Morgan Stanley Services Group Inc.

Russell Moriarty

Joseph Edmonds

Eric Mudge

A system and method for detecting cyberattacks involves monitoring and analyzing incoming email received over the internet using enterprise telemetry; extracting observations from an enterprise telemetry data feeds and transmitting to a summarization module for summarizing a potential indicator of compromise pertaining to the email monitored and analyzed by the network telemetry; storing the observation summarization data in a graph database; querying over the internet an external cybersecurity threat intelligence provider, upon identification of a true-positive network threat, for enriching information and artifacts contained within the true-positive network threat, receiving over the internet enriching information and artifacts from the external cybersecurity threat intelligence provider, and storing the received enriching information and artifacts in the graph database; and identifying a new indicator of compromise using data stored in the graph database.

System for cybersecurity campaign artifact discovery and tasking

A method for generating hashes associated with web domains and reacting to transmissions from those web domains is disclosed. When artifacts from a first web domain and artifacts from a second web domain have been transmitted over a network, a system generates, via a hashing or fingerprinting function that uses registry information, a first hash for the first web domain and a second hash for the second web domain and identifies a correlation between the first web domain and the second web domain based on shared subsets of the first hash and second hash. Upon receiving a notification that artifacts from the first web domain had been determined to negatively impact the functioning of a secondary computing system, based on the identified correlation between the first web domain and the second web domain, the system automatically quarantines artifacts from the second web domain from interacting with the secondary computing system.

Web domain correlation hashing method

A computer-implemented method of analyzing the contents of a file in a visual document format to identify a potentially-fraudulent overlay is disclosed. The method includes receiving the file, iterating over a set of visually rendered elements within the file, and calculating, for each element in the set, a bounding box. Based on identifying a pair of elements having at least partially overlapping bounding boxes, such that a visible item in an overlaid element at least partially obscures an item in an underlying element that would otherwise be visible, an attack vector ontology is updated to include information on the overlaid and underlying element. This attack vector ontology may be used in training an automatic system to identify fraudulent documents and prevent their being printed, signed, and/or further used.

Fraudulent overlay detection in electronic documents

A method for generating fingerprints of web domains and reacting to artifacts electronically received from those web domains is disclosed. When artifacts from a first web domain and artifacts from a second web domain have been transmitted over a network, a system generates, via a hashing function that consults registry information, a first hash for the first web domain and a second hash for the second web domain and identifies a correlation between the first web domain and the second web domain based on shared subsets of the first hash and second hash. Upon receiving a notification that artifacts from the first web domain had been determined to negatively impact the functioning of a secondary computing system; and based on the identified correlation between the first web domain and the second web domain, the system automatically quarantines artifacts from the second web domain from interacting with the secondary computing system.

Growing community of inventors

Ellicott City, MD, United States of America

Russell Moriarty