Ben-gurion University of the Negev Research and Development Authority

Deutschetelekom Ag

Other

B.G. Negev Technologies and Applications Ltd.

Nec Corporation

Verint Systems, Inc.

Medigus Ltd.

Morphisec Information Security 2014 Ltd.

Yeda Research and Develpment & Co. Ltd

Tel Aviv University

Nanyang Technological University

Nec Corporation of America

Metacure Limited

Yuval Elovici

Asaf Shabtai

Rami Puzis

Mordechai Guri

Dudu Mimran

Yisroel Avraham Mirsky

Elazar Sonnenschein

Amir Govrin

Minelu Sonnenschein

Masaki Inokuchi

Yoshinobu Ohta

Lior Rokach

Barak Chizi

Ron Bitton

Yuval Shahar

Ben Nassi

Erez Shmueli

Robert Moskovitch

Dima Stopel

Yoav Avidor

Zahy Bnaya

Ehud Gudes

Christoph Peylo

David Mimran

Orly Stan

Gabi Kedma

Roni Stern

Boris Rozenberg

Tal Beja

Liron Samama

Ariel Felner

Zvi Boger

Gil Tahan

Tamir S Levi

Benny Rousso

Adi Shamir

Yoshiyuki Yamada

Offer Glasberg

Tami Harel

Tobias Martin

Bracha Shapira

Paul Richard Spehr

Asaf Nadler

Shlomo Dolev

Anupam Chattopadhyay

Alexandra Mikityuk

Polina Zilberman

Siew Kei Lam

Lena Milman

Eitan Menahem

Gil Tachan

Assaf Shabtai

Naor Kalbo

Dvir Cohen

Manuel Kamp

Tomer Gluck

Oleg Brodt

Dudi Nassi

Raz Ben Nethanel

Alona Levy

David Toubiana

Elad Marco

Thambipillai Srikanthan

Tobias Glemser

Jawad Haj-Yahya

Moshe Bixenshpaner

Tomer Zrihen

Ronen Vaisenberg

Mordehai Guri

Michael Fire

Gilad Katz

Bark Chizi

Alexander Binun

Moshe Bixenspaner

Aviad Elitzur

Barak Zacharish

Pavel Ackerman

Alex Binon

Lena Chekina

Ronen Waisenberg

Masayuki Nakae

Ariel Bar

Ofir Tam

Heiko Lehman

Ming Yin

Shay Alexander Geller

Guy Amit

Viktoria Anna Laufer

Yizhak Vaisman

Lior Sidi

Yechiav Yzhak

Ma'ayan Gafny

Amir Harel

Tomer Shimshon

Yuri Poliak

An optimized limited-area WiFi network includes a plurality of Internet connectable devices, a wireless router for facilitating Internet connectivity, and a dynamically positionable signal coverage enhancer configured with an onboard processor, a signal coverage enhancing element, and mobile means. The signal coverage enhancer is repositionable, by the mobile means in response to a command signal transmitted by the processor, to a determined location of the limited-area WiFi network that is sufficiently close to one or more of the devices, such that an amplified signal produced by the signal coverage enhancing element which amplifies a wireless signal transmitted by the router maintains uninterrupted Internet operation of the to one or more devices.

Optimized WiFi network

An information collection system includes: a side-channel information processing unit that derives load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data; an allow list generation unit that generates an allow list including a scan timing and a scan range in which the availability is not affected, the allow list generation unit generating the allow list based on the load information; and an allow list storage unit that stores the allow list. An active scan of the target machine is executed by referencing the allow list stored in the allow list storage unit to collect asset information of the target machine.

Information collection system, information collection method, medium, and information collection program

A system and methods are provided for determining a vehicle action during a phantom projection attack, including processing a received image to identify a traffic object, and creating from the received image multiple processed images that are applied to respective neural network (NN) models. Latent representations of the multiple processed images from each of the NN models are then fed to a combiner model trained to determine whether the latent representations indicate a phantom projection attack, and, responsively to a determination of a phantom projection attack, issuing a phantom projection indicator.

Methods for detecting phantom projection attacks against computer vision algorithms

A framework for efficiently and automatically exploring a data network and accurately identifying network threats, which comprises a plurality of software and hardware-based agents, distributed over the data network. The agents are capable of adjusting or reconfiguring, on the fly, the behavior of the agents and their ability to collect data in a targeted manner, so as to investigate suspicious incidents and alerts and collect data that was not yet collected by the system; collecting forensic data by executing tasks defined in workflows, being distributed threat intercepting programs and reporting about the collected forensic data, back to a Central Control Unit (C&C). Distributed threat intercepting programs ('workflows') are used to provide instructions to agents, to perform branching and provide instructions to the Central Control Unit (C&C), which orchestrates the agents to assure proper execution of the workflows; analyzes the collected information and presents ongoing status to an operator supervising the data network.

Bio-inspired agile cyber-security assurance framework

A method and a system are provided for determining a likelihood of a metabolic pathway existing in an organism, including: calculating a feature vector for each metabolic pathway of metabolic pathways known to exist and not known to exist in the organism, wherein elements of the feature vectors are network properties of the metabolic pathways mapped to a metabolite concentration correlation network (CN); training a supervised machine learning model for classifying metabolic pathways as existing or not existing in the organism, according to the known and unknown feature vectors; determining, based on mapping to the CN, a feature vector of a proposed metabolic pathway, and feeding the feature vector of the proposed metabolic pathway to the trained SML model, to determine a likelihood of the proposed metabolic pathway existing in the organism.

Identification and prediction of metabolic pathways from correlation-based metabolite networks

A security assessment system is configured to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components. The security assessment system includes a duplicated environment design circuitry and a duplicated environment construction circuitry. The duplicated environment design circuitry is configured to select a duplication level based on constraints specified by a user in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design. The duplication level is indicative of any one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system. The duplicated environment construction circuitry is configured to construct the duplicated environment based on the designed result. The duplicated environment includes components which are duplicated by one of the duplication level.

Security assessment system

A security assessment system is configured to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components. The security assessment system includes a duplicated environment design circuitry and a duplicated environment construction circuitry. The duplicated environment design circuitry is configured to select a duplication level based on constraints specified by a user and effects associated with the physical components in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design. The duplication level is indicative of any one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system. The duplicated environment construction circuitry is configured to construct the duplicated environment based on the designed result. The duplicated environment includes components which are duplicated by one of the duplication level.

A system for analyzing and clustering darknet traffic streams with word embeddings, comprising a data processing module which collects packets that are sent to non-existing IP addresses that belong to darknet's taps (blackholes) that are deployed over the internet: a port embedding module for performing port sequence embeddings by using a word embedding algorithm on the port sequences extracted from the data processing module while transforming the port sequences into a meaningful numerical feature vectors: a clustering module for performing temporal clustering of the feature vectors over time; and an alert logic and visualization module visualizes the data and provides alerts regarding a cluster that an analyst classified as malicious in the past.

Method and system for clustering darknet traffic streams with word embeddings

Systems and methods are provided for detecting anomalous messages on a multipoint serial communications bus by extracting features from a first and a second message, including a time delay between the first and the second messages and, for each message, a sender address, a recipient address, a bus number, and a word count. A message transition pattern including the extracted features is generated. A probability of occurrence of the message transition pattern is determined by comparing the message transition pattern to a pattern dictionary, and the second message is determined to be anomalous when the probability is less than a predetermined threshold.

Echo detection of Man-in-the-Middle LAN attacks

A signature verification system, which comprises a plurality of worn devices of signing users, each provided with one or more motion sensors, and a processor for receiving motion signals from the sensors, the processor is adapted to define a set of features that describe a signature and distinguish one signature from another; perform a training phase by obtaining motion signals from one or more motion sensors of the worn devices; training a machine learning classifier using the instances and labels; obtain motion signals from motion sensors of the a worn device, the motion being of an allegedly genuine signature of one of the users; scale and domain transform the allegedly genuine signature; calculate values of the features describing the allegedly genuine signature with respect to scaled and transformed reference signatures of the one of the users; and apply the trained classifier on the feature values, thereby classifying the allegedly genuine signature as genuine or forged.

Method for online signature verification using wrist-worn devices

A method of monitoring network traffic in a communication network with a sentinel module to detect malicious activity is described. A gateway sentinel module receives network traffic directed through a gateway installed for a local distribution of the network, the gateway connecting the local distribution of the network to a core of the network. Malicious activity in the local distribution is detected based on a combination of: a local machine-learning model for identifying malicious activity in the local distribution, the local machine-learning model modelling network traffic from the local distribution; and a global machine-learning model. The global machine-learning model models network traffic from a plurality of local distributions of the network based training data from a plurality of local sentinel modules executed on a respective plurality of computing nodes. The computing nodes respectively receive network traffic from the plurality of location distributions. A corresponding device and system are also described.

Detection of malicious network activity

A system and method for identifying if a drone is illegitimately video streaming a location, object or person. An interceptor intercepts radio transmissions and identifies if a radio transmission is an FPV video transmission. A watermarker is used for emitting a periodic physical stimulus at a given frequency for a given duration. The system then verifies if there is a correlation between the video transmission and the periodic physical stimulus; and issues a privacy invasion attack notification if such a correlation is determined between the video transmission and the periodic physical stimulus.

Analyzing radio transmission for detecting whether a drone is filming a point of interest

The invention relates to a system for protecting IoT devices from malicious code, which comprises: (a) a memory extracting module at each of said IoT devices, for extracting a copy of at least a portion of the memory content from the IoT device, and sending the same to an in-cloud server; and (b) an in-cloud server for receiving said memory content, and performing an integrity check for a possible existance of malicious code within said memory content.

System and method for performing on-cloud memory analysis, forensic and security operations on connected devices

When using Web intelligence ('Webint') to collect information regarding a target social network user, one of the most valuable pieces of information is the target user's List-Of-Friends (LOF). In some cases, however, the LOF of the target user is not accessible in his profile. Herein are described methods and systems for identifying the LOF of a target user. An analysis system crawls the profiles of social network users, other than the target user, and reconstructs the LOF of the target user from the crawled profiles.

System and method for identifying contacts of a target user in a social network

The invention relates to a system for protecting a computerized device from a malicious activity resulting from a malicious code, which comprises: (a) a first DC supply monitoring unit which is located within a separate computerized environment, namely an environment which is totally separated and isolated both physically and in terms of connectivity from the hardware and software of the computerized environment of the device; (b) a memory database for storing one or more signatures of known malicious events, each of said signatures describes the temporal effect of a malicious event, respectively, on the power consumption from the DC supply of the device; and (c) a microprocessor within said DC supply monitoring unit for continuously monitoring the power consumption from said DC supply of the device, comparing temporal characteristics of the power consumption with said malicious events signatures in said database, and alerting upon detection of a match, wherein said DC supply monitoring unit is at most physically connected to the DC supply of the device.

System and method for detecting activities within a computerized device based on monitoring of its power consumption

Growing community of inventors

Moshav Arugot, Israel

Yuval Elovici