Microsoft Technology Licensing, LLC

Shalom Shay Shavit

Ram Haim Pliskin

Daniel Davraev

Andrey Karpovsky

Shay Chriba Sakazi

Systems and techniques for reduction of security detection false positives are described herein. Suspicious activity data is obtained for an operation. Operation data is obtained for the operation. It is determined that the operation is related to a parent operation that has not triggered an alert. The operation is cleared from the suspicious activity data.

Reduction of security detection false positives

A recovery instruction pertaining to a resource is detected. The recovery instruction is matched with a delete instruction that caused the resource to enter a soft-deleted. A mismatch between a first user account associated with the recovery instruction and a second user account associated with the delete instruction is determined. A mitigation action is performed based on determining the mismatch between the first user account and the second user account.

Methods, systems and computer programs for detecting potentially suspicious resource access events

A system for dynamically determining the legitimacy of a source internet protocol (IP) address requesting access to a target resource includes an address classifier, a resource similarity identifier, and a connection legitimacy prediction engine. The IP address classifier classifies the source IP address into a relevant address group selected from among a plurality of address groups. Each of the address groups consist of IP addresses that satisfy at least one address similarity criterion. The resource similarity identifier identifies a group of similar resources for the target resource based commonalities in a first subset of the address groups that have previously accessed the target resource and subsets of the address groups that have accessed each of the similar resources. The connection legitimacy prediction engine compute a probability of receiving a legitimate new request to access the target resource from the relevant address group based on connection history data associated with the relevant address group and each of the similar resources. The system denies the request to access the target resource in response to determining that the probability falls below a defined threshold.

Growing community of inventors

Yehud, Israel

Shalom Shay Shavit