Ironnet Cybersecurity, Inc.

Other

The United States of America, As Represented by the Director, National Security Agency

Robert L Grossman

James E Heath

Keith B Alexander

Matthew C Swort

Randy Lynn Garrett

Kevin Paul Siegel

Charles Raymond Byce

Patrick W Dowd

Thomas H Dwyer

Christopher Brown

Aoyu Chen

Randi Annette Paynter

Russell D Richardson

System and methods for cross-domain training and updating of models to perform classification and scoring of network data/traffic are described. Information used to build deep machine learning models about traffic in one domain is used to improve the modeling in another domain. By using cross-domain learning, labeled data from another domain can be used to improve the detection rate and false positive rate of an analytic model in another domain. Because of the construction of the models, and because the models, and not the data are transferred, there is no disclosure of personally identifiable or otherwise restricted information.

Systems and methods for detecting malicious network traffic using multi-domain machine learning

Systems and methods for recording information at a granular level; checking and verifying that data is used and processed is consistent with an entity's internal policies and/or external regulations; and producing reports to authorized users (e.g., individuals and organizations) with information are provided. The system and methods capture required data in an immutable fashion so that users outside of an entity (e.g., public, third parties) can check and audit that internal policies and other regulatory policies and frameworks are followed.

Data block-based system and methods for predictive models

A cybersecurity system for managing cyber behavior associated with cyber actors such that the cyber behavior can be computed and predicted and cyber interactions between the cyber actors can be created. The system includes a cyber behavioral space management module configured to receive input data, and data from the interaction engine and the analytic workflow engine, and to generate a plurality of cyber behavioral spaces based on the received data. The system includes an interaction engine configured to process cyber actor data to facilitate interactions with the cyber behavioral space, a cyber scene, a cyber map, and another cyber actor. The system includes an analytic workflow engine configured to analyze the cyber behavioral spaces and update cyber data based on the analyzed data and the interaction engine data. The system includes a visualization engine configured to compute visualizations and transmit the visualizations for display.

Simulation and virtual reality based cyber behavioral systems

A cybersecurity system for processing events to produce scores, alerts, and mitigation actions. The system includes sensors for receiving and processing data to form events, distributed analytic platform for processing events to form analytic workflows, and scoring engines for processing events using analytic workflows to produce scoring engine messages. The system also includes real time analytic engine for processing scoring engine messages and distributed analytic platform messages using the analytic workflows and analytic workflow and event processing rules to form and transmit a threat intelligence message. Threat intelligence messages include broadcast messages, mitigation messages, and model update messages. The system also includes logical segments which associate an analytic model, a set of analytic models, or an analytic workflow; one or more sources of inputs about activity within the logical segment, and a set of actions for mitigating an impact of the anomalous activity occurring within the logical segment.

Cybersecurity system

Electronic network security by establishing a network topology, including multiple devices, where the network includes a command and control layer and a transport layer, where the command and control layer is changeable by the transport layer and vice versa. All phases of an intrusion attempt are monitored to anticipate an intrusion, prevent an intrusion, and remedy a successful intrusion. An assessment of the threat is made in multiple dimensions. The topology of the network may be changed in accordance with the threat assessment. In addition, computer traffic in the network and from the intrusion source may be modified or stopped to guard against an intrusion, prevent an intrusion, and remedy a successful intrusion. The command and control layer is changeable by the transport layer and vice versa.

Device for and method of computer intrusion anticipation, detection, and remediation

A system, apparatus, and method for reducing fraud in payment transactions by identifying a potential point of compromise (POC) that may lead to subsequent fraudulent transactions, or confirming that a suspected point of compromise is in fact responsible for a security breach leading to fraudulent payment transactions. The invention is also directed to a system, apparatus, and method for identifying data or transaction characteristics that may be used to most effectively identify a point of compromise in a payment transaction system.

Growing community of inventors

River Forest, IL, United States of America

Robert L Grossman