Emc IP Holding Company LLC

Shay Amram

Alex Zaslavsky

Carmit Sahar

Anatoly Gendelev

Kevin Bowers

Alon Kaufman

Marcelo Blatt

Eyal Kolman

Zohar Duchin

Kineret Raviv

Liron Liptz

Idan Achituve

Alon Hazan

Alma Zohar

Christina Tkachenko

Techniques are provided for evaluating anomaly detection algorithms using impersonation data derived from user transaction data. An exemplary method comprises obtaining transaction data of a given enterprise organization comprising transactions of a plurality of users; generating impersonation data by modifying one or more features of a subset of the transaction data of the given enterprise organization; classifying (i) at least a portion of the transaction data of the given enterprise organization, and (ii) at least a portion of the impersonation data using the anomaly detection algorithm of the given enterprise organization, wherein records of the impersonation data comprise a known classification; and evaluating a performance of the anomaly detection algorithm of the given enterprise organization by comparing the classification of records of the impersonation data by the anomaly detection algorithm with the known classification.

Evaluation of anomaly detection algorithms using impersonation data derived from user data

Techniques of risk-based authentication involve adjusting a risk engine used by a recipient entity based on feedback acquired from multiple entities. Along these lines, both a recipient risk engine and one or more donor risk engines perform risk-based authentication for which respective feedback is generated. The feedback indicates whether certain transaction requests predicted to be fraudulent are confirmed to be fraudulent. The recipient risk engine is then adjusted based on the feedback created for itself, the feedback created for any of the donor risk engines, or some combination thereof.

Maintaining a risk model using feedback directed to other risk models

Techniques are provided for smoothing discretized values used, for example, for authentication or identity assurance. An illustrative method comprises obtaining at least one probability of transitioning between at least two discretized values of a given feature; computing a smoothed feature score for the given feature for a transition from a first one of the discretized values to a second one of the discretized values based on the probability of the transition from the first discrete value to the second discrete value; and performing one or more of authenticating a user and verifying an identity of a user based at least in part on the smoothed feature score. The probabilities of transitioning between the discretized values are optionally stored in a transition matrix. Feature scores for first and second discretized values are optionally weighted based on the probability of the transition from the first discrete value to the second discrete value.

Smoothing of discretized values using a transition matrix

Techniques are provided for determining anomaly scores for transactions based on adaptive clustering of the location of a given user over multiple transactions. In one embodiment, a method comprises obtaining transaction data for a given computer transaction by a user; extracting one or more location features from the transaction data for the given computer transaction; determining a user location of the given computer transaction based on the one or more location features; assigning the given computer transaction to one user location cluster of a plurality of user location clusters of the user based on a distance between the user location and centroids of each of the plurality of user location clusters, when the determined user location satisfies one or more predefined distance criteria; determining an anomaly score for the given computer transaction based at least in part on a centroid location of the assigned user location cluster; and updating the centroid location of the assigned user location cluster based on the user location.

Anomaly score generation based on adaptive clustering of user location

There is disclosed in one embodiment a method comprising the step of determining, access rights granted to a first user that enables access to a computerized resource. The method also comprises the step of comparing the access rights granted to the first user against access rights granted to a second user associated with the first user. The method further comprises the step of providing a warning when the comparison indicates that the first user has excessive access rights over the second user.

Method, apparatus and computer program product for identifying excessive access rights granted to users

Methods and apparatus are provided for identifying suspicious domains using common user clustering. An exemplary method comprises obtaining network event data comprising a plurality of network connections; identifying users and domains associated with the network connections in the network event data; creating a connection between each user/domain pair that communicate with one another in the identified users and the identified domains to generate a graph; connecting domains in the graph using inter-domain edges that share common users to obtain a graph of interconnected domains; identifying bi-connected components in the graph of interconnected domains, wherein the bi-connected components comprise node pairs having at least two paths in the graph of interconnected domains between them; and processing the bi-connected components to identify a plurality of suspicious domains that are likely to participate in a computer security attack. The graph of interconnected domains is optionally pruned and/or filtered to remove one or more inter-domain edges.

Methods and apparatus for identifying suspicious domains using common user clustering

Techniques of performing authentication involve comparing current user authentication factors with previous authentication factors selected from multiple users during a single authentication session. Along these lines, suppose that an authentication server receives current browser characteristics from a user computer during a current authentication session. Based on the current browser characteristics, the authentication server selects previous browser characteristics received from devices used by multiple users during previous authentication sessions. For example, the authentication server may select previous browser characteristics based on the whether any of the results of a modified, locally sensitive hashing (LSH) of the previous browser characteristics match any of the results of a modified LSH of the current browser characteristics. After the authentication server selects the previous browser characteristics, the authentication server compares those selected, previous browser characteristics with the current browser characteristics.

Growing community of inventors

Holon, Israel

Shay Amram