Microsoft Technology Licensing, LLC

Robert Eric Fitzgerald

Edward Wilkins Hardy

Efim Hudis

Arthur Zavalkovsky

Khaja Ehteshamuddin Ahmed

Lior Arzi

Jeffrey S Williams

Igal Figlin

Jack W Stokes

Alice Zheng

Raghavendra Malpani

Jennifer Lemond

Bodicherla Aditya Prakash

Jennifer R LeMond

A network security system employing multiple levels of processing to identify security threats. Multiple host machines may each contain an agent that detects possibilities of security threats based on raw data sensed locally at that host. The hosts may share information obtained from local analysis and each host may use information generated at one or more other hosts, in combination with information generated locally, to identify a security concern, indicating with greater certainty that a security threat exists. Based on security concerns generated by multiple hosts, a security threat may be to indicated and protective action may be taken.

Network intrusion detection with distributed correlation

An analysis system is described for identifying potentially malicious activity within a computer network. It performs this task by interacting with a user to successively remove known instances of non-malicious activity, to eventually reveal potentially malicious activity. The analysis system interacts with the user by inviting the user to apply labels to identified examples of network behavior; upon response by the user, the analysis system supplies new examples of network behavior to the user. In one implementation, the analysis system generates such examples using a combination of feature-based analysis and graph-based analysis. The graph-based analysis relies on analysis of graph structure associated with access events, such as by identifying entropy scores for respective portions of the graph structure.

Analysis of computer network activity by successively removing accepted types of access events

A network security system employing multiple levels of processing to identify security threats. Multiple host machines may each contain an agent that detects possibilities of security threats based on raw data sensed locally at that host. The hosts may share information obtained from local analysis and each host may use information generated at one or more other hosts, in combination with information generated locally, to identify a security concern, indicating with greater certainty that a security threat exists. Based on security concerns generated by multiple hosts, a security threat may be indicated and protective action may be taken.

System performance may be optimized, and extraneous audit noise reduced, by providing the capability of exercising a fine degree of control over individual audit events. A user such as an auditor interested in an individual audit event can obtain desired results without also obtaining results of all other individual audit events in the category containing the individual audit event. Additionally, audits may be obtained on either a per-user basis or on a system-wide basis. In this way, the auditor may tailor auditing events without regard to the auditing events established for other users of the system. Thus, there is a capability of establishing auditing policies for the entire system, in which case all users of the system may obtain results of the system-wide auditing.

Per-user and system granular audit policy implementation

Growing community of inventors

Bellevue, WA, United States of America

Robert Eric Fitzgerald