Check Point Software Technologies Ltd.

Natan Katz

Erez Israel

Dor Livne

Lior Goldman

Amit Elhelo

Dmitry Zinkevich

Michael Abramzon

Ofek Dadush

Raphael Lior Gozlan

Avner Duchovni

Daniel Cohen-sason

A device and method for classifying network devices based on their manufacturer (also referred to as vendor or brand) and function (e.g., printer, car, thermostat, etc.). This classification process utilizes a trained model that leverages parameters associated with the device's network activity as input.

Network device classification

A device, system, and method are provided for generating a network security policy automatically based on network traffic. The network security policy is generated by building a directional graph from the network traffic, with the nodes of the graph representing network end points, and the edges representing communication between two nodes on a communication channel. A feature vector is generated for each of the nodes and a graph neural network is applied to the feature vectors to generate output vectors. The output vectors are clustered using a cost function based on a weighted combination of a distance-based cost function and a network functionality cost function. The clusters generated from the output vectors are used to assign network security rules to each of the clusters.

Autonomous network policy generator

A method and system are provided for detecting malicious code using graph neural networks. A call graph is created from the computer code by identifying functions in the computer code and vectorizing the identified functions using a stream of application programming interfaces (APIs) called by the functions and using tokens generated for the functions using a byte pair tokenizer. A trained graph neural network (GNN) and a trained attention neural network are applied to the call graph to generate an output graph with each node representing a function and each node assigned weights based on a probability distribution of the maliciousness of the corresponding function. A graph embedding is generated by calculating a weighted sum of the assigned weights and a trained deep neural network is applied to the graph embedding to generate a malicious score for the computer code identifying the computer code as malicious or benign.

Malicious VBA detection using graph representation

A device, system, and method are provided for detecting an email phishing attack by training graph neural network to detect phishing emails based on hypertext markup language (HTML) tags and cascading style sheets (CSS) included in an email. Noise is added during the training of the graph neural network to make the trained graph neural networks more robust against small changes in the training data.

Phishing detection using HTML

Growing community of inventors

Tel Aviv, Israel

Natan Katz