Micro Focus Lcc

Intertrust Technologies Corporation

Entit Software LLC

Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Tomas Sander

Binyamin Pinkas

William G Horne

Brian Frederik Hosea Che Hein

Stuart Haber

Nadav Cohen

Ted Ross

Pratyusa Kumar Manadhata

Anurag Singla

Sandeep N Bhatt

Robert E Tarjan

Terence Spies

Susan K Langford

Prasad V Rao

Edward Ross

Tomasz Jaroslaw Bania

Manish Marwah

Joshua Hailpern

Amir Kibbar

Siva Raj Rajagopalan

Suranjan Pramanik

Daniel L Moor

Liqun Chen

Renato Keshet

Siani Lynne Pearson

Krishnamurthy Viswanathan

Barak Raz

William G Home

Brent James Miller

Serhan Shbeita

Richard D Austin

Danfeng Yao

Examples disclosed herein relate to source entities of security indicators. Some examples disclosed herein enable identifying, in a security information sharing platform, a security indicator that is originated from a source entity where the security indicator comprises an observable. Some examples further enable determining a reliability level of the source entity based on at least one of: security events, sightings of the observable, a first set of user feedback information that is submitted for the security indicator by users of the security information sharing platform, or a second set of user feedback information that is collected from external resources that are external to the security information sharing platform.

Source entities of security indicators

Examples disclosed herein relate to strength of associations among data records in a security information sharing platform. Some examples may enable creating, in the security information sharing platform, an association between a security indicator comprising an observable, and a data record. Some examples may further enable determining strength of the association between the security indicator and the data record based on at least one of: a likelihood of change in the association; a creator of the association; an aging rate of the association; or a quality of evidence that supports the association.

Strength of associations among data records in a security information sharing platform

A machine-readable medium may store instructions executable by a processing resource to access log data of an enterprise and extract time-series data of an enterprise entity from the log data. The time-series data may include measured feature values of a set of selected features over a series of time periods. The instructions may be further executable to train a predictive model specific to the enterprise entity using the time-series data, wherein the predictive model is to generate, for a particular time period, a predicted feature value for each of the selected features; access actual feature values of the enterprise entity for the particular time period; apply first-level deviation criteria to the actual feature value and the predicted feature value of each selected feature to identify deviant features of the enterprise entity; and apply second-level deviation criteria to the identified deviant features to identify the enterprise entity as behaving abnormally.

Abnormal behavior detection of enterprise entities using time-series data

In some examples, a plurality of alerts relating to issues in a computing arrangement are received, where the plurality of alerts generated based on events in the computing arrangement. A subset of the plurality of alerts is grouped into a bundle of alerts, the grouping being based on a criterion. The bundle of alerts is communicated to cause processing of the alerts in the bundle of alerts together.

Grouping alerts into bundles of alerts

In some examples, an alert relating to an issue in a computing arrangement is received. It is determined that the received alert is similar to a given alert in an information repository containing information of past processes performed to address respective issues, the determining comprising comparing a property associated with the received alert to a property of alerts associated with the past processes, and the information contained in the information repository comprising actions taken in the past processes to address the respective issues. Performance of a remediation action is triggered that comprises an action, identified by the information in the information repository, taken to respond to the given alert.

Responding to alerts

A technique includes determining relations among a plurality of entities that are associated with a computer system; and selectively grouping behavior anomalies that are exhibited by the plurality of entities into collections based at least in part on the determined relations among the entities. The technique includes selectively reporting the collections to a security operations center.

Reporting behavior anomalies

Examples disclosed herein relate to data objects associated with private set intersection (PSI). Some examples disclosed herein may enable identifying a set of server elements and a set of data objects. Each data object of the set of data objects may be associated with at least one server element of the set of server elements. Some examples further enable sending the set of server elements and the set of data objects to a client computing device that has a set of client elements. A private set intersection (PSI) between the set of server elements and the set of client elements may be inaccessible by the client computing device, and a subset of the set of data objects that are associated with the PSI may be accessible by the client computing device.

Data objects associated with private set intersection (PSI)

Updating ground truth data in a security management platform is disclosed. One example is a system including at least one processor and a memory storing instructions executable by the at least one processor to receive, in a security management platform, event data relating to a plurality of events corresponding to operation of a computing arrangement in a current time interval, and computing ground truth data for the current time interval based on the received event data, and threat intelligence data from time intervals preceding the current time interval. A prediction model is applied to generate predictions for the current time interval based on the received event data. Ground truth data is re-computed for the time intervals preceding the current time interval based on a comparison of the generated predictions and the computed ground truth data.

Updating ground truth data in a security management platform

Examples disclosed herein relate to visualization of associations among data records in a security information sharing platform. Some examples may enable creating, in the security information sharing platform, an association between a first data record comprising a security indicator, and a second data record. Some examples may further enable providing a visual representation of the first data record, the second data record, and the association, wherein the first data record represents a first node in the visual representation, the second data record represents a second node in the visual representation, and the association represents an edge that connects the first node and the second node.

Visualization of associations among data records in a security information sharing platform

Examples disclosed herein relate to encryption of community-based security information. Some examples may enable authorizing a user of a community to access an encrypted data item (e.g., at least an encrypted portion of community-based security information of that community) using a decryption key. The community may be generated on a security information sharing platform based on a set of community attributes. The decryption key may comprise a private key corresponding to each user attribute of a set of user attributes that are associated with the authorized user where the set of user attributes satisfy the set of community attributes.

Encryption of community-based security information

In one example in accordance with the present disclosure, a method for threat score determination includes detecting a change in malicious activity for a security object. The method also includes identifying an indicator that provides contextual information for the security object and determining a linked resource that is associated with a database record of the security object. The method also includes determining a first threat score associated with the security object and determining a relationship between the linked resource and the security object. The method also includes determining a second threat score associated with the linked resource based on the indicator, the threat score of the linked object and the relationship between the linked resource and the security object.

Threat score determination

Examples disclosed herein relate to generating communities on a security information sharing platform. Some examples may enable identifying a set of community attributes to be used to generate a community on the security information sharing platform that enables sharing of security information among a plurality of communities. Some examples may enable authorizing a first user to access community-based security information of the community where the first user is associated a set of user attributes that satisfy the set of community attributes. A security indicator may be obtained from the first user of the community. Information related to the security indicator may be obtained from a second user of the community. Some examples may enable including the security indicator and the information related to the security indicator in the community-based security information of the community.

Communities on a security information sharing platform

Example implementations relate to performance tracking in a security information sharing platform. For example, the security information sharing platform may enable sharing of security information among a plurality of users. A method of performance tracking in the security information sharing platform may include monitoring user behavior in the security information sharing platform, comparing the user behavior against a plurality of performance objectives in the security information sharing platform, and assigning a badge to a user among the plurality of users, for achievement of a performance objective among the plurality of performance objectives, based on the comparison.

Performance tracking in a security information sharing platform

Examples disclosed herein relate to associations among data records in a security information sharing platform. Some examples may enable creating, in the security information sharing platform that enables sharing of security information among a plurality of users, an association between a first security indicator comprising a first observable and a first data record based on sightings of the first observable by at least one source entity associated with the first data record. Some examples may further enable obtaining a search query that specifies the first security indicator, and identifying a set of data records that satisfy the search query. The set of data records may include the first data record.

Associations among data records in a security information sharing platform

In some examples, a method of privacy preservation in a security information sharing platform includes comparing, by a system comprising a hardware processor in the security information sharing platform that enables sharing of security information among a plurality of users, a set of profiles wherein each profile of the set of profiles is associated with an individual user; identifying, by the system based on the comparing, that a badge associated with a particular profile of the set of profiles is predictive of an identity of the individual user, the badge based on a contribution of security information by the individual user to the security information sharing platform, and the badge comprising user attributes associated with the individual user; and modifying, by the system based on the identifying, a visibility of the badge within the security information sharing platform.

Growing community of inventors

New York, NY, United States of America

Tomas Sander