Deutschetelekom Ag

Ben-gurion University of the Negev Research and Development Authority

Verint Systems, Inc.

Nanyang Technological University

B.g. Negev Technologies and Applications Ltd.

Intelici-cyber Defense System Ltd.

Rami Puzis

Yuval Elovici

Asaf Shabtai

Lior Rokach

Zahy Bnaya

Ziv Katzir

Liran Orevi

Ron Bitton

Genady Malinsky

Maor Reuben

Ariel Felner

Tal Beja

Roni Stern

Aviad Elyashar

Polina Zilberman

Liron Samama

Tobias Martin

Yisroel Avraham Mirsky

Anupam Chattopadhyay

Oliver Holschke

Shlomo Dolev

Siew Kei Lam

Danny Hendler

Ingmar Poese

David Toubiana

Dror Levy

Elad Israeli

Jawad Haj-Yahya

Thambipillai Srikanthan

Aviad Elitzur

Elad Marco

Oleg Brodt

Manuel Kamp

Dvir Cohen

Eitan Menahem

Mehran Roshandel

Elad Rapaport

Ofir Tam

Shimon Silberschlag

Genady Malinksy

Ariel Rozen

Ory Ossmy

Meital Tubi

An optimized limited-area WiFi network includes a plurality of Internet connectable devices, a wireless router for facilitating Internet connectivity, and a dynamically positionable signal coverage enhancer configured with an onboard processor, a signal coverage enhancing element, and mobile means. The signal coverage enhancer is repositionable, by the mobile means in response to a command signal transmitted by the processor, to a determined location of the limited-area WiFi network that is sufficiently close to one or more of the devices, such that an amplified signal produced by the signal coverage enhancing element which amplifies a wireless signal transmitted by the router maintains uninterrupted Internet operation of the to one or more devices.

Optimized WiFi network

A framework for efficiently and automatically exploring a data network and accurately identifying network threats, which comprises a plurality of software and hardware-based agents, distributed over the data network. The agents are capable of adjusting or reconfiguring, on the fly, the behavior of the agents and their ability to collect data in a targeted manner, so as to investigate suspicious incidents and alerts and collect data that was not yet collected by the system; collecting forensic data by executing tasks defined in workflows, being distributed threat intercepting programs and reporting about the collected forensic data, back to a Central Control Unit (C&C). Distributed threat intercepting programs ('workflows') are used to provide instructions to agents, to perform branching and provide instructions to the Central Control Unit (C&C), which orchestrates the agents to assure proper execution of the workflows; analyzes the collected information and presents ongoing status to an operator supervising the data network.

Bio-inspired agile cyber-security assurance framework

The present invention provides a method for determining a type of an object distributed through communication network said method implemented by one or more processing devices operatively coupled to a non-transitory storage device, on which are stored modules of instruction code that when executed cause the one or more processing devices to perform: monitoring objects traffic through communication network; building the objects' footprint, wherein said footprint is inferred from monitored traffic flows that contain said object wherein the footprint is organized in a graph structure wherein nodes are source and target network addresses of said traffic flows two nodes are connected if there is a traffic flows between the network address of the respective nodes containing the said object, analyzing the objects footprint for identifying features characteristics/parameters of the footprint to determine the objects type.

Method and system for classifying data objects based on their network footprint

A method and a system are provided for determining a likelihood of a metabolic pathway existing in an organism, including: calculating a feature vector for each metabolic pathway of metabolic pathways known to exist and not known to exist in the organism, wherein elements of the feature vectors are network properties of the metabolic pathways mapped to a metabolite concentration correlation network (CN); training a supervised machine learning model for classifying metabolic pathways as existing or not existing in the organism, according to the known and unknown feature vectors; determining, based on mapping to the CN, a feature vector of a proposed metabolic pathway, and feeding the feature vector of the proposed metabolic pathway to the trained SML model, to determine a likelihood of the proposed metabolic pathway existing in the organism.

Identification and prediction of metabolic pathways from correlation-based metabolite networks

An automated interactive optimization method of short keyword queries for improving information retrieval from opaque (black box) search engines is disclosed. The method requires collecting data from several fact-checking websites, for creating dataset used for evaluation; estimating the relevance of posts/query results retrieved from a search engine to a given input document, by calculating the mean relevance error (MRE), based on estimating the minimal distance between words comprising both the retrieved posts and the input document; labeling a subset of claims for evaluation, by choosing a number of claims that gained the maximal and the minimal mean relevance error (MRE); and finding the most appropriate queries in order to retrieve the maximal number of relevant posts using an opaque search engine, by performing an interactive greedy search for the best word that should be added to the input query, for maximizing the corresponding posts retrieved by the search engine.

Method and system for interactive keyword optimization for opaque search engines

A system for analyzing and clustering darknet traffic streams with word embeddings, comprising a data processing module which collects packets that are sent to non-existing IP addresses that belong to darknet's taps (blackholes) that are deployed over the internet: a port embedding module for performing port sequence embeddings by using a word embedding algorithm on the port sequences extracted from the data processing module while transforming the port sequences into a meaningful numerical feature vectors: a clustering module for performing temporal clustering of the feature vectors over time; and an alert logic and visualization module visualizes the data and provides alerts regarding a cluster that an analyst classified as malicious in the past.

Method and system for clustering darknet traffic streams with word embeddings

Described embodiments include a system that includes a monitoring agent, configured to automatically monitor usage of a computing device by a user, and a processor. The processor is configured to compute, based on the monitoring, a score indicative of a cyber-security awareness of the user, and to generate an output indicative of the score.

System and method for assessing cybersecurity awareness

An automated interactive optimization method of short keyword queries for improving information retrieval from opaque (black box) search engines, according to which data including labeled claims from several fact-checking websites, is collected for creating dataset which is used for evaluation. The relevance of posts/query results retrieved from a search engine to a given input document, is estimated by calculating the mean relevance error (MRE), based on estimating the minimal distance between words comprising both the retrieved posts and the input document. A subset of claims is labeled for evaluation, by choosing a number of claims that gained the maximal and the minimal mean relevance error (MRE). The most appropriate keywords is found in order to retrieve the maximal number of relevant posts using an opaque search engine, by performing an interactive greedy search for the best word that should be added to the input query, for maximizing the corresponding posts retrieved by the search engine.

A system for early predicting of impending data overflow situations in data networks, comprising one or more sensors being networked computers that do not provide services, for collecting monitored data regarding network traffic volume from content providers to an Internet Service Provider (ISP) entering or exiting the ISP via peering autonomous systems connected to the ISP via physical links; one or more processors executing one or more deep learning models, being adapted to: identify over the data network being handovers alternative peering links, which are not inherent Private Network Interconnects (PNI) between the content providers and the ISP; determine static or dynamic threshold for dataflow anomaly associated with overflow; for each alternative handover, predict impending overflow situation by applying ML algorithms to the collected data that corresponds to the each alternative handover.

System and method for predicting and handling short-term overflow

When using Web intelligence ('Webint') to collect information regarding a target social network user, one of the most valuable pieces of information is the target user's List-Of-Friends (LOF). In some cases, however, the LOF of the target user is not accessible in his profile. Herein are described methods and systems for identifying the LOF of a target user. An analysis system crawls the profiles of social network users, other than the target user, and reconstructs the LOF of the target user from the crawled profiles.

System and method for identifying contacts of a target user in a social network

The invention is a method and system for detecting attackers that are interested in attacking an organization's infrastructure during the reconnaissance phase of an Advanced Persistent Threat (APT). APTs are very sophisticated attacks and incorporate advanced methods for evading current security mechanisms. Therefore, the present invention uses an innovative social network honeypot.

Social network honeypot

Growing community of inventors

Ashdod, Israel

Rami Puzis