Splunk Inc.

Narus, Inc.

Symantec Corporation

The Boeing Company

Gluware Ip, LLC

Stanislav Miskovic

Mario Baldi

Satheesh Kumar Joseph Durairaj

Antonio Nucci

Yong Liao

Georgios Apostolopoulos

Kevin Alejandro Roundy

Michael Andrew Hart

Chris Gates

George Apostolopulous

Dimitrios Terzis

Qiang Xu

Sung-Ju Lee

Aleksandar Kuzmanovic

Matteo Dell'Amico

Sabyasachi Saha

Ruben Torres

Olivier Huynh Van

Han Hee Song

Giovanni Vigna

Christopher Kruegel

Ning Xia

Luca Invernizzi

Tim Silverline

Cui Lin

Jeffrey T Boone

Kyle Scarmardo

Ernest J Lefner, Iv

Kevin Irwin

A method of determining scores specific to a system is provided. The method comprises determining scores based on data associated with a component configuration, classifying the scores with respect to categories and subcategories, generating an aggregate score representative of a total performance of a component configuration, the generating including: generating a first category score specific to a first category and a second category score specific to a second category, performing normalization operations on the first category score and the second category score, wherein the first category score is representative of a first characteristic of the component configuration and the second category score representative of a second characteristic of the component configuration, combining the first normalized category score with the second normalized category score, and providing the aggregate score representative of an aggregate performance of the component configuration based on the first characteristic and the second characteristic.

Hierarchical scoring system for distributed networks

A system and method of obtaining and utilizing an activity signature that is representative of a specific category of network activities based on directory service (DS) log data. The activity signature may be determining by a learning process, including segmenting and pruning a training dataset into a plurality of event segments and matching them with activities based on DS log data of known activities. Once obtained, the activity signature can advantageously be utilized to analyze any DS log data and activities in actual deployment. Using activity signatures to analyze DS event log can reveal roles of event-collection machines, aggregate information dispersed across their component events to reveal actors involved in particular AD activities, augment visibility of DS by enabling various vantage points to better infer activities at other domain machines, and reveal macro activities so that logged information becomes easily interpretable to human analysts.

Network activity identification and characterization based on characteristic active directory (AD) event segments

A computerized method is disclosed that includes operations of obtaining network traffic data between a source device and a destination device, performing a regularity assessment of a first metric of the network traffic data across communication sessions of the source device and the destination device over a given time period by: determining an average of the first metric for each of the communication sessions; establishing an upper bound and a lower bound for the averages of the first metric over the given time period; determining a difference between the upper bound and the lower bound; comparing the difference between the upper bound and the lower bound to a mean of the first metric for each of the communication sessions over the given time period, and determining whether beaconing transmissions are present within the network traffic data based on the regularity assessment of the first metric.

Systems and methods for detecting beaconing communications in aggregated traffic data

A lateral movement application identifies lateral movement (LM) candidates that potentially represent a security threat. Security platforms generate event data when performing security-related functions, such as authenticating a user account. The disclosed technology enables greatly increased accuracy identification of lateral movement (LM) candidates by, for example, refining a population of LM candidates based on an analysis of a time constrained graph in which nodes represent entities, and edges between nodes represent a time sequence of login or other association activities between the entities. The graph is created based on an analysis of the event data, including time sequences of the event data.

Lateral movement candidate detection in a computer network

Graph-based detection of lateral movement

A method for inferring a user interest from geo data items associated with the user. The method includes retrieving point-of-interests (PoIs) from a PoI information repository based on the geo data items, generating a weighted count of the PoI for each geo data item that is weighted based on an attribute of the geo data item, and aggregating the weighted count across all geo data items to generate a score of the PoI, wherein the interest level of the user is inferred based at least on the score of the PoI.

Inferring user interests from geo-location reports

Lateral movement detection through graph-based candidate selection

A method for classifying network traffic in a network. The method includes obtaining, from an application distribution source, an application distribution data set of comprising information associated with distributing an application from the pre-determined application distribution source, extracting, based on a pre-determined extraction criterion, a token from the application distribution data set of the application, obtaining, from the network traffic, a plurality of flows generated by the application, extracting, in response to detecting the token in a flow of the plurality of flows, context information associated with the token in the flow, and generating an identification rule of the application based on the token and the context information, wherein the identification rule describes one or more rule steps to locate the token in the flow, wherein the network traffic is classified using at least the identification rule.

System and method for extracting signatures from controlled execution of applications and application codes retrieved from an application source

Embodiments of the invention provide a method, system, and computer readable medium for classifying network traffic based on application signatures generated during a training phase. The application signatures are generated based on tokens extracted from a training set that is generated by a particular application during the training phase. Accordingly, a new token extracted in real-time from current network data is compared to the application signatures to determine if the current network data is generated by the particular application.

System and method for extracting signatures from controlled execution of applications and using them on traffic traces

A method for applying a user-specific policy in a network. The method includes identifying a historical portion of network traffic of the network as associated with a user, analyzing, by a computer processor, the historical portion of network traffic to generate a fingerprint of the user, wherein the fingerprint represents characteristics of user activity in the network, identifying, by the computer processor, an ongoing portion of network traffic of the network as associated with the user, analyzing, by the computer processor and based on the fingerprint, the ongoing portion of network traffic to determine a match, wherein the match is determined at a time point within the ongoing portion of network traffic, and applying, in response to determining the match, the user-specific policy to the ongoing portion of network traffic subsequent to the time point.

User-specific policy enforcement based on network traffic fingerprinting

The disclosed computer-implemented method for providing integrated security management may include (1) identifying a computing environment protected by security systems and monitored by a security management system that receives event signatures from the security systems, where a first security system uses a first event signature naming scheme that differs from a second event signature naming scheme used by a second security system, (2) observing a first event signature that originates from the first security system and uses the first event signature naming scheme, (3) determine that the first event signature is equivalent to a second event signature that uses the second event signature naming scheme, and (4) performing, in connection with observing the first event signature, a security action associated with the second event signature and directed to the computing environment. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for providing integrated security management

Alerts generated by triggering signatures on endpoints are identified in samples of security telemetry. The sources of alerts are filtered. Alert tuples identifying multipart attacks are discovered. An iterative multi-pass search of alert types generated by filtered sources can be conducted. During each pass, groups of successively larger numbers of alert types generated by common sources are identified. A list of alert types can be sorted according to the number of filtered sources that generated each alert type, from most to least. Pairs of alert types with multiple common sources can be identified by traversing the sorted list of alerts types. The sorted list can be iteratively traversed, identifying successive additional alert types to add to previously identified groupings, which are used as seed groups for successive identifications. Only the portion of the sorted list appearing after the last added alert type need be examined for successive identifications.

Discovery of groupings of security alert types and corresponding complex multipart attacks, from analysis of massive security telemetry

The disclosed computer-implemented method for detecting security blind spots may include (i) detecting, via an endpoint security program, a threat incident at a set of client machines associated with a security vendor server, (ii) obtaining an indication of how the set of client machines will respond to the detecting of the threat incident, (iii) predicting how a model set of client machines would respond to the threat incident, (iv) determining that a delta exceeds a security threshold, and (v) performing a security action by the security vendor server, in response to determining that the delta exceeds the security threshold, to protect the set of client machines at least in part by electronically notifying the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting security blind spots

Tunable metrics are used for iterative discovery of groups of security alerts that identify complex, multipart attacks with different properties. Alerts generated by triggering signatures on originating computing devices are iteratively traversed, and different metrics corresponding to alerts and alert groups are calculated. The calculated metrics quantify the feasibility of the evaluation components (alerts and/or alert groups) for inclusion in tuples identifying multipart attacks with specific properties. Alerts and successively larger alert groups are iteratively joined into tuples, responsive to evaluation components meeting thresholds based on corresponding calculated metrics. Only those evaluation components that meet specific thresholds based on the calculated metrics are added to alert groups. Metrics are only calculated for those components that have met corresponding metric-based thresholds during prior iterations. Discovered tuples can be transmitted to multiple endpoint computing devices, where the tuples can be utilized as signatures to detect and defend against multipart attacks.

Using tunable metrics for iterative discovery of groups of alert types identifying complex multipart attacks with different properties

Growing community of inventors

San Jose, CA, United States of America

Stanislav Miskovic