Netskope, Inc.

Wootcloud Inc.

Shahab Sheikh-Bahaei

Srinivas Akella

Systems and methods to generate a hyper context associated with a computing device are described. In one embodiment, communication data associated with the computing device is accessed. One or more features associated with the computing device are extracted from the communication data. A type of the computing device is detected. An operating system associated with the computing device is detected. A control associated with the computing device is detected. A functionality of the computing device is detected. An ownership of the computing device is detected. A hyper context associated with the computing device is defined. The hyper context includes a type context, a category context, an ownership context, a connectivity context, and a control context.

Systems and methods for device fingerprinting

Systems and methods to continuously classify temporal communication data associated with a computing device are described. In one embodiment, temporal communication data associated with the computing device is accessed and processed to create a plurality of preprocessing models. The preprocessing models are used to train a neural network. The neural network derives one or more properties associated with the computing device from the temporal communication data. A device fingerprint is defined from the one or more properties. Subsequent to defining the device fingerprint, additional temporal communication data associated with the computing device is accessed. The neural network derives one or more additional properties associated with the computing device from the additional temporal communication data. The one or more additional properties are aggregated into the defined device fingerprint, refining the defined device fingerprint.

Systems and methods for computing device association are described. One aspect includes receiving first and second network communication data for a first and second computing device over a communication network, respectively. For each computing device, a first and second data set are extracted from the first and second network communication data, respectively. The first data set includes first spatial data and first temporal data associated with the first computing device. The second data set includes second spatial data and second temporal data associated with the second computing device. The first and second data sets are correlated. A first geometric distance between the first temporal data and the second temporal data and a second geometric distance between the first spatial data and the second spatial data are computed. The method identifies that the first computing device and the second computing device belong to a common user.

Systems and methods for computing device association

Systems and methods for risk assessment of a computer network are described. In one embodiment a first static risk score corresponding to a first computing device is computed. A connectivity map corresponding to the first computing device is determined. Communication performed by the first computing device via the connectivity map is analyzed, and a first dynamic risk score corresponding to the first computing device is computed. The first static risk score and the first dynamic risk score are combined to generate a first total risk score for the first computing device. A second total risk score for a second computing device is determined. The first total risk score and the second total risk score are aggregated into an aggregate risk score. A risk assessment of the computer network is determined based on the aggregate risk score.

Assessing computer network risk

Systems and methods for anomaly detection are described. One aspect includes defining a computing device group comprising a plurality of networked computing devices. The networked computing devices are associated with a computer network. One or more statistical parameters associated with the computing device group are calculated. A set of communication data associated with a networked computing device is received. An operating point geometric distance of the networked computing device relative to the one or more statistical parameters is computed. This operating point geometric distance is based at least in part on the set of communication data. An anomaly is detected based on the operating point geometric distance.

Systems and methods for anomaly detection

Systems and methods to determine an aggregate risk score are described. In one embodiment, a first dynamic risk factor and a second dynamic risk factor are generated associated with a first incident and a second incident respectively at a site. One or more static risk factors are retrieved from a database. The static risk factors and the dynamic risk factors are mapped to a first threat. A first threat risk score associated with the first threat is computed. A second risk score associated with a second threat is computed. A first total risk score associated with a first computing device included in a computer network associated with the site is computed. A second risk score associated with a second computing device included in the computer network is computed. The first total risk score and the second total risk score are aggregated to compute an aggregate risk score.

Systems and methods to generate a device composite fingerprint associated with a computing device are described. In one embodiment, communication data associated with the computing device is accessed. The communication data includes device identification data, device group data, and device operational data. A device identity fingerprint associated with the computing device is generated using the device identification data. A device group fingerprint associated with the computing device is generated using the device group data. A device operational fingerprint associated with the computing device is generated using the device operational data. The device identity fingerprint, the device group fingerprint, and the device operational fingerprint are combined to generate a device composite fingerprint.

Systems and methods to reverse-predict a MAC address associated with a computing device are described. In one embodiment, first temporal communication data associated with the computing device is accessed for a first time interval. The first temporal communication data is converted into a first image. Second temporal communication data associated with the computing device is accessed for a second time interval. The second temporal communication data is converted into a second image. An image ensemble including the first image and the second image is analyzed using a neural network. Each image in the image ensemble is converted from temporal communication data associated with the computing device. The neural network learns a temporal pattern associated with the image ensemble. Current temporal communication data associated with the computing device is accessed and converted into a current image. The current image is compared with the temporal pattern. A MAC address associated with the computing device is reverse-predicted responsive to the comparison.

Growing community of inventors

Atherton, CA, United States of America

Shahab Sheikh-Bahaei