Salesforce Com, Inc.

Cisco Technology, Inc.

Salesforce, Inc.

Opendns, Inc.

Ping Yan

Huy Nhut Hang

Wei Deng

Philip Raymond Nadeau

Matthew Saunders

Tejinder Singh Aulakh

John Slater

Hui Fung Herman Kwong

Paul Tantsis

Amit Bhardwaj

Andrew K Lie

Lisong Liu

Techniques for user behavior anomaly detection. At least one low-variance characteristic is compared to an expected result for the corresponding low-variance characteristics to determine if the low-variance characteristic(s) is/are within a pre-selected range of the expected results. A security response action is taken in response to the low-variance characteristic not being within the first pre-selected range of the expected results. At least one high-variance characteristic is compared to an expected result for the corresponding high-variance characteristics to determine if the high-variance characteristic(s) is/are within a pre-selected range of the expected results. A security response action is taken in response to the high-variance characteristic not being within the first pre-selected range of the expected results. Access is provided if the low-variance and the high-variance characteristics are within the respective expected ranges.

Feature-agnostic behavior profile based anomaly detection

Architectures and techniques for in-app behavior detection. A behavior detection agent within an application running on a hardware computing device captures events within the application. The events are inputs received from one or more sources external to the application. The behavior detection agent generates an event stream from the captured events. The behavior detection agent analyzes the event stream for significant feature frequencies and associations corresponding to one or more attack profiles. The behavior detection agent initiates an attack response in response to finding one or more significant feature frequencies and associations. The attack response comprises at least changing an operational configuration of the application.

In-app behavior-based attack detection

Threat detection in a multi-organizational environment. Attribute data corresponding to accesses to a multi-organizational environment and entity data corresponding to accesses to the multi-organizational environment are maintained. A graph based on the attribute data and the entity data where graph edges represent a relationship between an attribute and an entity is generated. Subsequent access are compared to the graph to determine if the subsequent access corresponds to a new relationship. The subsequent access is allowed if the subsequent access does not correspond to a new relationship. The subsequent access further analyzed if the subsequent access corresponds to a new, unexpected relationship.

Techniques and architectures for cross-organization threat detection

In-app behavior-based attack dectection

Systems and methods for domain classification using the network request behavior of clients are provided. The network requests of a plurality of clients are analyzed to determine a domain corresponding to each request. This information can be used to associate a set of domains with each individual client. Because of the reciprocal nature of a network request, the information is also used to associate a set of clients with each individual domain. Within the plurality of domains associated with the plurality of clients, there may exist known domains having a classification and unknown domains having no classification. Based on the correlation of clients and domains from their respective associations, the system generates domain classification information for at least one of the unknown domains.

Domain classification based on client request behavior

A system and method for performing an upgrade in a communication network comprising network elements coupled together to form one or more circuits are disclosed. In one embodiment, the upgrade is generated at a node in communication with the circuits and the method generally comprises providing a list of circuits or spans available for the upgrade and receiving input from a user identifying at least one circuit to be upgraded or at least one span for the upgraded circuit and a type of upgrade to be performed. The method further comprises automatically performing the upgrade.

Method and system for performing circuit upgrade

Growing community of inventors

San Francisco, CA, United States of America

Ping Yan