Hewlett-Packard Development Company, L.p.

Micro Focus Lcc

Hewlett Packard Enterprise Development LP

Other

Martin Arlitt

Manish Marwah

Cullen Edwin Bash

Pratyusa Kumar Manadhata

Chandrakant D Patel

Amip J Shah

Jerome Alexander Rolia

Jerry Rolia

Keith Farkas

Geoff M Lyon

Xiaoyun Zhu

Alkiviadis Simitsis

Chris Deon Hyser

Gowtham Bellala

Yuan Chen

Daniel Juergen Gmach

Thomas W Christian

Barak Raz

Kyle Williams

Ratnesh Kumar Sharma

Michael F Angelo

Douglas M Grover

Sven Graupner

Martha Lurie Lyons

Mijung Kim

Marie-Jo Fremont

Sergey Blagodurov

Tahir Cader

Sharad Singhal

Dirk Manfred Beyer

Xue Liu

Alex Xin Zhang

Subramoniam N Iyer

Fereydoon Safai

Wei-Nchih Lee

Naren Ramakrishnan

Artur Andrzejak

Maria Pospelova

Stephan F Jou

Thomas Turicchi

Muhammad Ihsanulhaq Sarfraz

Abdul Wasay

Jose Alberto Cueto Barcenas

Sherif Abdelwahab

Richard Shaw Kaufmann

Prithwish Chakraborty

Hyungsul Kim

Sandro Rafaeli

Amit Singh Rathore

Daniel Jurgen Gmach

Pezhman Jasper Sheini

Kristian Edward Ford

Large language models (LLMs) are versatile in responding to user questions on a wide variety of topics. However, LLMs suffer from several drawbacks, such as hallucinations, incomplete information, and inability to cite original sources of information. Disclosed herein are systems and methods for using an LLM in a restricted manner to respond to queries regarding document corpora, e.g., documents related to a set of products, such that the impact of these drawbacks is minimized. Information retrieval is coupled with LLMs to build a question and answer (Q&A) system on the text corpora. Complex retrieved information, incorporating human feedback, and recommendations in the Q&A system are provided.

Augmented question and answer (Q and A) with large language models

Thread information generated by one or more computing systems is captured. A thread pattern is identified from the captured thread information. The thread pattern is compared to a learned thread pattern. An anomaly is identified in the thread pattern based on a variance from the learned thread pattern. In response to identifying the anomaly in the thread pattern, an action is taken based on the anomalous thread pattern. For example, a user may be notified. The thread patterns may be extended to compare between operating systems, hypervisors, containers, and/or virtual machines.

Using thread patterns to identify anomalous behavior

A secondary fragment of an encryption key is received. The secondary fragment is associated with an authentication process of a user. The secondary fragment is one of a plurality of secondary fragments of the encryption key. The user is authenticated (e.g., by validating a username/password). The encryption key is regenerated using the secondary fragment and a primary fragment of the encryption key. In response to regenerating the encryption key using the secondary fragment and the primary fragment, and authenticating the user: access is granted, to the user, by unencrypting an encrypted data record using the regenerated encryption key.

System and method for managing fragmented encryption keys for granting access

Network traffic is monitored over a period of time (e.g., network traffic of a corporate network). Based on the monitored network traffic: an abstract temporal graph of the network traffic is generated; graph-based node embeddings of the abstract temporal graph are learned; edge tabular embeddings for edges of the abstract temporal graph are learned; and hybrid embeddings are computed. The computed hybrid embeddings are based on the learned graph-based node embeddings for the abstract temporal graph and the learned edge tabular embedding for the edges of the abstract temporal graph. This process is then repeated over multiple time periods and temporal trajectories are computed using the computed hybrid embeddings for each time period. The temporal trajectories are then used for analysis of the network. For example, the temporal trajectories are used to identify anomalies for prevention of security breaches of the network.

Hybrid graph-based representation

Embodiments of the disclosure provide systems and methods for analyzing log files. Automated processing of log files can comprise reading a log file generated during execution of an application and comprising a plurality of log events and generating a plurality of templates based on the plurality of log events in the log file. Each template can map a log event to a candidate value for the log event. The plurality of log events can be aggregated into a plurality of groups based on the candidate value mapped to each log event in the plurality of templates and the plurality of groups of log events can be ranked. The log file can be partitioned based on the ranking of the plurality of groups of log events and one or more groups of log events can be provided to an analysis process based on the partitioning of the log file.

Automated preprocessing of complex logs

Log entries and baseline log entries have timestamps, and can be structured over columns of respective data types. Temporal inconsistency can be identified by comparing a probability distribution of time differences between the timestamps of the log entries with a probability distribution of time differences between the timestamps of the baseline log entries. Data type inconsistency can be identified by comparing a data type of each column of the log entries with a data type of a corresponding column of the baseline log entries. Columnar inconsistency can be identified by comparing a number of the columns of the log entries with a number of the columns of the baseline log entries. In response to identification of temporal, data type, and/or columnar inconsistency, that an abnormality exists in collecting the log entries is detected.

Abnormality detection in log entry collection

A network traffic flow is directed to a computing services system is determined as being unrelated to the service that the system provides. In response, the network traffic flow is deflected away from the computing services system. Demand of the sender of the network traffic flow is managed by shaping the deflected network traffic flow in responding to the sender and/or by misinforming the sender in responding to the sender.

Demand management of sender of network traffic flow

A service receives, from client computing devices of client networks, information regarding incoming network traffic addressed to dark Internet Protocol (IP) address spaces the of client networks. The service can predict a cyber attack based on the information received from the client computing devices of the client networks. The server computing device notifies the client computing device of each client network affected by the predicted cyber attack.

Cyber attack prediction based on dark IP address space network traffic to plural client networks

Network communication events are filtered to remove the network communication events having a predicted unrelatedness to beaconing. Each network communication event has a timestamp, a source entity, and a destination entity. The filtered network communication events are aggregated by unique source entity-destination entity pairs. For each unique source entity-destination entity pair, the network communication events are timestamp-sorted, time differentials between the timestamps of adjacent network communication events are calculated, and a beacon likelihood metric is calculated from the calculated time differentials. Which of the unique source entity-destination entity pairs are indicative of beaconing are identified based on the beacon likelihood metric calculated for each unique source entity-destination entity pair.

Identification of beaconing from network communication events of network traffic log

Techniques and apparatuses are described to enable a strategically coordinated fictitious ecosystem of disinformation for cyber threat intelligence collection in a computing network. The ecosystem comprises fictitious profiles and supporting fictitious infrastructure information to portray in-depth, apparent authenticity of the ecosystem. Malicious communications from an adversary directed at the ecosystem are monitored, and threat intelligence about the adversary is collected to prevent future attacks.

Disinformation ecosystem for cyber threat intelligence collection

In some examples, a system constructs, based on event data representing a plurality of events in a system, a representation of the plurality of events, the representation including information relating the events, and computes issue indications corresponding to potential issues in the system. The system adds information based on the issue indications to the representation to form an enriched representation, and searches the enriched representation to find a chain of events representing an issue in the system.

Chain of events representing an issue based on an enriched representation

In some examples, a Domain Name System (DNS) server receives, over a network, DNS queries containing domain names, extracts a common domain name shared by the domain names, determines whether a measure of an amount of data relating to the DNS queries containing the common domain name exceeds a threshold, and in response to determining that the measure of the amount of data relating to the DNS queries containing the common domain name exceeds the threshold, trigger a countermeasure action to address a threat associated with the DNS queries.

Defending against domain name system based attacks

For each of a number of naming deviation types, the number of deviations within a domain name of a domain is determined. Each naming deviation type is a different type of deviation from domain name naming rules. For each naming deviation type for which the number of deviations is non-zero, first benign and malicious probabilities that benign and malicious domains, respectively, have the naming deviation type are estimated. Second benign and malicious probabilities that any given domain is respectively benign and malicious are estimated. Probabilities that the domain is benign and malicious are estimated based on the number of deviations for each naming deviation type and based on the estimated first and second benign and malicious probabilities. Whether the domain is benign or malicious is determined based on the estimated probabilities that the domain is benign and malicious.

Determining whether domain is benign or malicious

According to examples, an apparatus may include a memory on which is stored instructions that when executed by a processor, cause the processor to extract, from network traffic data, a connectivity matrix that identifies connectivity data between entities and group the entities into a plurality of clusters based on the extracted connectivity matrix. The processor may also, for each cluster of the plurality of clusters, identify at least one representative entity that is to represent the entities in the cluster and output the identified at least one representative entity for identification of group behaviors of the entities in the plurality of clusters, in which the identified group behaviors are to be used for information technology management.

Identifying representative entities in clusters for it management

First-order anomaly scores are received from related anomaly detectors. Each first-order anomaly score indicates a likelihood of an anomaly at a target system. A relatedness measure of the related anomaly detectors is determined, based on the first-order anomaly scores that have been received. A higher-order anomaly score is determined based on the relatedness measure that has been determined. The higher-order anomaly score indicates a likelihood of an anomaly at the target system. An anomaly at the target system is detected based on the higher-order anomaly score.

Anomaly detection based on higher-order anomaly score

Growing community of inventors

Calgary, Canada

Martin Arlitt