Cisco Technology, Inc.

Netskope, Inc.

Xinjun Zhang

Qihong Shao

David John Zacks

Yue Liu

Yi Zhang

Ari Azarafrooz

Zhenxin Zhan

Ghanashyam Satpathy

Dong Guo

Gurvinder Singh

Rongrong Tao

Kevin Broich

Kenneth Charles Croley

Jun Ou

Hongbo Yang

Hung-Ming Chen

A cloud-based network security system (NSS) is described. The NSS uses a sandbox to safely detonate and extract information about a document and uses machine learning algorithms to analyze the information to predict whether the document contains malicious software. Specifically, during the detonation, static and dynamic information about the document is captured in the sandbox as well as character strings from images in the document. The dynamic information (and sometimes the static information) is input to an AI or machine learning model trained to provide an output indicating a prediction of whether the document contains malware. The character strings are compared with a batch of phishing keywords to generate a heuristic score. A validation engine combines the output from the AI or machine learning model and the heuristic score to classify the document as malicious or clean. Security policies can then be applied based on the classification.

Machine learning powered cloud sandbox for malware detection

Disclosed is technology for choosing between alternative category labels tentatively assigned to tens of thousands of webpages by a classifier ensemble running on processors, applying the classifier ensemble with a sensitive category classifier, a non-sensitive category classifier, a title and metadata classifier and a heuristic classifier to tens of thousands of webpages. Also disclosed is applying a post processor to outputs of the classifier ensemble and tentatively assigning at least two category labels for non-sensitive categories for webpages; two category labels, automatically determining that at least one but not all of the tentatively assigned category labels is a general label and de-assigning the general label; saving the category label that is not de-selected to the webpage; and distributing the assigned category labels for at least some of the tens of thousands of webpages for use in controlling access to webpages by users on user systems protected using the assigned labels.

Machine learning-based URL categorization system with selection between more and less specific category labels

A method, computer system, and computer program product are provided for mitigating network risk. A plurality of risk reports corresponding to a plurality of network devices in a network are processed to determine a multidimensional risk score for the network. The plurality of risk reports are analyzed using a semantic analysis model to identify one or more factors that contribute to the multidimensional risk score. One or more actions are determined using a trained learning model to mitigate one or more dimensions of the multidimensional risk score. The outcomes of applying the one or more actions are presented to a user to indicate an effect of each of the one or more actions on the multidimensional risk score for the network.

Interpreting and remediating network risk using machine learning

A method, computer system, and computer program product are provided for network risk analysis. A plurality of risk reports relating to a network device in a network are obtained, wherein each risk report is associated with a particular dimension of a plurality of dimensions of risk for the network device in the network. A count of the plurality of risk reports is determined for each dimension of the plurality of dimensions of risk. A regression model is applied to determine a risk value for the network device in the network based on the count of the plurality of risk reports for each dimension and based a role of the network device in the network.

Tailored network risk analysis using deep learning modeling

A method, computer system, and computer program product are provided for peer risk benchmarking. Customer data for a first network is obtained, wherein the customer data comprises a role of one or more network devices in the first network and a plurality of risk reports corresponding to the one or more network devices, and wherein each risk report is associated with a particular dimension of a plurality of dimensions of risk for the one or more network devices. A network profile image is generated by processing the plurality of risk reports. A generative adversarial network generates a synthetic network profile image from the network profile image, wherein the synthetic network profile image does not include the customer data. A second network is evaluated using the synthetic network profile image to identify differences between the first network and the second network.

Peer risk benchmarking using generative adversarial networks

Growing community of inventors

San Jose, CA, United States of America

Xinjun Zhang