Mcafee, Inc.

Musarubra US LLC

Pablo Andres Michelis

Brian Howard Stewart

Gabriel G Infante-Lopez

Hemang Satish Nadkarni

Francisco Matias Cuenca-Acuna

Howard Don Stewart

Brian Roland Rhees

Seth D Grover

Matias L Marenchino

Maria Torino

German Lancioni

Example apparatus disclosed herein to perform a cybersecurity investigation are to generate an information graph based on a set of information seeker tools in response to detection of a threat alert in a monitored network, and search the information graph for a reference pattern associated with a cybersecurity threat. Disclosed example apparatus are also to, in response to detection of a portion of the reference pattern in the information graph, (i) select a first one of information seeker tools associated with a first input-output relationship capable of expanding the portion of the reference pattern to complete the reference pattern, and (ii) execute the first one of information seeker tools to complete the reference pattern associated with the cybersecurity threat.

Cybersecurity investigation tools utilizing information graphs

Methods, apparatus, systems and articles of manufacture are disclosed to facilitate malware detection using compressed data. An example apparatus includes an input processor to obtain a model, the model identifying a first sequence associated with a first trace of data known to be repetitive, a sequence identifier to identify a second sequence associated with a second trace of data, a comparator to compare the first sequence with the second sequence, and an output processor to when the first sequence matches the second sequence, transmit an encoded representation of the second sequence to the central processing facility using a first channel of communication, and when the first sequence fails to match the second sequence, transmit the second sequence to the central processing facility using a second channel of communication, the second sequence to be analyzed by the central processing facility to identify whether the second sequence is indicative of malware.

Methods and apparatus to facilitate malware detection using compressed data

Example apparatus disclosed herein to perform a cybersecurity investigation include a graph generator to iteratively generate an information graph based on investigative data in response to detection of a threat alert in a monitored network, the investigative data accessed from information sources based on a set of information seeker tools, the information graph generated based on a graph schema specifying possible relationships between the information seeker tools. Example apparatus also include a pattern recognizer to traverse the information graph to identify a path in the information graph matching a pattern from the graph schema associated with a cybersecurity threat. Example apparatus further include a user interface to output the path identified in the information graph and the cybersecurity threat to an output device.

Methods, apparatus, systems and articles of manufacture are disclosed. An example partitioned computer database system includes a plurality of nodes, a data director to distribute a plurality of portions of database data across the plurality of nodes, queriers associated with respective ones of the plurality of nodes, the queriers to execute respective sub-queries of respective portions of the database data, and a coordinator to receive a request to query the database data, and merge results of the plurality of sub-queries to form a response to the request.

Methods, apparatus, and systems to aggregate partitioned computer database data

According to some embodiments, so-called 'NS-Tree' indexes may be used to calculate whether all (or a portion) of two independent tables are consistent. The NS-Tree indexes may be comprised of various elements, e.g., a synchronization time, a primary key, a hash of the complete record itself, and an aggregate value associated with each index entry (e.g., an accumulated XOR value). At any point in the index, an entry may possess the accumulated aggregate value of all key entries in the table up to that point. That aggregate value may be used to validate data consistency with another table(s) maintaining the same index. Due to the unique composition of the NS-Tree index, users can also validate two data sets within a 'sub-range' of the entire data set. According to other embodiments, NS-Tree indexes may also be applied to two different clusters of nodes by applying the NS-Trees at a 'federated' level.

Aggregate, index-based, real-time verification of node contents

A method includes receiving a first index of records in a first table and a second index of records in a second table. Each index entry of the indexes includes an aggregate value associated with the data in its respective record. The method further includes determining that the first table is inconsistent with the second table by comparing the aggregate values of a pair of indicator index entries of the indexes. The method further includes identifying a first pair of corresponding index entries from the indexes for which the aggregate values of the corresponding index entries are inconsistent and synchronizing records corresponding to the first pair of corresponding index entries. The method further includes updating the aggregate values of the index entries of the indexes and comparing the updated aggregate values of the pair of indicator index entries to determine whether the first table and the second table are consistent.

Growing community of inventors

San Jose, CA, United States of America

Pablo Andres Michelis