Microsoft Technology Licensing, LLC

Mantisvision Ltd.

Yotam Livny

Roy Levin

Moshe Israel

Andrey Karpovsky

Tamer Salman

Hani Hana Neuvirth

Michael Zeev Bargury

Ram Haim Pliskin

Ben Kliger

Naama Kraus

Mathias Abraham Marc Scherman

Gueorgui Chkodrov

Dotan Patrich

Dawn Antonette Burns

Fady Nasereldeen

Omer Karin

Tomer Rotstein

Yael Livne

Nir David

Elad Yom-Tov

Gilad Pundak

Amir Zyskind

Josef Weizman

Tomer Koren

Ron Matchoro

Julian Federico Gonzalez

Orr Srour

Mathias Scherman

Zhipeng Zhao

Oran Brill

Yaakov Garyani

Dani Daniel

William Kendall Hollis

Vadim Kosoy

Scott Elliott Gorlick

Yaniv Zohar

Yoel Yehezkel Einhoren

Sangeetha Madderla

Shira Itzhaki

Assaf Israel

Owen Joseph Davis

Haim Saadia Ben Danan

Larry J Matuska

Methods, systems and apparatuses are described herein to provide adaptive severity functions for alerts, particularly security alerts. The adaptive severity functions may be aligned with an existing global security situation to upgrade or downgrade the severity of new and existing alerts. By taking into consideration the time factor along with other parameters, the alerts may be prioritized or reprioritized appropriately. The modification of the severity level for the alerts may be made based on rules and/or one or more triggering events or by using severity functions with or without the aid of artificial intelligence based on best-practice preferences.

Adaptive severity functions for alerts

A method enabling recovery of a terminated client-to-cloud processing sessions includes writing at least some data of cloud-based processing session between a cloud based server and a client device to the client device. Responsive to satisfaction of a session termination condition, the stored data is encrypted such that it can be recovered using suitable decryption techniques when the client-to-cloud-connection is subsequently re-established.

Maintaining and recovering secure cloud connections

A computing system includes a touch-sensitive display and one or more processors. The touch-sensitive display is configured to detect a run-time touch input from a user. The one or more processors are configured to execute instructions using portions of associated memory to implement a touch driver of the touch-sensitive display and an artificial intelligence model. The touch driver is configured to process the run-time touch input based on a plurality of calibration parameters and output a touch event and a plurality of run-time touch input parameters associated with the touch input event. The artificial intelligence model is configured to receive, as input, the run-time touch input parameters. Responsive to receiving the run-time touch input parameters, the artificial intelligence model is configured to output a personalized user touch driver profile including a plurality of updated calibration parameters for the touch driver.

Artificial intelligence model for enhancing a touch driver operation

Unauthorized use of user credentials in a network is detected. Data indicative of text strings being used to access resources in the network is accessed. Regex models are determined for the text strings. Troupings of the regex models are determined based on an optimization of a cumulative weighted function. A regex model having a cumulative weighted function that exceeds a predetermined threshold is identified. An alert is generated when the cumulative weighted function for the identified regex model exceeds the predetermined threshold.

Detection of abnormal entities based on syntactic grouping of strings preliminary class

The method disclosed herein includes determining a user interaction pattern with respect to a digital marker, the user interaction pattern based at least in part on user interaction with a capacitive sensor of a computing device, determining a geometric characteristic of the digital marker, and generating a predicted digital marking position of the digital marker on a digital medium of the computing device based at least in part on the determined geometric characteristic of the digital marker and the determined user interaction pattern.

Digital marking prediction by posture

An indication of a security alert and a context for the security alert is received. The context includes one or more entities related to the context and a timestamp for the security alert. Data sources for the one or more entities are searched during a time window around the timestamp. One or more anomaly detection models are executed to identify anomalies that are related to the security alert based on the context. Identified anomalies for investigation of the security alert are output.

Detection of anomalous count of new entities

Disclosed herein is a system for predicting, given a pattern of triggered alerts, a next alert in order to identify malicious activity that is about to occur on resource(s) being monitored by a security operations center. A resource can include a server, a storage device, a user device (e.g., a personal computer, a tablet computer, a smartphone, etc.), a virtual machine, networking equipment, etc. Accordingly, the next alert is speculatively triggered in advance and a security analyst can be notified of a pattern of activity that is likely to be malicious. The security analyst can then investigate the pattern of triggered alerts and the speculatively triggered alert to determine whether steps to mitigate the malicious activity before it occurs should be taken.

Predicting a next alert in a pattern of alerts to identify a security incident

Methods, systems, and apparatuses are provided for inferring security incidents from observational data. For example, alerts generated with respect to a set of entities by a first alert generator are received, association scores are calculated for pairs of alerts, the alerts are formed into clusters based on the association scores, and a security incident model is formed based on the clusters. The security incident model may define sequences of alerts corresponding to security incidents. Furthermore, the security incident model may be used to determine a match between additional alerts and a sequence of alerts in the security incident model and identify the additional alerts as a security incident corresponding to the sequence of alerts in the security incident model.

Inferring security incidents from observational data

Unauthorized use of user credentials in a network is detected. Data indicative of text strings being used to access resources in the network is accessed. Regex models are determined for the text strings. Groupings of the regex models are determined based on an optimization of a cumulative weighted function. A regex model having a cumulative weighted function that exceeds a predetermined threshold is identified. An alert is generated when the cumulative weighted function for the identified regex model exceeds the predetermined threshold.

Detection of abnormal entities based on syntactic grouping of strings

A security service utilizes a machine learning model to detect unused open ports. A security agent on client machines tracks the operating executables and the open ports on a machine. A machine learning model is trained for a specific port number using the more commonly-used executables that run on machines having the port opened from a large and diverse population of machines. The model is then used to determine the ports that an executable is likely to be associated with which is then used to determine if a particular machine has an unused open port.

Machine learning detection of unused open ports

Embodiments are provided for integrating feedback into alert managing processes having defined alert policies. These policies define conditions that, when satisfied by certain detected activities, triggers an alert to be sent to a client. A determination is made that a current detected activity does satisfy the condition(s). Subsequent to determining that the set of conditions is satisfied and prior to actually generating the alert, the current detected activity is determined to share a relationship with previously received feedback that caused the alert policy to be modified. After being modified, the alert policy specified whether the alert is to be sent to the client, modified and then sent, suspended, or disabled. The alert is then either generated or refrained from being generated based on the alert policy.

Common framework for translating customer feedback to standard and shareable policy changes of cloud threat detection service

Performing anomaly lookup on data sources that include an entity related to an alert. One or more entities related to an alert and a date when the alert occurred are received. The alert may indicate that an anomaly in data collected from a various data sources may be present in at least one of the data sources. The various data sources are searched for the one or more entities around the alert date to determine which of the data sources include the one or more entities. For those data sources including the one or more entities, an anomaly lookup procedure is performed on the data sources during a first time window to determine an initial set of suspicious anomalies.

Anomaly lookup for cyber security hunting

Using a set of anomalies indicative of a malicious pattern of behavior collected from data to determine new alerts for anomalies included in subsequently collected data. A set of anomalies found in data collected from data sources is accessed. The set of anomalies is determined by a prior analysis to be indicative of a malicious pattern of behavior by entities associated with the set of anomalies. Data that is subsequently collected from the data sources is searched to determine if any of the data includes the set of anomalies. Alerts are generated for any of the subsequently collected data that includes the set of anomalies.

Automatic generation of detection alerts

Growing community of inventors

Gadera, Israel

Yotam Livny