Qomplx, Inc.

Other

Richard Kelley

Jason Crabtree

Andrew Sellers

Randy Clayton

Luka Jurukovski

David Park

Jason Hopper

Michael James

Angadbir Singh Salaria

Farooq Shaikh

Farooq Israr Ahmed Shaikh

Joe Gray

Artem Panasenkov

Gandhi Balasubramaniam

Rick W Talbert

Jeffrey Chung

Tomas Fornara

Alejandro Caceres

Mike Chasman

Sherrill L Beard Kelley

A system and method for scoring and enforcing authentication standards that actually enable zero trust network security principles when combined with stateful authentication object tracking, authentication object manipulation and forgery detection, and assessment of authentication and identity attack surface. The methodology involves gathering all authentication objects issued by a network, storing the authentication objects in a centralized location for use in stateful deterministic authentication object tracking, scoring the completeness of the authentication observations, assessing the quality of the authentication observations, and assigning organization-specific penalty functions.

Network authentication toxicity assessment

A system and method for network cybersecurity analysis that uses user and entity behavioral analysis combined with network topology information and trigger-based network remediation to provide improved cybersecurity. The system and method involve gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Triggers may be based on risks or anomalous behavior and associated with a remediation action executed on the network by a security mitigation engine. The system and method may also dynamically adjust monitoring characteristics based on trigger events.

System and methods for cybersecurity analysis using UEBA and network topology data and trigger-based network remediation

A system and method for cyber exploitation path analysis and response using federated networks to minimize network exposure and maximize network resilience, with the ability to simulate complex and large scale network traffic through the use of federated training networks, by gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Lastly, network attack path analysis and automated task planning for minimizing network exposure and maximizing resiliency is performed with machine learning, generative adversarial networks, hierarchical task networks, and Monte Carlo search trees.

Computer-implemented system and method for cybersecurity threat analysis using federated machine learning and hierarchical task networks

A system and method for the dynamic authentication revocation using privilege assurance of enterprise computer network environments using lateral movement detection and prevention. The system uses local session monitors to monitor logon sessions within a network, generating and verifying event logs and authentication records to ensure the legitimacy of authenticated user sessions and to revoke credentials when an illicit session is detected and further removing potentially compromised network components from the network, halting lateral movement in real-time.

Dynamic authentication revocation utilizing privilege assurance

A system and method for operational and cyber risk assessment that utilizes a data-driven approach to evaluate the current security posture and identify areas for improvement based on the user's desired target profile. This process involves estimating the costs and benefits associated with various security program enhancements, increased, hiring, and control uplifts. The system and method then quantify these benefits in terms of reduction in tail value at risk, expected losses, cyber insurance premiums, and the amount of risk capital set aside. The system simulates attack paths associated with various risk scenarios and uses a risk scenario model to compute losses associated with each attack path for each risk scenario. The results of the simulation may be used to determine one or more business outcomes associated with the costs and benefits of implementing security enhancements.

Dynamic cybersecurity scoring and operational risk reduction assessment

A system and method for detection and prevention of ticket forgery cyberattacks by improving host-level analytics and monitoring and extending the improved host-level analytics and monitoring to endpoints of a network. The methodology described herein comprises the use of a ticket-granting log extension utility which stores every logon session on a network, queries the local ticket cache, and generates additional custom data as a part of an event log stream such as a start time, end time, renew time, and related session data. This comprehensive log extension data can be used to identify certain types of ticket forgery cyberattacks by comparing the user session name with the client name identified in the ticket presented for access to network resources and other means. This host-level ticket forgery detection can be extended to network endpoints for additional security.

Host-level ticket forgery detection and extension to network endpoints

A system and methods for Kerberos protocol collection, interdiction and decryption for real-time analysis to aid in both operational and security functions in SSO-enabled networks, using agent processes that intercept and decrypt Kerberos traffic to identify compromised credentials and accounts in real-time without exposing sensitive information.

Kerberos interdiction and decryption for real-time analysis

A system for network traffic classification using distributed sensor nodes is provided, comprising a plurality of network traffic sensors each configured to monitor visible network traffic, analyze the monitored traffic to identify patterns, communicate with other network sensors to correlate their respective traffic data, produce a threat landscape based on the correlated traffic data, identify a potential cybersecurity threat based on the threat landscape, and export the analyzed traffic and threat landscape for use by external systems.

Network action classification and analysis using widely distributed and selectively attributed sensor nodes and cloud-based processing

A system and method for generating multimedia artifacts with managed scene continuity in visual and multimedia using an AI-based and scene continuity aware media generation platform. The system receives a user or AI agent specification or simulation result(s), selects or trains generative models based on the specification, preprocesses relevant data, and generates scene narrative or frame-specific, sequence specific or broader continuity aware content using the selected or trained model(s). The generated content may be further enhanced using frame interpolation and view synthesis techniques to create smooth transitions or novel viewpoints or to aid in more efficient transmission or viewing or persistence of resultant content. The system enables efficient and customizable generation of high-quality scene continuity aware content for various applications in visual and multimedia production using neuro-symbolic and simulation enhanced compression, representation and generation processes.

System and method for efficient scene continuity in visual and multimedia using generative artificial intelligence

A system and method for comprehensive data utilization and tracking comprising an ontological engine which in some embodiments is configured to create and curate various industry-specific ontologies which can be used to provide deeper context to an enterprise's network traffic and data transmission. The system and method further comprise a tagging and tracking engine configured to inspect network packets, apply a first tag associated with an authentication object, apply a second tag associated with an identified ontology, and track the tagged packets as they traverse the enterprise network, generating data utilization tracking information as the packets move through the network. A scoring engine may leverage the data utilization tracking information in combination with user entity and behavior data to compute a risk score associated with data utilization on the enterprise network.

System and method for enterprise-wide data utilization tracking and risk reporting

A system and method for providing a cloud identity verification exchange service which ingests a plurality of identity assertion data from various Identity Providers and/or Service Providers and aggregates the ingested plurality of data into a master global authentication ledger. The system and method comprise: a data ingestion engine configured for acquiring, extracting, and loading data into the system as well as providing hashing capabilities; a metadata manager for collecting, organizing, and cataloguing ingested data based on collected metadata; and database for storing the master global authentication ledger. The master ledger acts as a central repository that consolidates authentication objects from various Identity Providers, allowing for centralized authentication management, auditing, reporting, and analysis. It provides a comprehensive view of authentication activities across multiple systems and enables the tracking of user authentication events across different identity providers.

Collaborative cloud identity and credential forgery and abuse defense

A system and method for large-scale internet health forecasting and internet noise analysis. The system and method feature the ability to scan for, ingest and process, and then use various data stores for capturing entity data, their relationships, and actions associated with them. This data forms the basis for cyber enrichment service databases which can used to provide information responsive to user submitted queries as well as to produce large-scale (e.g., Internet scale) simulation models using statistical models, generative ML models, massively multiplayer online gaming simulation systems, or full discrete event simulation engines or some combination. User submitted queries can be ran against the raw data or against simulations to provide simulation results that can be used improve cybersecurity for an organization against actual observed behaviors or simulations.

System and method for internet activity and health forecasting and internet noise analysis

A system for dynamic cybersecurity scoring using traffic fingerprinting and score improvement, that uses a web crawler that sends message prompts to external hosts and receives responses from external hosts, a time-series data store that produces time-series data from the message responses, and a directed computational graph module that analyzes the time-series data to produce a weighted score representing the overall cybersecurity state of an organization.

Dynamic cybersecurity scoring using traffic fingerprinting and risk score improvement

A system and method for privilege assurance protection of computer networks that remedies the deficiencies of the current directory service structure. The system uses a software agent to collect and store snapshots of all network resources on a computer network by identifying network domains, searching the directory service of each domain for network resources, and periodically querying the network resources for changes. The software agent communicates with a backend server which provides searching, querying, storage, administrative and other functionality to the agent via remote procedure calls.

Privilege assurance of computer network environments

A dynamic experience curation platform utilizing AI and ML techniques, including neural networks and generative models, to enhance user interactions with content on the Internet. The platform employs an Experience Broker (EB) service to disintermediate user devices from the internet (or other content/information sources), improving security and user experience. It processes content requests, extracts relevant information, filters out unwanted content like ads, transforms, combines, and/or mutates existing content, and generates curated content consistent with user preferences and other constraints. The platform's generative AI process renders content into a user interface consistent with user preferences. It allows for personalized content delivery across devices, including virtual and augmented reality environments. The platform supports a spectrum of personalization, allowing users to fine-tune their content consumption experience. Additionally, it manages user sessions across devices and integrates various databases for storing user profiles, preferences, and other relevant information.

Growing community of inventors

Woodbridge, VA, United States of America

Richard Kelley