantageously be directed toward code samples and associated contexts most appropriate for non-automated responses.

Computer assisted identification of intermediate level threats

Growing community of inventors

Eagle Mountain, UT, United States of America

Joseph H Levy