Microsoft Technology Licensing, LLC

Jugal Parikh

Mariusz Hieronim Jakubowski

Douglas John Hines

Nitin Kumar Goel

Seyed Mehdi Fatemi Booshehri

Cristian Craioveanu

Geoffrey Lyall McDonald

Allan Gordon Lontoc Sepillo

Bradley Noah Faskowitz

Eleanor Catherine Quint

Benjamin E Nick

Yogesh Kant Roy

Ram Shankar Siva Kumar

Daniel L Mace

William Blum

Edir Vinicio Garcia Lazo

Amir Rubin

Mesfin Adane Dema

Kristian Holsheimer

Fuchen Liu

Jeremias Eichelbaum

Nihal Irmak Pakis

Peter A Bryan

Sadegh Momeni Milajerdi

Geoffrey Lyall Mcdonald

A computer-implemented method of generating a security language query from a user input query includes receiving, at a computer system, an input security hunting user query indicating a user intention; selecting, using a trained machine learning model and based on the input security hunting query, an example user security hunting query and corresponding example security language query; generating, using the trained machine learning model, query metadata from the input security hunting query; generating a prompt, the prompt comprising: the input security hunting user query; the selected example user security hunting query and the corresponding example security language query; and the generated query metadata; inputting the prompt to a large language model; receiving a security language query from the large language model corresponding to the input security hunting query reflective of the user intention.

Generating security language queries

In systems for interpreting the predictions of a machine learning model with the help of a surrogate model, feature vectors of inputs to the machine learning model can be grouped based on locality sensitive hashes or other hashes that reflect similarity between the feature vectors in matching hash values. For a given prediction to be interpreted and the corresponding input feature vector, a suitable training dataset for the surrogate model can then be obtained at low computational cost by hashing the input feature vector and retrieving stored feature vectors with matching hash values, along with their respective predictions.

Interpretable machine learning for data at scale

Embodiments seek to prevent detection of a sandbox environment by a potential malware application. To this end, execution of the application is monitored, and provide information about the execution to a reinforcement learning machine learning model. The model generates a suggested modification to make to the executing application. The model is provided with information indicating whether the application executed successfully or not, and this information is used to train the model for additional modifications. By modifying the potential malware execution during its execution, detection of a sandbox environment is prevented, and analysis of the potential malware applications features are better understood.

Undetectable sandbox for malware

Generally discussed herein are devices, systems, and methods for improving phishing webpage content detection. A method can include identifying first webpage content comprises phishing content, determining, using a reinforcement learning (RL) agent, at least one action, generating, based on the determined at least one action and the identified first webpage content, altered first webpage content, identifying that the altered first webpage content is benign, generating, based on the determined at least one action and second webpage content, altered second webpage content, and training, based on the altered second webpage content and a corresponding label of phishing, a phishing detector.

Webpage phishing detection using deep reinforcement learning

Events within a computer system are grouped in order to identify security threats and, in some cases, perform an action to mitigate the threat. In some aspects, a computing system event that meets a criterion, are identified. A first layer of computing resources is determined which includes computing resources referenced during the computing system event. A second layer of computing resources is then determined, the second layer including one or more of a parent process or file loaded by the first layer processes, a process writing to a file included in the first layer of computing resources, or a previous version of a file included in the first layer of computing resources. Similarities between computing resource pairs in the first and second layers are determined, and a group of high similarity pairs related to each other is identified. In some embodiments, a mitigating action is identified based on the group.

Layered analysis for network security risk detection

Growing community of inventors

Bellevue, WA, United States of America

Jugal Parikh