Amazon Technologies, Inc.

Matthew Michael Sommer

Brendan Cruz Colon

Christopher Miller

Alexander Noble Adkins

Matthew Ryan Jezorek

Adam Edward Powers

Maciej Broda

Joshua Hansen

Bruce Sherrod

Jason Cetina

Jason L Thalken

Dennis Naylor Brown

Kimberly A Young

Michael Chad McClure

Jessica Erin Clark

Daniel Azuara

Consuelo Manas Pilot

Laura Jane Hayward

Joe Stapleton

Aaron Boswell

Kellen K Axten

Lance Dennis Leishman

Samantha Felice

Diana Keller

Michael Alexander Cecil

Joel Booker

Dorion Carroll

Douglas Allan Peabody

Paul Clarke

A system enriches detections of anomalous computer-related activity with output from a language model. The detection and enrichment system uses Bayesian inference to model the likelihood that a co-occurrence of a detection event and an enriched detection event indicate an actual attack. The detection and enrichment system uses a question answering model, to process text data, such as, but not limited to, transcripts or emails. A language model is trained to detect potential attacks based on labelled training data, such as, but not limited to, transcripts or emails with examples of a type of attack.

Enriched anomalous computer activity detection with language models

Devices and techniques are generally described for detection of fraud in text. In various examples, ground truth text data comprising a plurality of first transcripts related to fraudulent activity may be received. In some examples, a respective first data representation of each transcript of the plurality of first transcripts may be generated. Unlabeled text data including a plurality of second transcripts may be received. Second data representations of each transcript of the plurality of second transcripts may be generated. A plurality of clusters may be determined. A number of nearest neighbors that are associated with the plurality of first transcripts related to fraudulent activity may be determined for a first instance of the second data representations. A determination may be made that the first instance of the second data representations corresponds to a transcript related to fraudulent activity.

Fraud detection in text

A method includes generating a set of training data, wherein a first training instance of the set of training data comprises a first plurality of messages between a first customer service agent and a first purported customer and a first label indicating whether one or more messages of the first plurality of messages are associated with malicious behavior; training a large language model (LLM) using the set of training data to generate messages; generating, by the LLM representing a second purported customer, a message associated with malicious behavior; receiving a response message from a second customer service agent based on the message associated with malicious behavior; and in response to the response message being an authorization, generating a feedback for the second customer service agent based on a number of responses before the response was an action.

Large language model to detect and emulate malicious activity

Captures or recordings of sensitive information or data displayed on screens or displays are detected by generating unique identifiers of users and embedding linked codes including such identifiers into the information or data. When the information or data is accessed by a user and displayed on a screen, and an image of the information or data is captured by a camera of a mobile device or other system, the camera detects a code within the images and requests to access a page or other networked resource associated with a link embedded in the code. Upon detecting a request to access such a page, the request may be attributed to the user. Upon detecting a unique identifier within an image depicting sensitive information, the image may be attributed to the user.

Detecting out-of-band screen captures and recordings

Devices and techniques are generally described for unused identity and access management rights detection. In various examples, a first skill-usage vector associated with a first profile may be determined. A first nearest neighbor algorithm and the first skill-usage vector may be used to determine a second skill-usage vector grouped together with the first skill-usage vector in a feature space, where the second skill-usage vector is associated with a second profile. A first rights vector associated with the first profile may be determined. The first rights vector associated with the first profile may be compared to a second rights vector associated with the second profile. At least one unused right associated with the first profile may be determined based at least in part on the comparing of the first rights vector to the second rights vector.

Peer-based inference of unused identity and access management rights

Devices and techniques are generally described for peer-based anomalous rights detection. In various examples, a rights vector may be determined for a first individual, the rights vector representing rights held by the first individual. A nearest neighbor algorithm may be used to determine a set of individuals having similar rights to the first individual. In various examples, a category label associated with the first individual may be determined. In some examples, a number of individuals of the set of individuals having the category label may be determined. In some examples, a determination may be made that the rights held by the first individual are anomalous based at least in part on the number. In some cases, alert data indicating that the rights held by the first individual are anomalous may be generated.

Peer-based, angular distance detection of anomalous rights

Devices and techniques are generally described for evaluation of text data using large n-grams. In various examples, a first vector may be generated for first text data, wherein each element of the vector comprises a value indicating whether the first text data includes a respective n-gram included in a corpus of text data. First label data indicating that a user associated with the first text data has connected to a first computer-implemented service more than a threshold number of times during a past time period may be determined. A first machine learning model may be trained based at least in part on the first vector and the first label data. The first machine learning model may be used to determine a first probability associated with a first n-gram of the first vector. In some examples, at least a first user associated with the first n-gram may be determined.

Anomalous source detection in high-dimensional sequence data

Devices and techniques are generally described for anomalous computer activity detection. In various examples, first computer activity data associated with a first account may be determined. A first linear detection event that corresponds to the first computer activity data may be determined. In some examples, a set of gradient-based data associated with the first linear detection event may be determined. The set of gradient-based data may represent comparative analysis of the first computer activity data with computer activity data of other accounts. In some examples, first data representing the first linear detection event and the set of gradient-based data may be generated. In various cases, network access for the first account may be disabled based on the first data.

Anomalous computer activity detection and prevention

Disclosed are various embodiments providing automated management of security operations centers. In one embodiment, a correlation and decision engine correlates event data generated by a plurality of monitoring services with a plurality of alerts generated by a plurality of threat intelligence services. The engine then adjusts at least one rule of one or more threat intelligence services with respect to at least one event based at least in part on a corresponding frequency of at least one of the plurality of alerts meeting a threshold, where the adjusted alert(s) are associated with the event(s).

Automated management of security operations centers

An electronic message delivery service receives a request to transmit an electronic message to a recipient. In response to the request, the electronic message delivery service determines first information from the electronic message usable to uniquely identify the electronic message. The electronic message delivery service obtains, based at least in part on the first information and a cryptographic key, cryptographic information that can be inserted into the electronic message. The electronic message delivery service inserts the cryptographic information and second information usable to validate at least a portion of the electronic message with the cryptographic information into the electronic message. The electronic message is transmitted to the recipient.

Electronic message authentication

Growing community of inventors

Issaquah, WA, United States of America

Matthew Michael Sommer