Microsoft Technology Licensing, LLC

Imperva, Inc.

Zengo Inc.

Microsoft Israel Research and Development (2002) Ltd

Tal Arieh Be'ery

Amichai Shulman

Idan Plotnik

Itai Grady

Sivan Krigsman

Nitzan Niv

Michael Dubinsky

Shelly Hershkovitz

Tom Jurgenson

Gil David

Omer Shlomovits

Ouriel Ohayon

Gary Benattar

Benny Lakunishok

Michael Dolinsky

Marina Simakov

Ami Luttwak

Amit Rosenzweig

Tal Joseph Maor

Itai Grady Ashkenazy

Ohad Plotnik

Yaron Kaner

Gregory Messerman

Tomer Bitton

Menahem Cherbakovsky

Alexander Manuskin

Oded Leiba

Chaim Menachem Hoch

Systems and methods of performing multi factor authentication (MFA), including: receiving, by a computing device, an MFA request from a first server, generating, by the computing device, a first share of a cryptographic key, based on a multi-party computation (MPC) protocol, generating, by a second server, a corresponding second share of the cryptographic key, based on the MPC protocol, wherein the cryptographic key corresponds to a public key and private key pair, co-signing, by the computing device and the second server, the MFA request based on the MPC protocol, wherein the computing device signs the MFA request with the first share and the second server signs the MFA request with the second share, and verifying, by the first server, the signed MFA request.

System and method of multi-party computation based multi-factor authentication

Methods and systems of recovering a cryptographic key associated with a blockchain based computer network, including encryption of at least a portion of a cryptographic key of the computer network with a recovery public key, sending of the encrypted at least a portion of the cryptographic key to at least one second computing device, sending of a recovery private key to a recovery escrow service, detection that the at least one first computing device is unavailable, publishing the recovery private key in a public repository, retrieving the recovery private key from the public repository, and decryption of the encrypted at least a portion of the cryptographic key by the at least one second computing device.

System and method for key recovery and verification in blockchain based networks

Systems and methods for determining a user's presence on a network of an enterprise are provided. Traffic is collected to a network from devices and, over a period of time, login and logoff information from a user is determined from the collected network traffic. Network sessions are determined from a user's login and logoff information and timetable is generated specific to the user that contains the network sessions. The time table identifies when the user was active and when the user was not active based on the login and logoff information and, therefore, present at a particular location over a period of time.

Establishing user's presence on internal on-premises network over time using network signals

Systems and methods of managing a shared cryptographic account for a first user and at least one second user in a blockchain based computer network, including: generating, by a first computing device of the first user, a first share of a cryptographic key, generating, by a server, a corresponding second share of the cryptographic key, wherein the cryptographic key corresponds to a public key and private key pair, and wherein the private key is configured to decrypt shares of the cryptographic key that are encrypted by the public key, generating a group ID for a group of users of the shared cryptographic account, distributing, by the server, the first share among each of the at least one second user, and enforcing a signing logic scheme for users of the group when signing with the shared cryptographic account.

System and method of management of a shared cryptographic account

Systems and methods of securing interface to a blockchain based network, including generating, by a server, a proxy communication layer for communication between the server and a computerized device, wherein the proxy communication layer replaces an IP address of the computerized device with another IP address, intercepting, by the server, data communicated through the proxy communication layer, and blocking, by the server, unauthorized communication data intercepted by the server, wherein communication requests associated with unauthorized IP addresses are blocked, where the server is in communication with the blockchain based network, and wherein the server provides a web interface to decentralized applications of the blockchain based network.

System and method of secured interface to a blockchain based network

Systems and methods of cryptographic key distribution in a plurality of networks, including: sharing, by a first device, a first portion of a first cryptographic key controlled by a server with a second device, sharing, by the second device, a first portion of a second cryptographic key with the first device, signing a first transaction on a first network with data exchange from a first threshold signature address controlled by the first device, to a third address when one or more details of the first transaction are validated by the server; and signing a second transaction on a second network with data exchange from the second threshold signature address controlled by the second device to a fourth address when one or more details of the second transaction are validated by the server.

System and method of cryptographic key management in a plurality of blockchain based computer networks

According to one embodiment, a web application layer attack detector (AD) is coupled between an HTTP client and a web application server. Responsive to receipt of a set of packets from the HTTP client carrying a web application layer message that violates a condition of a security rule, the AD transmits an alert package to an automatic attribute value generation and rule feedback module (AVGRFM). The AVGRFM uses the alert package, and optionally other alert packages from the same AD or other ADs, to automatically generate a new set of attribute values for each of a set of attribute identifiers for use, by the AD or other ADs, in a different security rule than the violated security rule. The new set of attribute values may be used in an attack specific rule to detect a previously unknown web application layer attack.

Automatic generation of attribute values for rules of a web application layer attack detector

An analyzer module (AM) within a same protected network and on-premise with a server detects and distinguishes between types of Denial-of-Service (DoS) attacks. The AM tracks whether test messages, which include test request messages that a signal generation module (SGM) is configured to transmit to the server according to a predefined time schedule to allow the AM to detect and distinguish between types of DoS attacks, are timely received. The AM is aware of the predefined time schedule according to which the SGM is configured to transmit the test request messages to the server. The AM detects an occurrence of a DoS attack and identifies the type of the DoS attack based upon the result of the tracking indicating that a number of the test messages have not been timely received.

Coordinated detection and differentiation of denial of service attacks

The threat of malicious parties exposing users' credentials from one system and applying the exposed credentials to a different system to gain unauthorized access is addressed in the present disclosure by systems and methods to preemptively and reactively mitigate the risk of users reusing passwords between systems. A security device passively monitors traffic comprising authorization requests within a network to reactively identify an ongoing attack based on its use of exposed credentials in the authorization request and identifies accounts that are vulnerable to attacks using exposed credentials by actively attempting to log into those accounts with exposed passwords from other networks. The systems and methods reduce the number of false positives associated with attack identification and strengthens the network against potential attacks, thus improving the network's security and reducing the amount of resources needed to securely manage the network.

Detecting attacks using compromised credentials via internal network monitoring

Embodiments are directed to monitoring local users' activity without installing an agent on a monitored machine. Periodic scans of the local users' directory using the standard protocol messages and APIs of a remote admin interface provide access to local machine data. Using the remote admin interface, defenders gain visibility to local users' logons, group membership, password changes, and other parameters. Security applications enabled by this visibility include, but are not limited to, abnormal logons detection, abnormal group addition and removal detection, and abnormal password changes detection.

Detecting local user security-related anomalies using active scans

According to examples, an apparatus for managing alerts pertaining to additions of users to a user group in a computer network may include a processor and a memory, which may have stored thereon machine readable instructions that are to cause the processor to, during a learning period, identify an entity that added a user to the user group during the learning period and enter an identification of the identified entity into an allowed entity list for the user group. Following the learning period, the instructions are to cause the processor to identify a user addition event that indicates that an adding entity added another user to the user group, determine whether the adding entity is in the allowed entity list, and manage issuance of an alert regarding the user addition event based upon whether the adding entity is in the allowed entity list to reduce a number of issued alerts.

Managing alerts regarding additions to user groups

There is provided a method for detecting a malicious attempt to access a service providing server using credentials of a client terminal in a network, the method performed by a malicious event detection server analyzing packets transmitted over the network, comprising: analyzing at least one login-credential associated with an attempt to obtain authentication to access the service providing server to determine whether the login-credential matches an invalid login-credential included in a set of honeytoken-credentials, wherein the set of honeytoken-credentials is stored on a local memory of the client terminal, wherein the set of honeytoken-credentials includes the invalid login-credential and a valid login-credential, wherein the invalid login-credential is invalid for authentication of the client terminal to access the service providing server and the valid login-credential is valid for authentication of the client terminal to access the service providing server; and identifying a malicious event when the login-credential matches the invalid login-credential.

Systems and methods for the detection of advanced attackers using client side honeytokens

Mitigating false positives for impossible travel alerts. A first user access location for a user is provided, for a first user access of computing resources identified using a first identification process, to a user behavior analytics service. The first identification process identifies a real world indicator of location for a device associated with the first user access. A second user location is provided for the user, for a second user access of computing resources, to the user behavior analytics service, using a second identification process. The second identification process identifies a location associated with an egress point to which communication to and from a device is routed to access computing resources, such that the user behavior analytics service receives a location associated with the egress point as the second user location. At the user behavior analytics service, the second user location is filtered from being used for impossible travel detection.

System to filter impossible user travel indicators

A system and method for performing IP to name resolution in organizational environments. IP addresses are determined for devices utilizing the corporate network. An IP address is resolved to a first device name and then the same IP address is subsequently resolved to a second device name. A profile is generated such as a timeline for the IP address including both the first and second device names. The timeline may be queried to determine whether the first device name or the second device name was associated with the IP address during a period of time.

Active and passive method to perform IP to name resolution in organizational environments

According to one embodiment, an analyzer module (AM) within a same protected network and on-premise with a web application server (WAS) detects and distinguishes between types of Denial-of-Service (DoS) attacks. The AM tracks whether test HTTP messages, which include test HTTP request messages that a signal generation module (SGM) is configured to transmit to the WAS and test HTTP response messages that the WAS is expected to transmit in response to the test HTTP request messages, are timely received. The AM is aware of a timeliness that the SGM is expected to transmit the test HTTP request messages and that the WAS is expected to transmit the test response HTTP messages. The AM detects an occurrence of a DoS attack and identifies the type of the DoS attack based upon the result of the tracking indicating that a number of the test HTTP messages have not been timely received.

Growing community of inventors

Petach Tikva, Israel

Tal Arieh Be'ery