Emc Corporation

Emc IP Holding Company LLC

Lior Asher

Marcelo Blatt

Alex Zaslavsky

Ido Zilberberg

Alon Kaufman

Zohar Duchin

Oleg Freylafert

Erez Yakoel

Ayelet Biger Levin

Techniques of operating intrusion detection systems provide a recommendation of an intrusion detection rule to an administrator of an intrusion detection system based on the experience of another administrator that has used the rule in another intrusion detection system. For example, suppose that electronic circuitry receives a numerical rating from a first intrusion detection system that indicates whether an intrusion detection rule was effective in identifying malicious activity when used in the first intrusion detection system. Based on the received rating and attributes of the first intrusion detection system, the electronic circuitry generates a predicted numerical rating that indicates whether the intrusion detection rule is likely to be effective in identifying malicious communications when used in a second intrusion detection system. If the predicted numerical rating is sufficiently high, then the electronic circuitry transmits a message to the second intrusion detection system recommending the intrusion detection rule for use in the second intrusion detection system.

Automatic selection of malicious activity detection rules using crowd-sourcing techniques

Methods, apparatus and articles of manufacture for risk scoring for internet protocol networks are provided herein. A method includes identifying a network to which a first network element belongs, wherein said first network element comprises corresponding risk-related information, determining each of one or more network elements previously identified as belonging to the network, and calculating a risk score assigned to the network, wherein said calculating comprises aggregating (i) the risk-related information corresponding to the first network element and (ii) risk-related information corresponding to each of the one or more network elements previously identified as belonging to the network.

Risk scoring for internet protocol networks

There is disclosed a technique for use in providing an assessment of authentication requests. In one embodiment, the technique comprises receiving an authentication request with post-authentication feedback and an authentication request with no post-authentication feedback. In the same embodiment, the post-authentication feedback can include a marking indicating that the request is one of a genuine or fraudulent status after review by an analyst. If a request does not possess a post-authentication feedback then it is considered genuine status. The technique can then assign the status of the requests to a distinctive attribute associated with the requests before performing a computation which produces a computational result that is indicative of the risk associated with the distinctive attribute.

Method, apparatus and computer program product for assessing risk associated with authentication requests

There is disclosed herein a technique for use in providing an assessment of authentication requests. In one embodiment, the technique comprises obtaining authentication data that relates to an attribute of authentication requests in a current time period and a previous time period. The technique also comprises applying a weight to the authentication data that relates to the attribute of authentication requests in the previous time period and performing a computation involving the weighted authentication data and the authentication data that relates to the attribute of authentication requests in the current time period. The computation producing a computational result. The technique still further comprises providing the computational result for use in processing future authentication requests.

Providing an assessment of authentication requests

Methods, apparatus and articles of manufacture for providing an automatic electronic fraud network data quality feedback loop are provided herein. A method includes evaluating an item of input data provided by a given source, wherein the item of input data comprises a fraud-related status identifier provided by the given source, and wherein said evaluating comprises determining a level of accuracy associated with the fraud-related status identifier; outputting the determined level of accuracy associated with the fraud-related status identifier to the given source; and updating a trust measure associated with the given source based on the determined level of accuracy associated with the fraud-related status identifier provided by the given source.

Growing community of inventors

Tel Aviv, Israel

Lior Asher