Rapid7, Inc.

Roy Donald Hodgman

Vasudha Shivamoggi

Wah-Kwan Lin

Aditya Kuppa

Jonathan Hart

Andrew Reece

Suchin Gururangan

John Lim Oh

Jocelyn Beauchesne

Derek M Abdine

Katherine Wilbur

Jeffrey D Myers

Thomas Eugene Sellers

Dustin Myers

Oliver Keyes

Prashant Subbarao

Gabrielle Rappaport

Michael Scutt

Timothy Stiller

Justin Pagano

Matthew Robert Hathaway

Matthew Berninger

Kwan C Lin

Dana Elizabeth Wolf

Raphaëlle Delpont

Hd Moore

Luke Ludington

Jacqueline Daniel

Lauren Johnson

Some embodiments provide techniques for detecting cyberattacks against a software service authentication system that authorizes access to software services. The techniques access a user activity profile specifying values of parameters indicating the user's pattern of requesting access to unique software service(s). The techniques monitor the activity of the user over a time period to obtain software request data indicating request(s) by the user to access software services in the time period. The techniques determine, using the software service request data and the user activity profile, whether computing activity of the user during the time period is anomalous.

Techniques for detecting cyberattacks on an authentication system

A method includes obtaining a command captured at a computing device to start a process on the computing device submitted via a command line interface. The command is of a plurality of commands captured at respective computing devices that triggered respective alerts to review the plurality of commands. The method includes parsing the command to generate a plurality of tokens that represent the command according to dictionary of features of commands submitted via the command line interface, generating a feature vector based, at least in part, on the plurality of tokens, applying a classification model, trained on other commands submitted via the command line interface to predict benign commands, to the feature vector to determine a score indicative of a probability that the command is benign, and, responsive to a determination that the score is above a confidence threshold, removing the command from the plurality of commands to be reviewed.

Command line parsing for classification of process start alerts

An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.

Automated generation of anomaly scenarios for testing machine learned anomaly detection models

Various embodiments include systems and methods to implement a password requirement conformity check. During a password reset process, a proposed password is received. A homomorphic encryption operation may be performed on the proposed password to generate a first character string. The first character string may be compared to a previous character string associated with a previous password to determine a password similarity metric. The password similarity metric may or may not satisfy at least a distance threshold. Responsive to determining that the password similarity metric does not satisfy the distance threshold, there may be a rejection of the proposed password and a prompt to receive an alternative proposed password during the password reset process.

Password similarity checking using homomorphic encryption operations

Various embodiments include systems and methods of anomalous data transfer detection. Hotspots for an asset of an organization may be determined, corresponding to period(s) of time in which outbound data from the asset satisfies a hotspot threshold determined to be indicative of high outbound data traffic activity. Based on the outbound data, a first set of days are identified as 'quiet' day(s); a second set of days are identified as “active” day(s); and “quiet” hour(s) of the day, associated with “active” day(s), are identified. The “quiet” day(s) and the “quiet” hour(s) are identified as a warmspot dataset, which may be utilized to detect anomalous data transfer activity associated with the asset. Detecting the anomalous data transfer activity includes computing one or more statistics on the warmspot dataset. Responsive to detecting the anomalous data transfer activity, an alert associated with the asset may be generated.

Anomalous data transfer detection

Identifying high-influence features for model-detected anomalies

Automated dimensionality reduction for machine learning anomaly detection pipeline

Various embodiments include systems and methods of anomalous data transfer detection, including determining hotspots for an asset of an organization. The hotspots correspond to one or more periods of time in which outbound data from the asset satisfies a hotspot threshold determined to be indicative of high outbound data traffic activity. A subset of data that does not correspond to the hotspots is filtered out from the outbound data. The remaining data corresponds to a hotspot dataset associated with the hotspots. The hotspot dataset may be utilized to detect anomalous data transfer activity associated with the asset. Detecting the anomalous data transfer activity includes computing one or more statistics on the hotspot dataset. Responsive to detecting the anomalous data transfer activity, an alert associated with the asset may be generated.

Disclosed herein are methods, systems, and processes for detecting data exfiltration. A data exfiltration event in a network is detected. Traffic data regarding outgoing traffic of a source in the network associated with the data exfiltration event is received. A logarithmic transformation is applied to the traffic data to generate transformed data. An outlier identification technique is selected based on the transformed data and is executed on the transformed data to determine that the outgoing traffic is indicative of the data exfiltration event. An alert is generated in response to the determination that the outgoing traffic is indicative of the data exfiltration event.

System and method for monitoring network activity for detecting data exfiltration events

Machine learning system for detecting anomalies in hunt data

Systems and methods are disclosed to implement a cyberattack detection system that monitors a computer network for suspected lateral movement. In embodiments, the system employs multiple machine learning models to analyze connection data of a network to identify anomalies in the network's connection behavior. The models are updated incrementally using online machine learning methods that can be performed in constant time and memory. In embodiments, the system uses an incremental matrix factorization model and a connection count fitting model to generate anomaly scores for each connection. Connection paths are constructed for acyclic sequences of time-ordered connections observed in the stream. The paths are evaluated based on the anomalies scores of their individual connections. Paths that meet a detection criterion are reported to analysts for further review. Because the detection models are online models, they are continuously updated based on newly observed data, without having to store the new observation data.

Anomalous connection detection using combination of online machine learning models

Generating synthetic datapoints from observed datapoints for training machine learning models

Systems and methods are disclosed to implement a cyberattack detection system that monitors a computer network for lateral movement. In embodiments, the system uses network data from a computer network to build a baseline of connection behaviors for the network. Connection graphs are generated from new network data that indicate groups of nodes that made connections with one another during a last time interval. The graphs are analyzed for connection behavior anomalies and ranked to determine a subset of graphs with suspected lateral movement. Graphs with suspected lateral movement may be further analyzed to determine a set of possible attack paths in the lateral movements. The suspected attack paths are reported to network administrators via a notification interface. Advantageously, the disclosed system is able to detect potential lateral movements in localized portions of a network by monitoring for connection behavior anomalies in network data gathered from the network.

Attack monitoring service that selectively analyzes connection graphs for suspected attack paths

Password requirement conformity check

Methods and systems for assessing a vulnerability of a network device. The systems and methods described herein combine data regarding locally discovered vulnerabilities and exposed services with data regarding what executables are provided by software installed on the network device.

Assessing vulnerability of service-providing software packages

Growing community of inventors

Boston, MA, United States of America

Roy Donald Hodgman