Ca, Inc.

Ca Technologies, Inc.

Secureworkscorp.

Steven Cornelis Versteeg

Xien Yao

John Sinclair Bird

Nathan Allin Hastings

Miao Du

John Collis Grundy

Naveen Arora

Jean-Guy Schneider

Robert Williams

Jun Han

Ramanjaneyulu Mallisetty

Victor Ooi

Jean-David Dahan

Gowtham Sen Potnuru

Surya Kiran Satyavarapu

Ron Marom

Souptik Sen

Avraham Rosenzweig

Nicholas Bargnesi

Li Sun

Cameron Murray Hine

Systems and methods for dynamically training a threat detection system include monitoring security analyst workflow data from security analysts analyzing scans of security logs. The workflow data includes rules applied to security log scan results, rule results selected for further analysis, tags applied to rule results, filters applied to rule results, rankings applied to rule results, or actions associated with a pivot by security analysts. A tagging classifier is then trained based on tags assigned to scan results. A review classifier is trained based on scan results previously reviewed by security analysts. A filter and ranking method is trained based on filters and rankings applied to the scan results. An automated threat hunting playbook is generated including the tagging classifier, the review classifier, and the filter and ranking method. The automated threat hunting playbook generates one or more scripts to automatically analyze incoming security data.

Systems and methods for automated threat detection

A password breach registry is utilized to secure a service provided by a service provider. The password breach registry is a publicly accessible registry and includes password tokens written by breached service providers. The password tokens indicate passwords used to access breached service providers that may have been breached. A service provider can subscribe to the password breach registry and periodically query the password breach registry to determine if a password token corresponding to a user of a service provided by the service provider has been written to the password breach registry. This may indicate that the user of the service utilizes the same password on other services that have been breached. Upon determining that the password token has been written to the password breach registry, the user can be locked out from the service to prevent a malicious actor from gaining access to the account of the user.

Password breach registry

A registry is utilized to identify personally identifiable information (PII) that has been breached. The registry is a distributed database shared by multiple organizations to track which PII has been breached in other organizations. A first service provider initially receives PII and corresponding signed descriptor from a user. The PII is used to verify an identity of the user and the signed descriptor describes the type of PII that is received. The first service provider queries the registry to determine if the signed descriptor of the user has been written to the registry by a second service provider, indicating that it has been breached at a service provided by the second service provider. If the first service provider uses the breached PII, the breached PII is invalidated by the first service provider.

Publicly readable blockchain registry of personally identifiable information breaches

A computer-implemented method is disclosed which detects that new source code linked to a defect identifier has been checked in to a source code repository for a given code branch of a software application. The new source code is automatically checked in to additional code branches of the software application based on the defect identifier. For each additional code branch into which the new source code is automatically checked in, code coverage metrics are determined which indicate an extent to which application source code of the code branch is tested by its corresponding test case source code before and after the automatic check in. If a difference between the code coverage metrics indicates that code coverage for the code branch has decreased by more than a predefined threshold, a notification is transmitted that indicates a test case deficiency for the code branch.

Effective defect management across multiple code branches

In a computer-implemented method for endpoint management, a plurality of messages communicated between a target endpoint and a client are recorded, in a computer-readable memory. Ones of the messages are clustered into respective groups, where the respective groups correspond to respective operation types of the ones of the messages included therein. For the respective operation types, respective message structures used by the target endpoint are determined based on commonalities among the ones of the messages of the respective groups corresponding to the operation types. For one of the respective operation types, a request to the target endpoint is generated in accordance with a corresponding one of the respective message structures used by the target endpoint. Related computer systems and computer program products are also discussed.

Machine learning-derived universal connector

In a method of service emulation, a plurality of messages communicated between a system under test and a target system for emulation are recorded in a computer-readable memory. Ones of the messages are clustered to define a plurality of message clusters, and respective cluster prototypes are generated for the message clusters. The respective cluster prototypes include a commonality among the ones of the messages of the corresponding message clusters. One of the message clusters is identified as corresponding to a request from the system under test based on a comparison of the request with the respective cluster prototypes, and a response to the request for transmission to the system under test is generated based on the one of the message clusters that was identified. Related computer systems and computer program products are also discussed.

Systems and methods for automatically generating message prototypes for accurate and efficient opaque service emulation

In a service emulation method, a transaction library storing a plurality of messages communicated between a system under test and a target system upon which the system under test depends is accessed responsive to receiving a request from the system under test. One of the messages stored in the transaction library is identified as corresponding to the received request based on a distance measure therebetween, and a response to the received request is generated using the one of the messages that was identified. Related systems and computer program products are also discussed.

Message matching for opaque service virtualization

A method, program product, and apparatus for managing profiles in an access management domain. In an embodiment, attribute field mapping rules are generated for an identity profile schema applied to a plurality of identity profiles and an account profile schema applied to a plurality of account profiles. Each of the identity profiles includes one or more identity attribute fields and each of the plurality of account profiles includes one or more account attribute fields. As part of generating attribute field mapping rules, a synchronization manager iteratively compares data in each of the identity attribute fields with data in one or more of each of the account attribute fields. In response to detecting a match between data in a given identity attribute field and data in a given account attribute field, the synchronization manager increments an attribute correlation value that is associated with the given identity attribute field and the given account attribute field. The synchronization manager compares attribute correlation values that are each associated with a same identity attribute field and identifies a dominant attribute correlation value based on said comparing attribute correlation values.

Identity-to-account correlation and synchronization

Provided are methods of providing a virtual service that may provide partial real time service to clients of a production computing service that is unavailable. Methods may include generating, based on transaction data corresponding to a production computing service that is available, a production computing service model that includes multiple request types and multiple confidence values that correspond to ones of the request types. Methods may include responding to a request received from a client of the production computing service with a model-generated response to the request in response to the production computing service being unavailable. The production computing service is updated with the request received from the client and the model-generated response responsive to the production computing service being available after being unavailable.

Virtual stand-in computing service for production computing service

In a service emulation method, a transaction library storing a plurality of messages communicated between a system under test and a target system upon which the system under test depends is accessed responsive to receiving a request from the system under test. One of the messages stored in the transaction library is identified as corresponding to the received request based on different weightings assigned to respective sections of the messages, and a response to the received request is generated using the one of the messages that was identified. Related systems and computer program products are also discussed.

Growing community of inventors

Ivanhoe, Australia

Steven Cornelis Versteeg