Microsoft Technology Licensing, LLC

Oran Brill

Roy Levin

Royi Ronen

Moshe Israel

Yotam Livny

Dotan Patrich

Elad Ziklik

Naama Kraus

Tomer Teller

Tom Jurgenson

Vlad Korsunsky

Assaf Israel

Maya Maimon

Tools and techniques are described to automate triage of security and operational alerts. Insight instances extracted from raw event data associated with an alert are aggregated, vectorized, and assigned confidence scores through classification based on machine learning. Confidence scoring enables heavily loaded administrators and controls to focus attention and resources where they are most likely to protect or improve the functionality of a monitored system. Feature vectors receive a broad base in the underlying instance values through aggregation, even when the number of instance values is unknown prior to receipt of the event data. Visibility into the confidence scoring process may be provided, to allow tuning or inform further training of a classifier model. Performance metrics are defined, and production level performance may be achieved.

Enhancing cybersecurity and operational monitoring with alert confidence assignments

Methods are provided for building and tuning a correlation data structure. The correlation data structure includes relationship correlations with relationship scores that reflect the level of correlation between alert conditions and feature set events that occurred in a machine. Each relationship correlation further includes a time of influence associated with the times of occurrence for each alert condition and corresponding feature set event. The correlation data structure is built and tuned using sourcing to leverage the alert conditions and feature set events on each machine for all machines in the network. Methods are also provided to use the correlation data structure to monitor the machines in a network, detect feature set events, and detect if alert conditions correlated with those feature set events are likely to occur. The methods further provide for mitigating those alert conditions.

Detection of attacks in the cloud by crowd sourcing security solutions

A method includes acts for filtering auto consumption recommendations and auto consumption actions. The method includes receiving from a recommendation system, a recommendation of an asset for consumption. The asset for consumption is evaluated in the context of one or more filter rules regarding auto consumption. The filter rules are configured to filter recommended assets from being consumed when certain criteria are met or to permit recommended assets to be consumed when certain criteria are met. As a result, the method includes identifying one or more constraints on how recommended asset should be consumed. The method further includes filtering consumption of the recommended asset based on the one or more constraints.

Modes, control and applications of recommendations auto-consumption

Growing community of inventors

Modiin, Israel

Oran Brill