Cognyte Technologies Israel Ltd.

Verint Systems, Inc.

Offri Gil

Yitshak Yishay

Omer Ziv

Yuval Altman

Hodaya Shabtay

Omri David

Pinchas Birenbaum

Yaron Gvili

Gal Fridman

Yaron Gvilli

A traffic-monitoring system that monitors encrypted traffic exchanged between IP addresses used by devices and a network, and further receives the user-action details that are passed over the network. By correlating between the times at which the encrypted traffic is exchanged and the times at which the user-action details are received, the system associates the user-action details with the IP addresses. In particular, for each action specified in the user-action details, the system identifies one or more IP addresses that may be the source of the action. Based on the IP addresses, the system may identify one or more users who may have performed the action. The system may correlate between the respective action-times of the encrypted actions and the respective approximate action-times of the indicated actions. The system may hypothesize that the indicated action may correspond to one of the encrypted actions having these action-times.

System and method for de-anonymizing actions and messages on networks

Machine learning techniques for classifying encrypted traffic with a high degree of accuracy. The techniques do not require decrypting any traffic and may not require any manually-labeled traffic samples. An automated system uses an application of interest to perform a large number of user actions of various types. The system further records, in a log, the respective times at which the actions were performed. The system further receives the encrypted traffic exchanged between the system and the application server, and records properties of this traffic in a time series. Subsequently, by correlating between the times in the log and the times at which the traffic was received, the system matches each of the user actions with a corresponding portion of the traffic, which is assumed to have been generated by the user action. The system thus automatically builds a labeled training set, which may be used to train a network-traffic classifier.

System and method for using a user-action log to learn to classify encrypted traffic

Systems and methods for passive monitoring of computer communication that does not require performing any decryption. A monitoring system receives the traffic exchanged with each relevant application server, and identifies, in the traffic, sequences of messages&#x2014;or 'n-grams'&#x2014;that appear to belong to a communication session between a pair of users. Subsequently, based on the numbers and types of identified n-grams, the system identifies each pair of users that are likely to be related to one another via the application, in that these users used the application to communicate (actively and/or passively) with one another. The system may identify those sequences of messages that, by virtue of the sizes of the messages in the sequence, and/or other properties of the messages that are readily discernable, indicate a possible user-pair relationship.

System and method for identifying pairs of related application users

Growing community of inventors

Hod-Hasharon, Israel

Offri Gil