Mellanox Technologies, Ltd.

Nvidia Corporation

Rachel Allen

Bartley Richardson

Vadim Gechman

Rami Ailabouni

Ahmad Saleh

Thanh Nguyen

Haim Elisha

Nir Rosen

Michael Demoret

Hsin Chen

Ajay Anil Thorve

Allan Enemark

Ryan Kraus

Technologies for generating a graphical user interface (GUI) dashboard with a three-dimensional (3D) grid of unit cells are described. An anomaly statistic can be determined for a set of records. A subset of network address identifiers can be identified and sorted according to the anomaly statistic. The subset can have higher anomaly statistics than other network address identifiers. There can be a maximum number in the subset. The GUI dashboard is generated with unit cells organized by the subset of network address identifiers as rows, time intervals as columns, colors as a configurable anomaly score indicator, and a number of network access events as column heights. Each unit cell is a colored, 3D visual object representing a composite score of anomaly scores associated with zero or more network access events corresponding to the respective network address identifier at the respective time interval. The GUI dashboard is rendered on a display.

Finding anomalous patterns

Apparatuses, systems, and techniques for classifying a candidate uniform resource locator (URL) as malicious using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being words in a candidate URL and numeric features of a URL structure of the candidate URL. The security service classifies, using the ML detection system, the candidate URL as malicious or benign using the set of features. The security service outputs an indication of a malicious URL responsive to the candidate URL being classified as malicious.

Malicious uniform resource locator (URL) detection in memory of a data processing unit using machine learning detection models

Apparatuses, systems, and techniques for classifying one or more computer programs executed by a host device as being ransomware using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service obtains a series of snapshots of data stored in the physical memory and extracts a set of features from each snapshot of the series of snapshots, each snapshot representing the data at a point in time. The security service classifies a process of the one or more computer programs as ransomware or non-ransomware using the set of features and outputs an indication of ransomware responsive to the process being classified as ransomware.

Ransomware detection in memory of a data processing unit using machine learning detection models

Apparatuses, systems, and techniques for classifying one or more candidate uniform resource locators (URLs) as having a domain generation algorithm (DGA) domain using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being domain characters in one or more candidate URLs. The security service classifies, using the ML detection system, the one or more candidate URLs as having a DGA domain or a non-DGA domain using the set of features. The security service outputs an indication of a DGA malware responsive to the one or more candidate URLs being classified as having the DGA domain.

Malicious domain generation algorithm (DGA) detection in memory of a data processing unit using machine learning detection models

Apparatuses, systems, and techniques for detecting that one or more computer programs executed by a host device are subject to malicious activity using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being associated with the one or more computer programs. The security service determines, using the ML detection system, whether the one or more computer programs are subject to malicious activity based on the set of features. The security service outputs an indication of the malicious activity responsive to a determination that the one or more computer programs are subject to the malicious activity.

Malicious activity detection in memory of a data processing unit using machine learning detection models

Growing community of inventors

Arlington, VA, United States of America

Rachel Allen