Microsoft Technology Licensing, LLC

Peleg Hadar

Shay Kels

Jonathan Bar Or

Moran Neuhof

Techniques are described herein that are capable of detecting a spoofed entity based on complexity of a distribution of events initiated by the spoofed entity. Frequencies with which events of event types are initiated are determined by an entity during a designated period of time. Complexity of a distribution of the events among the event types is determined based at least on the frequencies with which the events of the event types are initiated by the entity during the designated period of time. Based at least on the complexity of the distribution of the events among the event types being less than or equal to a complexity threshold, the entity is identified as a spoofed entity associated with a spoofing attack. A security action is performed with regard to the entity based at least on the entity being identified as the spoofed entity associated with the spoofing attack.

Growing community of inventors

Tel Aviv, Israel

Peleg Hadar