Sri International

Keith M Skinner

Phillip Andrew Porras

Kenneth C Nitz

Dayne B Freitag

Steven Mark Dawson

Alfonso De Jesus Valdes

Paul Stern Kalmar

A method for creating a training playbook to train a potential target of social engineering against an attack by an adversarial actor includes generating a training playbook based on a plurality of conversational patterns from a respective plurality of dialogs between non-human synthetic persona with the adversarial actor. A given conversational pattern of the plurality of conversational patterns comprises one or more dialog interaction elements utilized by the adversarial actor during a respective dialog of the plurality of dialogs. The method also includes configuring a dialog model for a second synthetic persona to engage in a training dialog with a target trainee to train the target trainee to detect, avoid and/or mitigate a future attack by the adversarial actor. The dialog model is configured to emulate the future attack by the adversarial actor by utilizing the training playbook. The method additionally includes outputting the training playbook.

Systems and methods for training against adversarial attacks

A method of determining an adversarial attack playbook includes receiving, from an adversarial actor, an electronic communication intended for a target user. The method includes engaging in a deep dialog with the adversarial actor by deploying a synthetic persona dynamically during the electronic communication. The deep dialog includes multiple rounds of communication exchanges. The method includes determining a length and type of the deep dialog to obtain attributes related to the adversarial actor. The method includes identifying a conversational pattern from the deep dialog. The conversational pattern comprises dialog interaction elements utilized by the adversarial actor. The method includes dynamically producing, based on the conversational pattern, the playbook associated with the adversarial actor. The playbook is indicative of a dialog interaction strategy implemented by the adversarial actor. The method includes providing the playbook to a social engineering attack (SEA) system in order to detect, avoid and/or mitigate future attacks.

Conversation-depth social engineering attack detection using attributes from automated dialog engagement

A network security policy may be implemented at network switches as a set of active packet disposition directives. In a dynamically programmable network, the network switches can be dynamically reprogrammed with packet disposition directives. A security actuator receives flow policy directives from a number of network applications. The flow policy directives express higher-level network security policy goals, including blocking and/or redirecting network traffic. The security actuator converts a flow policy directive into one or more packet disposition directives. The packet disposition directives may include trigger rules to cause network communications to be monitored for matching trigger packets. An automated mechanism initiated by the security actuator may cause trigger packets to be forwarded to the security actuator for analysis. The security actuator may generate packet disposition directives in response to receiving the trigger packets.

Security actuator for a dynamically programmable computer network

This invention uses probabilistic correlation techniques to increase sensitivity, reduce false alarms, and improve alert report quality in intrusion detection systems. In one preferred embodiment, an intrusion detection system includes at least two sensors to monitor different aspects of a computer network, such as a sensor that monitors network traffic and a sensor that discovers and monitors available network resources. The sensors are correlated in that the belief state of one sensor is used to update or modify the belief state of another sensor. In another embodiment of this invention, probabilistic correlation techniques are used to organize alerts generated by different sensors in an intrusion detection system. By comparing features of each new alert with features of previous alerts, rejecting a match if a feature fails to meet or exceed a minimum similarity value, and adjusting the comparison by an expectation that certain feature values will or will not match, the alerts can be grouped in an intelligent manner.

Growing community of inventors

Sunnyvale, CA, United States of America

Keith M Skinner