Bull Sas

Paladion Networks Private Limited

Rajat Mohanty

Vinod Vasudevan

Harshvardhan Parmar

Amarnath Chatterjee

A method for detecting outliers in processes running in a group of machines. A clustering stage, carried out at a first frequency, including fetching a list of software contained in all machines, calculating tf-idf value for each installed software and for each machine, performing clustering of the machines by applying a clustering algorithm and using a Jaccardian weighted distance method between machines based on the tf-idf values. A preliminary outliers detection stage, carried out at a second frequency greater than the first frequency, including fetching information of processes running in the machines, for each cluster calculating tf-idf values for each process, wherein if a tf-idf value is greater than a first predetermined threshold, the process is considered as outlier, for all clusters calculating itf-idf value for each process considered as outlier, and if a itf-idf value is lower than a second predetermined threshold, the process is confirmed as outlier.

Method and system for detecting outliers in processes

A network security system that analyzes data from network attacks to determine which attacks came from the same attacker, even if the attacker tries to disguise its identity by spreading attacks out over time and attacking from multiple IP addresses. Intrusion detection systems or firewalls may log data for each attack, such as the time of the attack, the type of attack, and the source and target addresses. Embodiments may augment this data with derived attributes that may profile the attacker's behavior. For example, some attackers may spread out attacks over time, but always attack on the same day of the week; some attackers may spread out attacks over different IP addresses, but these addresses may all be in the same country. The original and augmented data may be clustered using an algorithm such as DBSCAN, and each attacker may be identified with one of the resulting clusters.

Network security system that detects a common attacker who attacks from different source addresses

A network user behavior system that detects anomalous user behavior includes a memory system with a user behavior module. The user behavior module creates a user profile based on user activity that includes user activity logs that record parameters related to user activity; selects indicator features, wherein the indicator feature includes user activity related to the parameters; creates a user identifier (UID) for each combination of the indicator feature and user; associates each UID with a timestamp to establish a UID and timestamp relationship; establishes a UID and timestamp relationship range indicative of non-anomalous user behavior; and identifies an anomalous user behavior as a UID and timestamp relationship outside of the range indicative of non-anomalous user behavior.

User behavior anomaly detection

A system uses a probabilistic technique to determine the vulnerability of similar assets based on the data provided on some assets. The probabilistic technique includes stages of preparing data followed by calculating probability; a preparing data stage, including gathering the latest vulnerability reports of all assets in a system with the help of known scanners; creating open vulnerabilities; enriching the obtained data of open vulnerabilities; creating all vulnerabilities; enriching the obtained data of all vulnerabilities. Following this stage, probability calculation may be done for three cases, when asset information is known, when asset information is partially unknown, and when asset information is completely unknown based on the data taken from open vulnerabilities and all vulnerabilities categorized into blocks of 6 months based on the time at which they have been reported to NIST/MITRE.

Growing community of inventors

Fairfax Station, VA, United States of America

Rajat Mohanty