Palo Alto Networks, Inc.

Noname Gate Ltd.

Shai Meir

Arkady Miasnikov

Dany Cohen

Ohad Ohayon

Yuval Alkalai Tavori

Yaniv Gabay

Adi Chen Arbib

Idan Tager

Adi Vardi

Itzhak Gershfeld

A system and method for clustering computing interface calls. A method includes: determining a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings; and clustering a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings.

Techniques for securing computing interfaces using clustering

Adaptive normal profiles are generated at a hierarchical scope corresponding to a set of endpoints and a process. Abnormal endpoint activity is detected by verifying whether event data tracking activity on the set of endpoints conforms to the adaptive normal profiles. False positives are reduced by verifying alarms correspond to normal endpoint activity. Abnormal event data is forwarded to a causality chain identifier that identifies abnormal chains of processes for the abnormal endpoint activity. A trained threat detection model receives abnormal causality chains from the causality chain identifier and indicates a likelihood of corresponding to a malicious attack that indicates abnormal endpoint behavior.

Context informed abnormal endpoint behavior detection

Growing community of inventors

Tzur Yitzhak, Israel

Shai Meir