Acronis International Gmbh

Nickolay Berko

Stanislav Protasov

Serg Bell

Ivan Klimov

A system and method for updating a digital fingerprint library storing data fingerprints with hierarchical security classification levels. The digital fingerprint library is updated when new fingerprints are presented for inclusion in the library. When a new fingerprint matches a fingerprint in the library, the library's fingerprint is updated. When the new fingerprint does not have a match in the library, the new fingerprint is added to the library.

Generation of the digital fingerprints library with hierarchical structure

A system to optimize required resources at an endpoint needed to monitor a user behavior for abnormalities with the endpoint includes a processor processing a plurality of agents running at the endpoint to intercept network traffic metrics, intercept device access metrics, intercept app-specific user-mode metrics, parse intercepted data, and submit the intercepted data to a backend component at a server to collect the intercepted data from the endpoint, predict deviation from a normal profile, in which the backend component assesses available characteristics of a particular endpoint, calculates an endpoint user profile, calculates a degree of variance (DoV) between the user profile and the normal profile, compares the calculated DoV to a predetermined Variance Threshold (VT), and predicts, based on machine learning algorithms, a movement of a trend of the DoV within the VT, creates an adjusted metrics list, and distributes adjusted metrics to a related endpoint.

User behavior anomaly detection-sensors

The invention relates to a system and method that relates to creation of a digital fingerprint library for storing information of a document containing protected information. The system mainly includes a fragment generator, a fingerprint value generator, and the digital fingerprint library. The fragment generator generates fragments of the document using a sliding window method. Fragment length is determined heuristically, can be hardcoded in the program or be a parameter in GUI. The fingerprint value generator generates a fingerprint value, e.g., its hash, for each fragment. The fingerprint value represents the information related to respective fragments. The digital fingerprint library then stores the fingerprint value. Fingerprint values of individual fragments serve as key values to provide a mechanism for comparing fragments of unknown files to the digital fingerprint library.

System and method for creating a digital fingerprint library

A system to create Data Loss Prevention (DLP) policies and adjust DLP policies over time in a computing system using agents running at an endpoint to intercept a data transfer in a network traffic. New data flow/DLP policy rules are created and updated with reference to behavior data of trusted and untrusted users.

Policy creation and adjustment methods

A system of monitoring a user behavior for abnormalities compared to a group behavior includes a processor configured to implement instructions for a user to group behavior signature monitor (UGBSM) with at least one user, as a monitored user, and a group of one or more users, as baseline users, to access to certain characteristics of the monitored user and certain characteristics of the baseline users, calculate a user behavioral signature of the monitored user, calculate a group behavioral signature of the baseline users, calculate a degree of variance (DoV) between the user behavioral signature of the monitored user and the group behavioral signature of baseline users, and compare the calculated DoV to a variance threshold to determine whether the user behavioral signature of the monitored user is similar or is different from the group behavioral signature of the baseline users.

User in group behavior signature monitor

A system of automatically managing assignments of users to user groups comprises

Automatic user group manager

A system for automatic recognition of security incidents includes a processor coupled to a memory storing instructions, the processor being configured to implement the instructions for an automatic incident generator (AIG) with at least one type of events related to the system, and access to a repository of information about previously recorded incidents with the events related to these previously recorded incidents, to monitor a plurality of events, identify sequences of events including suspected signatures that are capable of constituting an incident, calculate a degree of variance (DoV) of the suspected signatures and at least one signature related to a previously recorded incident, compare the DoV to at least one threshold and, if the DoV is less (or less or equal) to the threshold, identify the incident and optionally initiate the workflow related to the identified incident.

Automatic incident generator

A system for identifying of presence of protected data in an unknown file includes a processor coupled to a memory storing instructions, the processor being configured to implement the instructions to apply a sliding window process to generate one or more fragments of length, for each generated fragment, check whether information about the generated fragment exists in a library of known fragments of protected data, and if the information about the generated fragment from the unknown file exists in the library of known fragments of protected data, perform steps to reflect an existence of the information about the generated fragment.

Automatic identification of files with proprietary information

An automatic incident dispatcher calculates an incident signature of a new incident, calculates a degree of variance (DoV) of the new incident from an incident signature of the previously classified incident, compares the calculated DoV to a predetermined threshold, and determines that the new incident belongs to a same class as a class of the previously classified the new incident if the calculated DoV is less than or equal to the threshold.

Growing community of inventors

Schaffhausen, Switzerland

Nickolay Berko