Accenture Global Solutions Limited

Accenture Global Services Gmbh

Robin Lynn Burkett

Louis William DiValentin

Joshua Patterson

Michael Evan Wendt

Keith Kraus

Amin Hassanzadeh

Azzedine Benameur

Chien An Chen

Nahid Farhady Ghalaty

Apoorv Krishak

Matthew Carver

Elvis Hovor

David William Rozmiarek

Mohamed H El-Sharkawi

Implementations are directed to methods for detecting and identifying advanced persistent threats (APTs) in networks, including receiving first domain activity data from a first network domain and second domain activity data from a second network domain, including multiple alerts from the respective first and second network domains and where each alert of the multiple alerts results from one or more detected events in the respective first or second network domains. A classification determined for each alert of the multiple alerts with respect to a cyber kill chain. A dependency is then determined for each of one or more pairs of alerts and a graphical visualization of the multiple alerts is generated, where the graphical visualization includes multiple nodes and edges between the nodes, each node corresponding to the cyber kill chain and representing at least one alert, and each edge representing a dependency between alerts.

Detection of adversary lateral movement in multi-domain IIOT environments

Malicious threat detection through time-series graph analysis, in which a data analysis device receives a data file comprising multiple log data entries. The log data entries include parameters associated with a computer network event in a computing network. The data analysis device produces a graphical model of the computing network based on at least one parameter included in the log data. The data analysis device also identifies a parameter associated with a node of the computer network represented by the graphical model, and performs a time-series analysis on the parameter. The data analysis device further determines, based on the time-series analysis on the parameter, at least one of an anomalous event associated with the computing network or a malicious event associated with the computing network.

Malicious threat detection through time series graph analysis

Graph database analysis for network anomaly detection systems, in which a data analysis device receives multiple log data entries including parameters associated with a computer network event in a computing network. The data analysis device extracts one or more parameters in real-time and generates a network event graph based on at least one of a first graph metric or a second graph metric. The first and second graph metrics are based on the one or more extracted parameters. The data analysis device detects, based on queries performed on the network event graph, at least one of an anomalous event associated with the computing network or a malicious event associated with the computing network.

Graph database analysis for network anomaly detection systems

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for determining threat data contextualization. One of the methods includes receiving data that identifies assets, attributes for each of the assets, and respective relevance ratings for the assets, receiving threat data that identifies vulnerabilities of particular attributes, determining vulnerability trends for the particular attributes, determining whether an attribute is one of the particular attributes identified in the threat data, updating the relevance ratings of the attribute using the vulnerability trends for the attribute, for each of two or more vulnerabilities identified in the threat data: determining the particular attributes affected by the vulnerability, and determining a score for the vulnerability using the respective relevance ratings for the particular attributes affected by the vulnerability, generating a ranking of the vulnerabilities using the corresponding scores, and generating instructions for presentation of a user interface that identifies each of the vulnerabilities.

Contextualization of threat data

Growing community of inventors

Alexandria, VA, United States of America

Robin Lynn Burkett