Rapid7, Inc.

Nike, Inc.

Vasudha Shivamoggi

Roy Donald Hodgman

Wah-Kwan Lin

Jocelyn Beauchesne

John Lim Oh

Devavrat D Shah

Ying-zong Huang

Vishal Doshi

Katherine Wilbur

Ritesh Madan

Balaji Rengarajan

Dustin Myers

Oliver Keyes

Matthew Berninger

Kwan C Lin

Luke Ludington

Jacqueline Daniel

Lauren Johnson

Vighnesh Sachidananda

George Chen

Some embodiments provide techniques for detecting cyberattacks against a software service authentication system that authorizes access to software services. The techniques access a user activity profile specifying values of parameters indicating the user's pattern of requesting access to unique software service(s). The techniques monitor the activity of the user over a time period to obtain software request data indicating request(s) by the user to access software services in the time period. The techniques determine, using the software service request data and the user activity profile, whether computing activity of the user during the time period is anomalous.

Techniques for detecting cyberattacks on an authentication system

Computer-implemented prediction methods, in accordance with various embodiments, involve storing key-value pairs each including a key tuple and an associated value in a data store, building a prediction model associated with at least a subset of the key-value pairs, and in response to receipt of a prediction query that specifies a key tuple, generating a prediction response based on the prediction model that includes a predicted value for the specified key tuple. In one example application, the key tuples each include an operation specifying a purchase and a two-part identifier specifying a customer and a product.

Event prediction

A method includes obtaining a command captured at a computing device to start a process on the computing device submitted via a command line interface. The command is of a plurality of commands captured at respective computing devices that triggered respective alerts to review the plurality of commands. The method includes parsing the command to generate a plurality of tokens that represent the command according to dictionary of features of commands submitted via the command line interface, generating a feature vector based, at least in part, on the plurality of tokens, applying a classification model, trained on other commands submitted via the command line interface to predict benign commands, to the feature vector to determine a score indicative of a probability that the command is benign, and, responsive to a determination that the score is above a confidence threshold, removing the command from the plurality of commands to be reviewed.

Command line parsing for classification of process start alerts

An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.

Automated generation of anomaly scenarios for testing machine learned anomaly detection models

Various embodiments include systems and methods to implement a password requirement conformity check. During a password reset process, a proposed password is received. A homomorphic encryption operation may be performed on the proposed password to generate a first character string. The first character string may be compared to a previous character string associated with a previous password to determine a password similarity metric. The password similarity metric may or may not satisfy at least a distance threshold. Responsive to determining that the password similarity metric does not satisfy the distance threshold, there may be a rejection of the proposed password and a prompt to receive an alternative proposed password during the password reset process.

Password similarity checking using homomorphic encryption operations

Various embodiments include systems and methods of anomalous data transfer detection. Hotspots for an asset of an organization may be determined, corresponding to period(s) of time in which outbound data from the asset satisfies a hotspot threshold determined to be indicative of high outbound data traffic activity. Based on the outbound data, a first set of days are identified as 'quiet' day(s); a second set of days are identified as “active” day(s); and “quiet” hour(s) of the day, associated with “active” day(s), are identified. The “quiet” day(s) and the “quiet” hour(s) are identified as a warmspot dataset, which may be utilized to detect anomalous data transfer activity associated with the asset. Detecting the anomalous data transfer activity includes computing one or more statistics on the warmspot dataset. Responsive to detecting the anomalous data transfer activity, an alert associated with the asset may be generated.

Anomalous data transfer detection

Identifying high-influence features for model-detected anomalies

Automated dimensionality reduction for machine learning anomaly detection pipeline

Various embodiments include systems and methods of anomalous data transfer detection, including determining hotspots for an asset of an organization. The hotspots correspond to one or more periods of time in which outbound data from the asset satisfies a hotspot threshold determined to be indicative of high outbound data traffic activity. A subset of data that does not correspond to the hotspots is filtered out from the outbound data. The remaining data corresponds to a hotspot dataset associated with the hotspots. The hotspot dataset may be utilized to detect anomalous data transfer activity associated with the asset. Detecting the anomalous data transfer activity includes computing one or more statistics on the hotspot dataset. Responsive to detecting the anomalous data transfer activity, an alert associated with the asset may be generated.

Disclosed herein are methods, systems, and processes for detecting data exfiltration. A data exfiltration event in a network is detected. Traffic data regarding outgoing traffic of a source in the network associated with the data exfiltration event is received. A logarithmic transformation is applied to the traffic data to generate transformed data. An outlier identification technique is selected based on the transformed data and is executed on the transformed data to determine that the outgoing traffic is indicative of the data exfiltration event. An alert is generated in response to the determination that the outgoing traffic is indicative of the data exfiltration event.

System and method for monitoring network activity for detecting data exfiltration events

Machine learning system for detecting anomalies in hunt data

Generating synthetic datapoints from observed datapoints for training machine learning models

A system for event prediction is configured to ingest at least partially incomplete unstructured data from at least one data source, convert at least a subset of the ingested data into a prediction model in accordance with a received model definition, receive a prediction query, and in response, supply an event prediction based on the prediction model. In some embodiments, ingesting the data involves transforming the unstructured data into a universal structured format in which the data is represented as key-value pairs each comprising a key tuple and an associated value, the key tuple specifying an operation and at least one identifier; the prediction query includes a key tuple specifying an operation and at least one identifier; and the event prediction generated with the prediction model includes a value associated with the key tuple that is missing from the transformed data.

Systems and methods are disclosed to implement a cyberattack detection system that monitors a computer network for lateral movement. In embodiments, the system uses network data from a computer network to build a baseline of connection behaviors for the network. Connection graphs are generated from new network data that indicate groups of nodes that made connections with one another during a last time interval. The graphs are analyzed for connection behavior anomalies and ranked to determine a subset of graphs with suspected lateral movement. Graphs with suspected lateral movement may be further analyzed to determine a set of possible attack paths in the lateral movements. The suspected attack paths are reported to network administrators via a notification interface. Advantageously, the disclosed system is able to detect potential lateral movements in localized portions of a network by monitoring for connection behavior anomalies in network data gathered from the network.

Growing community of inventors

Cambridge, MA, United States of America

Vasudha Shivamoggi