Emc IP Holding Company LLC

Leandro Diato

Naveen Sunkavally

Victor Malchikov

Alex Zaslavsky

Kevin T Douglas

Diptanu Das

Nicholas H Hoang

Kien Nguyen

Techniques are provided for distribution-based aggregation of scores across multiple events. One method comprises obtaining a plurality of individual scores associated with a plurality of events; obtaining an expected distribution for the plurality of individual scores; and generating an aggregate score for the plurality of individual scores based on a deviation of the plurality of individual scores from the obtained expected distribution for the plurality of individual scores. The aggregate score, for example, reflects how closely the individual scores follow the expected distribution. The aggregate score comprises, for example, an aggregate risk score that: (i) is compared across different vectors of an organization; (ii) is used to create a security policy and/or modify a security policy; and/or (iii) triggers an alert based on one or more predefined threshold criteria. The multiple aggregate risk scores can be visualized in one or more geographic regions and/or sub-networks of an organization.

Distribution-based aggregation of scores across multiple events

Methods, apparatus, and processor-readable storage media for identifying and determining the criticality of enterprise assets using network traffic information are provided herein. An example computer-implemented method includes capturing network session information from an enterprise network; identifying multiple assets within the enterprise network by processing the captured network session information; determining, for each of the identified assets, one or more predefined features of the asset based at least in part on the processing of the captured network session information; determining, for each of the identified assets, a level of criticality associated with the asset based at least in part on the one or more determined features of the asset; and outputting the level of criticality and an identifier of the asset associated therewith to a security-related system, wherein the level of criticality and the asset identifier are used by the security-related system to take at least one automated action.

Determining criticality of identified enterprise assets using network session information

Techniques are provided for visualizing user access data and for configuring and enforcing location-based access policies. One method comprises obtaining a plurality of risk-based policies specified by administrators using a map-based interface for multiple geographic regions, wherein the map-based interface comprises one or more zoom levels within each geographic region of the geographic regions, and wherein each geographic region has an associated aggregated risk score indicating a level of risk for user access events that occurred within the respective geographic region; and performing the following steps, in response to a user access event: determining a geolocation of the user access event; identifying a particular geographic region associated with the determined geolocation; identifying one or more of the plurality of risk-based policies associated with the particular geographic region; and processing the user access event based on the identified risk-based policies associated with the particular geographic region.

Map-based techniques for visualizing user access data and for configuring and enforcing location-based access policies

Methods, apparatus, and processor-readable storage media for machine learning risk assessment utilizing calendar data are provided herein. An example computer-implemented method includes processing historical calendar data attributed to users on a network; generating, based on the processed historical calendar data and historical user activity data associated with the network, a machine learning user activity model; processing input data, wherein the input data comprise additional user activity data associated with the network attributed to one of the users and additional calendar data temporally related to the additional user activity data; generating a risk assessment output for the user by applying the machine learning user activity model to the processed input data; and providing the risk assessment output to one or more risk management entities within the network for execution of one or more automated actions based on the risk assessment output.

Growing community of inventors

San Francisco, CA, United States of America

Leandro Diato