Interset Software, Inc.

International Business Machines Corporation

Stephan F Jou

Shaun Pilkington

Michael John Cyze

Michael Iles

Wesley Lawrence

Joanna W Ng

Diana H Lau

Alex T Lau

Maria Pospelova

Mario Daigle

Ross Diener

Doug Liversidge

Josh Mahonin

Josh Christopher Tyler Mahonin

A system and method is described for providing custom predictive models for detecting electronic security threats within an enterprise computer network. The custom models may be defined in a declarative language. The custom models, along with native models, may be combined together to provide custom machine learning (ML) use cases.

System and method for custom security predictive methods

A computing device includes a processor and a medium storing instructions. The instructions are executable by the processor to: receive a database query for an approximate aggregation of a numerical value of a plurality of records, wherein each record includes the numerical value and a filter value; in response to the database query, determine a count of records that have filter values within an importance threshold associated with the database query; and determine the approximate aggregation of the numerical value based on the count of records and the importance threshold associated with the database query.

Approximate aggregation queries

Predictive entity resolution uses a set of identity models to resolve an attribute to one or more associated entities, possibly with respective probabilities, at a particular time. The predictive entity resolution generates the sets of identity models from evidence events received from evidence sources. Each evidence event has at least one attribute and an associated time stamp.

Predictive entity resolution

The systems and methods described herein, given a population of entities each with associated information technology (IT) security risk scores, computes an aggregate risk score which quantifies the overall risk of the population. The method works for any arbitrary population of any size, and of any combination of different entity types and results in normalized risk scores for the arbitrary population (i.e. in the [0,1] range, regardless of population size or makeup). Since the risk scores are normalized, it affords comparison across different arbitrary entity populations having different combinations of entity types (e.g. users, servers, and printers). The aggregation technique allows for sensitivity to small numbers of high risk entities, which is a highly desirable characteristic for risk-based applications, and allows for sensitivity to different entity types or other relevant factors such as higher risk users, different threat types.

Aggregation of risk scores across ad-hoc entity populations

Humans as well as non-human actors may interact with computer devices on a computer network. As described herein, it is possible to train and apply human vs. non-human detection models to provide an indication of the probability that a human or a non-human actor was interacting with a computer device during a particular time period. The probability that a human or non-human was interacting with computers during a particular time may be used to improve various actions, including selecting one or more different threat detection models to apply during the particular time, selecting data to use with threat detection models during the time, or selecting data from the particular time to store.

Systems and methods for discriminating between human and non-human interactions with computing devices on a computer network

The present invention provides a method, system and computer program product for analyzing risks, for example associated with potential data leakage. Risk for activities may be measured as a function of risk components related to: persons involved in the activity; sensitivity of data at risk; endpoint receiving data at risk; and type the activity. Risk may account for the probability of a leakage event given an activity as well as a risk cost which reflects the above risk components. Manually and/or automatically tuned parameters may be used to affect the risk calculation. Risk associated with persons and/or files may be obtained by: initializing risk scores of persons or files based on a rule set; adjusting the risk scores in response to ongoing monitoring of events; identifying commonalities across persons or files; and propagating risk scores based on the commonalities.

Method and system for analyzing risk

Sensitive data may be anonymized for use in user interfaces by applying a cryptographic hash function to the data. The hashed value may be broken into hash tokens and the hash tokens converted to human readable tokens using a 1:1 conversion function. The human readable tokens can then be concatenated together to provide a human readable identifier of the sensitive data.

Anonymization of sensitive data for use in user interfaces

The present invention provides methods for providing mathematical regression analysis. In particular, the method for conducting regression analysis comprises the steps of: selecting a regression model; selecting an initial set of regression parameters; applying the regression model to the initial set of regression parameters to create an initial set of regression values; selecting an improved set of regression values, wherein the improved set of regression values is selected from the set of initial regression values; generating a loss function based on the improved set; applying an iterative optimization method to the loss function and the improved set of regression values to generate a resultant set of regression values; and outputting the resultant set of regression values.

Systems and methods for mathematical regression with inexact feedback

The present invention provides a method of identifying aggregating and mathematically ranking security alert data having the steps of identifying a plurality of alerts, selecting a subset of the plurality alerts based on at least one preselected theme, applying a function to the subset of the plurality alerts to compute an aggregate risk score, the function based on at least one factor and prioritizing the aggregate risk score in a risk score list.

Method and system for aggregating and ranking of security event-based data

An illustrative embodiment of a computer-implemented method for predictive analytic queries includes creating a user-defined predictive analytics query using a set of syntactic grammar that defines a correct syntax of the user-defined predictive analytics query including a created set of predictive analytics by-example vocabularies and a set of subject-specific by-example vocabularies forming a set of by-example vocabularies, wherein the set of syntactic grammar defines semantics of each syntactically correct predictive analytics query using the by-example vocabularies such that predictive analytics queries can be expressed with semantic precision using this constrained Natural Language Processing (cNLP) approach. The computer-implemented method further generates a predictive analytic model and runtime query, using the user-defined predictive analytics query, executes the runtime query using the predictive analytic model to create a result, and returns the result to the user.

Predictive analysis by example

A report rendering system and method of filtering and navigating reports on mobile devices are provided. The report rendering system comprises a scene generator for generating a scene of a report in response to a request to view the report or a subset of the report and a navigation module for storing selected components within the scene. The method comprises the steps of generating a scene of a report in response to a request to view the report or a subset of the report and storing selected components within the scene.

System and method of report rendering

A report representation system and method of transforming report outputs into a standard representation format are provided. The report representation system comprises a report parser for parsing a report output, a code generator for generating a standard representation code of the report output and a code compiler for converting the standard representation code into a format representable as a fixed schema repository. The method comprises the steps of parsing a report output, generating a standard representation code of the report output and converting the standard representation code into a format representable as a fixed schema repository.

Growing community of inventors

Richmond Hill, Canada

Stephan F Jou