Microsoft Technology Licensing, LLC

Yogesh Kant Roy

Daniel L Mace

Deepak Vijaywargi

Antoine El Daher

Seetharaman Harikrishnan

Ram Shankar Siva Kumar

Haijun Zhai

Anisha Mazumder

Taroon Mandhana

Craig Henry Wittenberg

Benjamin E Nick

Jugal Parikh

Wing Kwong Wan

Richard P Lewis

William Blum

Edir Vinicio Garcia Lazo

Amir Rubin

Manas George

Jeremias Eichelbaum

Nihal Irmak Pakis

Peter A Bryan

Arvindnarayanan Ravi

Jordan Wesley Rogers

A computer-implemented method of generating a security language query from a user input query includes receiving, at a computer system, an input security hunting user query indicating a user intention; selecting, using a trained machine learning model and based on the input security hunting query, an example user security hunting query and corresponding example security language query; generating, using the trained machine learning model, query metadata from the input security hunting query; generating a prompt, the prompt comprising: the input security hunting user query; the selected example user security hunting query and the corresponding example security language query; and the generated query metadata; inputting the prompt to a large language model; receiving a security language query from the large language model corresponding to the input security hunting query reflective of the user intention.

Generating security language queries

Techniques are described herein that are capable of performing automatic graph-based detection of potential security threats. A Bayesian network is initialized using an association graph to establish connections among network nodes in the Bayesian network. The network nodes are grouped among clusters that correspond to respective intents. Patterns in the Bayesian network are identified. At least one redundant connection, which is redundant with regard to one or more other connections, is removed from the patterns. Scores are assigned to the respective patterns in the Bayesian network, based on knowledge of historical patterns and historical security threats, such that each score indicates a likelihood of the respective pattern to indicate a security threat. An output graph is automatically generated. The output graph includes each pattern that has a score that is greater than or equal to a score threshold. Each pattern in the output graph represents a potential security threat.

Automatic graph-based detection of potential security threats

Provided herein are methods, systems, and computer program products for intelligent detection of multistage attacks which may arise in computer environments. Embodiments herein leverage adaptive graph-based machine-learning solutions that can incorporate rules as well as supervised learning for detecting multistage attacks. Multistage attacks and attack chains may be detected or identified by collecting data representing events, detections, and behaviors, determining relationships among various data, and analyzing the data and associated relationships. A graph of events, detections, and behaviors which are connected by edges representing relationships between nodes of the graph may be constructed and then subgraphs of the possibly enormous initial graph may be identified which represent likely attacks.

Intelligent system for detecting multistage attacks

The described technologies leverage a trained evaluation function to analyze an email message to determine if a password is included in the text of the email message. The text of the email message may be vectorized using a character lookup table including vector values for each ASCII character. The trained evaluation function analyzes the vectorized text to determine if a password is included in the text of the mail message. An email message found to include a password may be placed in a quarantine storage to at least temporality prevent the email message from being disseminated to a recipient.

Sensitive data detection in communication data

Search results are provided with personalized deeplinks for an end user. User behavior information is gathered regarding web pages visited by the end user. When the end user submits a search query, the website category of a search result is identified and user behavior information regarding web pages visited at other websites within the website category is identified. At least one deeplink is selected for the search result based on that user behavior information. In some instances, user behavior information may be tracked for a group of end users. The user behavior information for the group of end users may be used in conjunction with the user behavior information for the end user to facilitate deeplink selections for search results returned in response to search queries from the end user.

Personalized deeplinks for search results

Parameterized actions are provided with search results to allow users to enter parameter values and perform the actions directly from the search results. By analyzing websites in a category, a parameterized action available at the websites and common parameters may be identified. When an end user performs a search that returns a web page result from a website having the parameterized action, an indication of the parameterized and common parameters may be provided as part of the search result. Additionally, user interface elements may allow the end user to enter parameter values to perform the parameterized action directly from the search result. In some instances, user context may be employed to pre-populate parameter values in the search result.

Context-aware parameterized action links for search results

Growing community of inventors

Bellevue, WA, United States of America

Yogesh Kant Roy