Forcepoint LLC

Arceo Labs Inc.

Forcepoint Federal Holdings LLC

Russell Snyder

Ann Irvine

Richard Anthony Ford

Adam Reeve

Benjamin Shih

Chris Puderbaugh

Robert Mealey

Chris Poirel

Christopher Poirel

William Renner

Phillip Bracikowski

Determining additional signals for determining cybersecurity risk is disclosed, including: obtaining signals associated with a cybersecurity risk, wherein the obtained signals include technographic signals and query derived signals obtained from queries; combining the technographic signals and the query derived signals into a Bayesian model indicating the cybersecurity risk; and determining additional technographic signals or additional query derived signals associated with the cybersecurity risk to obtain such that the additional technographic signals or the additional query derived signals are to be computed to impact the cybersecurity risk.

Determining additional signals for determining cybersecurity risk

Generating a cybersecurity risk model using sparse data is disclosed, including: obtaining signals associated with a cybersecurity risk, wherein the obtained signals include technographic signals and query derived signals obtained from queries; generating pseudo signals based at least in part on a priori factors relating to the cybersecurity risk; and combining the pseudo signals and the obtained signals into a Bayesian model indicating the cybersecurity risk.

Generating a cybersecurity risk model using sparse data

A method, system and computer-usable medium for adaptively assessing risk associated with an endpoint, comprising: determining a risk level corresponding to an entity associated with an endpoint; selecting a frequency and a duration of an endpoint monitoring interval; collecting user behavior to collect user behavior associated with the entity for the duration of the endpoint monitoring interval via the endpoint; processing the user behavior to generate a current risk score for the entity; comparing the current risk score of the user to historical risk scores to determine whether a risk score of a user has changed; and changing the risk score of the user to the current risk score when the risk score of the user has changed.

Gracefully handling endpoint feedback when starting to monitor

A system, method, and computer-readable medium for resolving an identity of an entity, comprising parsing entity identifier information associated with the entity to provide an entity identifier element, the entity identifier information comprising temporal information; classifying the entity identifier element to provide a classified entity identifier element; normalizing the classified entity identifier element to provide a classified and normalized entity identifier element; and, associating the classified and normalized entity identifier element and the temporal information with the entity to resolve the identity of the entity at a particular point in time.

Temporal resolution of an entity

A method, system and computer-usable medium for generating session-based security information. Generating the session-based security information includes the steps of monitoring user behavior between an enactor and an entity; detecting user behavior data associated with the user behavior; generating a session using the user behavior data, the session relating to an entity discrete interaction of the enactor; and, associating the session and the session-based security information with the user profile.

Session-based security information

A method, system and computer-usable medium for performing security analytics comprising receiving a stream of data from a data source; preprocessing the stream of data identify entity information and event information from the stream of data; transforming the entity information into transformed entity data and the event information into transformed event data; the transforming conforming to a genericized data model; storing the transformed entity data and the transformed event data in a security analytics data repository; and, performing a security analytics operation on the transformed entity data and the transformed event data.

Genericized data model to perform a security analytics operation

Risk adaptive protection

A method, system and computer-usable medium for performing a risk score volatility reduction operation, comprising: collecting event data associated with user behavior of a user; generating a scoring interval risk score for the user for a current risk scoring interval; and, processing the scoring interval risk score of the current risk scoring interval with a scoring interval risk score from a prior risk scoring window to provide a scoring window risk score, the scoring window risk score reducing volatility of a risk score associated with the user.

Growing community of inventors

Baltimore, MD, United States of America

Russell Snyder