WO2023067425A1 - User entity normalization and association - Google Patents

User entity normalization and association Download PDF

Info

Publication number
WO2023067425A1
WO2023067425A1 PCT/IB2022/059544 IB2022059544W WO2023067425A1 WO 2023067425 A1 WO2023067425 A1 WO 2023067425A1 IB 2022059544 W IB2022059544 W IB 2022059544W WO 2023067425 A1 WO2023067425 A1 WO 2023067425A1
Authority
WO
WIPO (PCT)
Prior art keywords
event
user
events
given
entity
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/IB2022/059544
Other languages
English (en)
French (fr)
Inventor
Netanel Rimer
Aviad Meyer
Yaron NEUMAN
Jonathan Allon
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Palo Alto Networks Israel Analytics Ltd
Original Assignee
Palo Alto Networks Israel Analytics Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Palo Alto Networks Israel Analytics Ltd filed Critical Palo Alto Networks Israel Analytics Ltd
Priority to IL309373A priority Critical patent/IL309373A/en
Priority to AU2022370400A priority patent/AU2022370400B2/en
Priority to EP22797849.1A priority patent/EP4420020B1/en
Priority to JP2024505476A priority patent/JP2024540794A/ja
Publication of WO2023067425A1 publication Critical patent/WO2023067425A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the present invention relates generally to computer security and networks, and particularly to associating user identifiers in event logs with a user entity and generating a user entity profile based on events in the logs.
  • a method for protecting a computer system including identifying, by a processor, multiple user identifiers associated with a single user entity, detecting a first event carried out using a first one of the user identifiers, detecting a second event carried out using a second one of the user identifiers that is different from the first one of the user identifiers, and in response to a combination of the first and the second events, issuing an alert.
  • identifying the multiple user identifiers associated with the single user entity includes collecting a set of events including the first and the second events, extracting respective user identifiers from the events in the set, mapping the extracted user identifiers to respective accounts, and associating the accounts with respective user entities, wherein the single user entity includes one of the multiple user entities.
  • mapping a given extracted user identifier to a given account includes normalizing the given user entity to a specific format, wherein the given account includes the normalized user entity.
  • the single user entity is associated with one or more accounts.
  • multiple user identifiers map to a given account for the single user entity.
  • detecting the first event includes detecting the first event on a first networked entity, and wherein detecting the second event includes detecting the second event on a second networked entity different from the first networked entity.
  • detecting the first even includes detecting multiple first events during a first time period, and the method further includes generating a profile in response to the multiple first events, wherein detecting a second event includes detecting one or more second events in a second time period subsequent to the first time period, and wherein the combination of the first and the second events includes detecting that the one or more second events are not in accordance with the profile.
  • the first event includes a time-based status of the single user entity, and wherein the second event is not in accordance with the time-based status.
  • an apparatus for protecting a computer network including a network interface card (NIC), and at least one processor configured to identify multiple user identifiers associated with a single user entity, to detect a first event carried out using a first one of the user identifiers, to detect a second event carried out using a second one of the user identifiers that is different from the first one of the user identifiers, and in response to a combination of the first and the second events, to issue an alert.
  • NIC network interface card
  • a computer software product for protecting a computing system, the product including a non- transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer to identify multiple user identifiers associated with a single user entity, to detect a first event carried out using a first one of the user identifiers, to detect a second event carried out using a second one of the user identifiers that is different from the first one of the user identifiers, and in response to a combination of the first and the second events, to issue an alert.
  • program instructions when read by a computer, cause the computer to identify multiple user identifiers associated with a single user entity, to detect a first event carried out using a first one of the user identifiers, to detect a second event carried out using a second one of the user identifiers that is different from the first one of the user identifiers, and in response to a combination of the first and the second events, to issue an alert.
  • FIG. 1 is a block diagram that schematically shows a computing facility comprising a security server that is configured to generate activity profiles for user entities based on events retrieved from network event logs, in accordance with an embodiment of the present invention
  • Figure 2 is a block diagram showing an example of a given event log, in accordance with an embodiment of the present invention.
  • FIG. 3 is a block diagram showing an example of an aggregated event log stored on the security server, in accordance with an embodiment of the present invention.
  • Figure 4 is a block diagram showing an example of a database record that can be stored by a domain database server, in accordance with an embodiment of the present invention
  • FIG. 5 is a block diagram showing an example of user entity information stored on the security server, in accordance with an embodiment of the present invention.
  • Figure 6 is a flow diagram that schematically illustrates a method of generating the activity profiles, in accordance with an embodiment of the present invention.
  • Figure 7 is a flow diagram that schematically illustrates a method of using the generated activity profiles to detect suspicious activity, in accordance with an embodiment of the present invention.
  • Networked entities that communicate over computer network typically store logs that record events on the networked entities. While these logs can include identifiers for the events, user entities (e.g., employees of an organization) may use multiple accounts (e.g., email accounts) when accessing data on the network, and each account may use multiple identifiers when accessing data on the network. Therefore, it can be difficult to detect suspicious/malicious activity performed by a given user entity using different accounts and different user identifiers on the network.
  • user entities e.g., employees of an organization
  • accounts e.g., email accounts
  • Embodiments of the present invention provide methods and systems for protecting a computer system by identifying multiple user identifiers associated with a single user entity. Upon detecting a first event carried out using a first one of the user identifiers and detecting a second event carried out using a second one of the user identifiers that is different from the first one of the user identifiers, an alert can be issued in response to a combination of the first and the second events.
  • the first event is collected from a first log on a first networked entity and the second event is collected from a second log on a second networked entity different than the first networked entity.
  • multiple events can be collected from multiple event logs on networked entities coupled to a computer network.
  • Identifiers can be extracted from the events, the identifiers can be normalized so as to map the events to accounts, and a subset of the accounts can be associated with the single user entity.
  • a user entity profile can then be generated based on the events associated with the single user entity.
  • systems implementing embodiments of the present invention can detect and flag suspicious activity if any subsequent events associated with the single user entity are determined not to be in accordance with the user entity profile.
  • FIG. 1 is a block diagram that schematically shows an example of a computing facility 20 comprising a security server 22 that is configured to generate user entity activity profiles 24 based on activity recorded by a plurality of networked entities in respective event logs 26, in accordance with an embodiment of the present invention.
  • security server 22 is configured to communicate with a plurality of computing devices 28 (also known as hosts or host computers), an account database server 29 and a human resources (HR) server 30 over a data network such as a local area network (LAN) 32.
  • a plurality of computing devices 28 also known as hosts or host computers
  • HR human resources
  • Account database server 29 may comprises a domain database management system (DBMS) application 31 and a domain database 37.
  • Account database 33 comprises a set of account database records 35 that are described in the description referencing Figure 4 hereinbelow.
  • Computing facility 20 may also comprise an Internet gateway 34, which couples computing facility 20 to a public network 36 such as the Internet.
  • a firewall 38 that is coupled to LAN 32 and controls, based on predetermined security rules, data traffic between computing devices 28 and a data cloud 40 comprising one or more cloud servers 42.
  • security server 22 can be configured to generate user entity profiles 24 based on activity recorded by a plurality of networked entities in respective event logs 26. While the configuration in Figure 1 shows the networked entities comprise computing devices 28, firewall 38 and cloud servers 42, any other type of networked entities that communicate over a network are considered to be within the spirit and scope of the present invention. [0029] In the configuration shown in Figure 1, event logs 26 can be differentiated by appending a letter to the identifying numeral, so that the web pages:
  • Operating system (OS) logs 26A store information on events generated by operating systems (such as WindowsTM produced by Microsoft Corporation, and LinuxTM) and applications executing on computing devices 28.
  • operating systems such as WindowsTM produced by Microsoft Corporation, and LinuxTM
  • Endpoint detection and response (EDR) logs 26B store information on events detected by endpoint agents 44 (e.g., XDRTM produced by Palo Alto Networks, Inc., of 3000 Tannery Way, Santa Clara, CA 95054 USA) executing on computing devices 28.
  • endpoint agents 44 e.g., XDRTM produced by Palo Alto Networks, Inc., of 3000 Tannery Way, Santa Clara, CA 95054 USA
  • Firewall log 26C stores information on transmissions between computing facility 20 (e.g., computing devices 28) and servers (e.g., cloud servers 42) coupled to Internet 36.
  • computing facility 20 e.g., computing devices 28
  • servers e.g., cloud servers 42
  • firewall 38 is the PA-3250 Next Generation FirewallTM produced by Palo Alto Networks, Inc.
  • Cloud event logs 26D store information on events generated by cloud servers 42. Examples of logs 26 include, but are not limited to application logs, resource logs, and service logs for Amazon Web Services (provided by Amazon.com, Inc., 410 Terry Avenue North Seattle, WA 98109 USA).
  • security server 22 can be configured to extract user identifiers (IDs) from logs 26, normalize the user IDs and associate the normalized user IDs with user entities (i.e., individual people such as employees).
  • HR server 30 stores an HR database 46 that stores information for each user entity.
  • HR database 46 comprises a set of records 47 that have a one-to-one correspondence with user entities (i.e., employees) of an organization.
  • Security server 22 comprises a processor 48, a memory 50 and a network interface card (NIC) 51 that couples the security server to LAN 32.
  • processor 48 can combine logs 26 into an aggregated event log 52. Event logs 26 and 52 are described respectively in the descriptions referencing Figure 2 and 3 hereinbelow.
  • processor 48 collects events from event logs 24A- 24D, and stores to aggregated event log 52, aggregating events from other types of event logs 26 into the aggregated event log is considered to be within the spirit and scope of the present invention.
  • Examples of information that can be stored by one or more additional event logs 26 include, but are not limited to: • Input/Output (I/O) events (also known as file events).
  • I/O events also known as file events.
  • An example of an I/O event is domain account “Company ⁇ jdoe” writing a file named ‘jocal ⁇ file ⁇ malicious.exe” . Domain accounts are described hereinbelow.
  • Registry events An example of a registry event is domain account “Company ⁇ jdoe” modifying a registry key related to autorun, with the value ‘jocal ⁇ file ⁇ malicious. exe”.
  • Process execution events An example of a process execution event is SYSTEM automatically executing "docaljile ⁇ malicious.exe” with permissions of domain account “companAjdoe ” .
  • Network events An example of a network event is domain account "'compamSjdoe”. using a process named local_file ⁇ malicious.exe, performed an HTTP request to ”www. malwar e _command_and_control .com” .
  • SSO Single sign-on
  • SSO services e.g., OktaTM, PingOneTM,AzureADTM' l _ typically provide audit logs, which.
  • processor 48 can collect is SSO account “ john.doe@company.com” logging in.
  • Email logs that store email events can be collected from local systems such as OutlookTM, server (i.e., corporate) systems such as Exchanger ServerTM and cloud-based email servers such as Exchange OnlineTM.
  • An example of an email event in a local system is an email sent/received by "'john.doe@ mail.com”.
  • An example of an email event in a server system is an email sent/received by "'johndoe® company .com”.
  • An example of an email event in a cloud-based system is an email sent/received by "john_doe @ cloud_email _provider. com ” .
  • memory 50 also stores a plurality of user entity records 54 that store profiles 24.
  • each given user entity record 54 can retrieve information for a given user entity from HR database 46 and store the retrieved information to the given user entity record.
  • tasks described herein such as extracting user-IDs from event logs 26, normalizing the user IDs, associate the normalized user IDs with user entities, aggregating logs 26 into aggregated event log 52, and generating user entity profiles 24 may be split among multiple computers systems 22, 28 and 30 within computing facility 20 or external to the computing facility (e.g., cloud servers 42).
  • the functionality of some or all of computing devices 28, security server 22, account database server 29 and HR server 30 may be deployed in computing facility 20 and/or Internet 36 as physical computing devices, virtual machines or containers.
  • client computers 28 have respective host names 56 that can be used to identify each of the client computers.
  • Processor 48 comprises a general-purpose central processing units (CPU) or specialpurpose embedded processors, which are programmed in software or firmware to carry out the functions described herein.
  • This software may be downloaded to security server 22 in electronic form, over a network, for example. Additionally or alternatively, the software may be stored on tangible, non-transitory computer-readable media, such as optical, magnetic, or electronic memory media. Further additionally or alternatively, at least some of the functions of processor 48 may be carried out by hard-wired or programmable digital logic circuits.
  • Examples of memory 50 include dynamic random-access memories, non-volatile randomaccess memories, hard disk drives and solid-state disk drives.
  • FIG. 2 is a block diagram shown an example of data components stored in event logs 26, in accordance with an embodiment of the present invention. While event logs 26A-26D may store information in different respective layouts (i.e., formats and schemas), for purposes of simplicity the event logs herein comprise a single layout.
  • layouts i.e., formats and schemas
  • each event log 26 comprise a set of event log entries 60, each of the event log entries comprising a date 62, a time 64 and an event message 66 that stores a description of an event.
  • date 62 comprises the date of the given event
  • time 64 comprises the time of the given event
  • event message 66 describes an event and lists user identifiers of participants. User identifiers are described in the description referencing Figure 3 hereinbelow.
  • Each event message 66 (i.e., referencing a given event) can have one or more user identifiers 68 (i.e., participants in the corresponding event).
  • user identifiers 68 i.e., participants in the corresponding event.
  • the given event message 66 comprises a single identifier (ID) 68.
  • ID identifier
  • the given event message may comprise two identifiers 68.
  • processor 48 can map each identifier 68 to a respective account 69, and then associate each account 69 with a respective user entity 67.
  • Accounts 69 are described in the description referencing Figure 5 hereinbelow.
  • processor 48 can retrieve event log entries 60 from all the event logs (e.g., event logs 26A-26D), and store event information in the retrieved event log entries to aggregated event log 52. As described hereinbelow, processor 48 can use the information stored in aggregated event log 52 to map events to user entities.
  • FIG. 3 is a block diagram shown an example of data components stored in aggregated event log 52, in accordance with an embodiment of the present invention.
  • Aggregated event log 52 comprises a set of aggregated log entries 70.
  • processor 48 can create a new aggregated log entry 70 for each event log entry 60 in each event log 26.
  • each aggregated log entry 70 has a corresponding event log entry 60.
  • Each aggregated event log entry 70 comprises an event ID 72, a source 74, a date 76, a time 78, an event message 80 and an identifier information record 82.
  • processor 48 can:
  • IP Internet Protocol
  • MAC media access control
  • processor 48 can extract one or more user IDs 69 from event message 80s, normalize the user IDs and associate the normalized user IDs with user entities.
  • each user ID 69 extracted from a given event message 80 has a corresponding identifier record 82 that stores information such as an extracted user identifier 84, an identifier type 86, a mapped account m and an associated user entity 90.
  • processor 48 can identify a number (i.e., one or more) identifiers 68 in event message 80, add the identified number of identifier information records 82 to the new aggregated log entry so that each identifier 68 has a corresponding identifier information record 82, and populate each given identifier information record as follows:
  • a given user entity 67 named “John Doe” works for a company “Company”, has multiple mapped accounts 88, each referenced by one or more identifiers 84.
  • identifier types 86 include, but are not limited to:
  • Domain names such as “Company/jdoe” . Domain names can typically be found in event messages 66 in event logs 26A, 26B and 26C.
  • Fully qualified domain names such as “Company.com/jdoe” .
  • FQDNs can typically be found in event messages 66 in event logs 26A, 26B and 26C.
  • a username i.e., without a domain
  • Usernames can typically be found in event messages 66 in event logs 26A, 26B and 26C.
  • SID Security Identifier
  • GUID Globally Unique Identifier
  • a Globally Unique Identifier (GUID) number such as “8c6bfd4a-4cb2-llea-b67e- 88e9fe502clj” .
  • GUID numbers can typically be found in event messages 66 in event logs 26B and 26D.
  • a local username such as “host !23 ⁇ jdoe” , where “host 123” comprises a given host name 56. Local usernames can typically be found in event messages 66 in event logs 26 A, 26B and 26C.
  • event logs 26 such as SSO logs (not shown), email logs (not shown), and event logs 26C and 26D.
  • a personal username such as “john.doe@ gmail.com” .
  • event logs 26 such as SSO logs (not shown), email logs (not shown), and event logs 26C and 26D.
  • FIG. 4 is a block diagram showing an example configuration of a given database record 35, in accordance with an embodiment of the present invention.
  • Each database record 35 can store information such as an event identifier 92 and a corresponding account identifier 94 that references a given account 69.
  • account database records 33 can store known relationships between identifiers 68 and accounts 67.
  • account database 33 may comprise Directory Sync ServiceTM (DSSTM), produced by Palo Alto Networks, Inc.
  • DSSTM Directory Sync ServiceTM
  • endpoint agents 44 may comprise XDRTM
  • the XDRTM endpoint agent may interact with DSSTM to retrieve mappings between identifiers 68 and accounts 67.
  • relationships between identifiers 68 and accounts 67 can be maintained by a directory services application (not shown) such as is Active DirectoryTM (produced by Microsoft Corporation, Redmond, Washington, USA) that performs operations such as authenticating and authorizing all users and computers in a WindowsTM domain type network, assigning and enforcing security policies for all computers, and installing or updating software.
  • a directory services application such as is Active DirectoryTM (produced by Microsoft Corporation, Redmond, Washington, USA) that performs operations such as authenticating and authorizing all users and computers in a WindowsTM domain type network, assigning and enforcing security policies for all computers, and installing or updating software.
  • account DBMS 31 can query Active DirectoryTM to retrieve mappings between identifiers 68 and accounts 67 that comprise domain accounts.
  • FIG. 5 is a block diagram showing an example of information stored in user entity records 54, in accordance with an embodiment of the present invention.
  • each user identity record 54 stores information such as a user entity ID 100, user entity profile 24, a set of status information records 104, a set of account information records 106 and a set of identifier- account mapping records 108.
  • User entity ID 100 comprise a unique identifier for a given user entity 67.
  • processor can create a set of user entity records 54 that have a one-to one correspondence with account database records 47, and store a unique identifier to each user entity id 100 in the set. Therefore, each given user entity (i.e., employee) 67 has a corresponding user entity record 54.
  • User entity IDs 100 may also be referred to herein as user entities 100.
  • User entity profile 24 comprises a user profile indicating expected activity of the corresponding user entity. As described in the description referencing Figure 7 herein below, processor 48 can use user profile 24 to detect any anomalies in actions performed by the corresponding user entity in computing facility 20.
  • Each status information records comprises a start date 110, and end date 112 and a status 114.
  • Each given status 114 spans a time period starting with start date 110 and ending with end date 112.
  • start date 110 and end date 112 may also include time (e.g., 13:30 on 12/11/22).
  • statuses 114 include, but are not limited to:
  • Processor 48 can flag activity (e.g., emails, file access) by the corresponding user entity as suspicious if the user entity is no longer employed by the organization.
  • activity e.g., emails, file access
  • Processor 48 can flag activity (e.g., emails, file access) by the corresponding user entity as suspicious if the user entity is on vacation.
  • activity e.g., emails, file access
  • processor 48 can use this information to detect activity by a given user entity working from an anomalous location.
  • User entities 100 may use different computing devices 28 (e.g., desktop/laptop computers and mobile devices).
  • Processor 48 can use this information to track which of the user entities are using which computing devices 28 at any given time (i.e., past or present)
  • each user entity 100 can be assigned to a specific department (e.g., finance, marketing), thereby indicating systems (e.g., payroll, ad tracking) that are typically accessed by employees in each department.
  • a specific department e.g., finance, marketing
  • systems e.g., payroll, ad tracking
  • An organization title of a given user entity 100 can indicate privileges and typical system behavior for the given user entity.
  • Each user entity ID 100 typically uses one or more email accounts.
  • each given user entity 100 comprises a corresponding user entity record 54 that stores a corresponding account information record 106 for each of the email accounts used by the given user entity.
  • Each account information record 106 can store information such as a unique account ID 116, an account name 118 (i.e., an email address such as "'john.doe@coinpany.com” and john.doe@gmail.com) and account type 120.
  • account ID 116 may also be referred to as account 116.
  • Examples of account types 120 include, but are not limited to:
  • a domain account comprises an account that can be used across Acvive Directory 1111 (produced by Microsoft Corporation) domain in an organization. Domain accounts are typically associated with the following identifier types 86: domain name s, FQDNs, usernames, SID numbers, GUID numbers and corporate identifiers.
  • Local accounts comprising accounts such as ”host!23/jdoe” (i.e., where “hostl23” comprises a given host name 56) that are bound to specific respective networked entities.
  • Local accounts are typically associated with the following identifier types 86: usernames, SID numbers, GUID numbers and local users.
  • Cloud accounts such as ”john.doe@ company. com” .
  • a cloud account can be used across cloud infrastructure, like Google Cloud Platform 1111 (provided by Alphabet Inc., Mountain View, California) or Azure 1111 (provided by Microsoft Corporation). Cloud accounts are typically associated with the following identifier types 86: GUID numbers, corporate identifiers and personal identifiers.
  • Personal accounts comprising accounts such as jjohn.doe® gmail.com” that can be used both inside and outside an organization. Personal accounts are typically associated with the personal identifiers.
  • processor 48 extracts identifiers 84 from event log entries 60 and normalizes the extracted identifiers so as to identify respective mapped accounts 88.
  • processor 48 can store, in identifier-account mapping records 108, current mappings between the extracted identifiers and the associated accounts (i.e., both for the given user entity).
  • Each identifier- account mapping record 108 in a given user entity record 54 i.e., for a corresponding user entity 100
  • identifier types 124 comprise domain names, FQDNs, usernames, SID numbers, GUID numbers, local usernames, corporate identifiers and personal identifiers.
  • Figure 6 is a flow diagram that schematically illustrates a method of associating activity in event logs 26 with user entities 100 and generating profiles 24 based on activity of the user entities in computing facility 20, in accordance with an embodiment of the present invention.
  • processor 48 initializes user entity records 54.
  • each user entity record 54 corresponds to a given HR database record 47 an a corresponding user entity 100.
  • processor 48 can initialize user entity profiles 24 as well.
  • step 132 processor 48 identifies event logs 26.
  • step 134 the processor selects an unmapped event log entry 60 in a given event log 26.
  • unmapped event log entries 60 comprise any of the event log entries no processed by steps 134-136 as described hereinbelow.
  • processor 48 retrieves the selected event log entry. Upon retrieving the selected log entry, processor 48 can add a new aggregated log entry 70 to aggregated event log 52, and populate, in the new aggregated log entry, event ID 72, source 74, date 76, time 78 and event message 80 using embodiments described hereinabove.
  • processor 48 identifies one or more identifiers 68 in event message 80 and stores the identified identifiers 68 to one or more extracted identifiers 84 (i.e., in one or more respective identifier information records 82).
  • processor 48 normalizes the one or more extracted identifiers 84 to one or more specified formats so as to map each of the extracted identifiers to a respective account 116.
  • each account type 120 may have a corresponding specified format.
  • a specified format for the account type “domain account” can be ""CompanyName[/]UserName” , where “ Company Name” and ""UserName” are self-descriptive.
  • an example of a domain account is ""Company/jdoe” .
  • a specified format for the account type “local account” can be "'CompulerlD/U serName”. where "'Computer ID” comprises an identifier for a given computing device 28 on network 32 and ""UserName” is self-descriptive. As described supra, an example of a local account is "'host 123/jdoe”.
  • a specified format for the account type “cloud account” can be ""UserName[@]CompanyDomain”, where ""UserName” is self-descriptive comprises an identifier for a given computing device 28 on network 32 and ""UserName” is self-descriptive and "'Company Domain ” comprises a corporate domain name.
  • an example of a cloud account is ""john.doe ⁇ company, com” .
  • a specified format for the account type “personal account” can be ""UserName[@]ProviderDomain”, where ""UserName” is self-descriptive comprises and ""ProviderDomain” comprises an email service provider domain name (e.g., GmailTM, provided by Alphabet Inc.). As described supra, an example of a personal account is ""john.doe ⁇ gmail.com” .
  • the format for a given event is based on the source (e.g., the event log that processor 48 retrieved the event log entry corresponding to the given event, the event type, the field in the log entry corresponding to the given event) or content of the log entry corresponding to the given event.
  • the source e.g., the event log that processor 48 retrieved the event log entry corresponding to the given event, the event type, the field in the log entry corresponding to the given event
  • processor 48 can normalize the given identifier to a cloud account (e.g., ""john.doe ⁇ company. coni ') or a personal account (e.g., ""john.doe ⁇ gmail.com”).
  • a cloud account e.g., ""john.doe ⁇ company. coni '
  • a personal account e.g., ""john.doe ⁇ gmail.com”.
  • processor 48 extracts a given identifier 84 from a given log entry 60 from a log of a email server, and the domain is some public service, we will know it is most likely referring to a private email account (e.g., the context was that the given log entry came from a given log 26 of an email serve, and the content of the given log entry comprised a public email domain like ""@gmail”).
  • SID formats can refer to local or domain accounts and are usually differentiated by content. In some embodiments, the prefix of the SID will uniquely identify the domain, or the local machine (e.g., a given computing device 28).
  • GUIDs can refer to different account types, and can recognized by context (e.g., the respective types of logs 26 from which processor 48 extracted the GUIDs) or by matching the GUIDs to "ground truths" that processor 48 can extract from account database 33 (e.g., DSSTM).
  • context e.g., the respective types of logs 26 from which processor 48 extracted the GUIDs
  • ground truths e.g., DSSTM
  • Processor 48 can map the following identifiers 84 to a given account 116 "Company/jdoe” whose account type 120 comprises a domain account: o “Company /jdoe” whose identifier type 86 comprises a domain name. o “Company.com/jdoe” whose identifier type 86 comprises a FQDN. o "jdoe” whose identifier type 86 comprises a username without any domain. o "S-l-5-21-1602811402-2595058921-120187713-502” whose identifier type 86 comprises a SID.
  • Processor 48 can map the following identifiers 84 to a given account 116 "host!23/jdoe” whose account type 120 comprises a local account: o "jdoe” whose identifier type 86 comprises a username without any domain. o "S-l-5-21-1602811402-2595058921-120187713-502” whose identifier type 86 comprises a SID. o "8c6bfd4a-4cb2-l 1 ea-b67e-88e9fe502clj” whose identifier type 86 comprises a GUID. o "host!23 ⁇ jdoe” whose identifier type 86 comprises a local username.
  • Processor 48 can map the following identifiers 84 to a given account 116 "john.doe ⁇ company. com” whose account type 120 comprises a cloud account: o ”8c6bfd4a-4cb2-l 1 ea-b67e-88e9fe502clj” whose identifier type 86 comprises a GUID. o "'john.doe@company.com” whose identifier type 86 comprises a corporate username. o "'john.doe@ gmail.com” whose identifier type 86 comprises a personal username.
  • Processor 48 can map the following identifier 84 to a given account 116 "'john.doe@ gmail.com” whose account type 120 comprises a personal account: o "'john.doe@ gmail.com” whose identifier type 86 comprises a personal username.
  • processor 46 can query database records 35 to the extracted identifiers to a respective account 116.
  • processor 48 Upon performing each mapping of a given extracted identifier 84, processor 48 stores, the mapped account (ID) 116 to mapped account 88 in the identifier information record 82 storing the given extracted identifier. If any given mapping detected is step 140 is not already stored to user entity records 54, processor 48 can add a new identifier- account mapping record in the user entity record storing the mapped account, and populate identifier 122, identifier type 124 and associated account ID 126 accordingly.
  • processor 48 can normalize a given extracted identifier 84 by string manipulation (i.e., processor 48 stores the extracted identifiers as text strings).
  • processor 48 can normalizing extracted identifiers 84 to enable correlations and queries.
  • processor 48 can use string manipulation to normalize both
  • processor 48 can normalize a given extracted identifier 84 by using domain knowledge.
  • special identifiers can indicate the type and scope of the account (e.g., at the host or main levels) mapped to the given identifier.
  • processor 48 can use domain knowledge to:
  • Map ”AzureAD ⁇ jdoe to a cloud account.
  • Map “MicrosoftAccounf ⁇ jdoe ” domain to a personal MicrosoftTM account.
  • a machine account i.e., + a username).
  • Domain knowledge enables processor 48 to differentiate between accounts that are typically managed differently in Active DomainTM and Kerberos realms, as well as various data cloud environments.
  • processor 48 can normalize a given extracted identifier 84 by using prior learned knowledge.
  • processor 48 can use learned roles and Directory Synchronization Service (DSSTM) to determine the account for a given extracted identifier 84.
  • DSSTM Directory Synchronization Service
  • processor 48 can use domain knowledge as follows:
  • account type 120 is a domain account.
  • account type 120 is a local account
  • processor 48 can pivot via the DSS.sid field (“sid” is an abbreviation for “security identifier” in Active DirectoryTM) so as to map the given extracted identifier to “company ⁇ jdoe” .
  • processor 48 compares the string "john.doe ⁇ gmail[.]com” to the DSS.upn field, and if a record with that value is found, it will be considered to be a domain account, and the processor will return normalized identifier “company ⁇ jdoe” .
  • the value in the corresponding DSS record "DSS.netbios_domairi ⁇ DSS.sam_account_name" may comprise "company ⁇ / ⁇ 7oe”.
  • processor 48 associates a given user entity 100 with a given mapped account 88.
  • each user entity 100 may be associated with one or more accounts 116.
  • the mapped accounts may comprise “Company/jdoe” , “hostl23/jdoe” , “john.doe@company.com” and "'john.doe ⁇ gmail.com” . All these mapped accounts 88 may be associated with a given user entity named “John Doe”.
  • processor 46 can use information stored in HR database 46 and/or account database 33 so as to associate a given account 69 with a given user entity 67. For example, if processor 46 uses account database 33 to map a given identifier 68 to a given account 69 “john.doe ⁇ gmail.com” . and identifies a given user entity 67 named “John Doe” in HR database 46, then the processor can associate the given account with the given user entity as they have the same name.
  • processor 48 can use heuristics to associate the given user entity with the given mapped account. For example, if “john.doe ⁇ gmail[.]com” matches DSS display name “John Doe” then they likely refer to the same user entity 100.
  • processor 48 can use profiling and attribution to associate the given user entity with the given mapped account.
  • processor 48 can determine that the computing device having the host name “host_123” is mostly used by a single user entity 100 “company ⁇ jdoe”.
  • processor 48 can determine that the account “john.doe ⁇ gmail[.]com” always originates log enties 60 from the computing device having the host name “host_123” .
  • processor 48 can determine that the computing device having the host name “host_123” is a personal endpoint used by the user entity “jdoe”. In a second attribution example, processor 48 can determine that “john.doe ⁇ gmail[.]com” is the personal email of the user entity “jdoe”. In a third attribution example, processor 48 can determine that the user entity “jdoe” likely has access to the account “host_123 ⁇ Administratov” .
  • processor 48 identifies one or more of the user entities that participated in the event corresponding to the selected log entry.
  • processor 48 updates, with the event indicated by the event message in the selected log entry, the user entity profile for each of the user entities identified in step 144. .
  • processor 48 can update user entity profiles 24 with the event indicated in the selected log entry only if the event was within a specified time period (e.g., the last 30 days).
  • step 148 if there are any unmapped log entries 60, then the method continues with step 132. The method ends when there are no unmapped log entries 60.
  • processor 48 Once processor 48 creates profiles 24, the processor can use the profiles to detect a single user entity 100 using multiple identifiers 122 to perform malicious activity in computing facility 20. For example, Processor 48 can:
  • Figure 7 is a flow diagram that schematically illustrates a method of using user entity activity profiles 24 to detect suspicious activity, in accordance with an embodiment of the present invention.
  • processor 48 collects, from logs 26, a set of additional event log entries 60.
  • processor 48 can collect the additional event log entries during a specific time period (e.g., 10 minutes or a full day).
  • processor 48 associates each of the events in the event messages in the additional event log entries with respective user entities 100, using embodiments described in the description referencing steps 140-142 in Figure 6 hereinabove.
  • processor 48 updates status information records 104 with any updates to HR database 46 and updates user entity profiles 24 accordingly. For example, the user entity “John Doe” may be on vacation.
  • step 154 processor 48 selects an unselected user entity 100.
  • processor 48 compares the additional events for the selected user entity to user entity profile 24 of the selected user entity.
  • processor 48 determines, based on the user entity profile, whether or not the additional events comprise suspicious activity.
  • each user profile 24 can include information from status records 104 for the corresponding user entity 100. For example, if a given status for 114 for a given user entity 100 indicates that the given user entity is retired, and processor 48 detects events associated with the user entity subsequent to the retirement, then the processor can classify those events as suspicious since the events are not in accordance with the retirement status in the user entity profile.
  • processor 48 issues an alert for the selected user entity.
  • the suspicious activity may combine a first event in a first given event log entry 60 that processor 48 used to generate the user entity profile, and a second event in a second given event log entry 60 that processor 48 collected in step 150.
  • the first and the second given event log entries mapped to different identifiers 122 associated with the same user entity 100.
  • To issue the alert processor 48 can perform operations such as transmitting a message to a system administrator (not shown) or restricting access to any of the accounts associated with the selected user entity.
  • processor 48 updates the user entity profile of the selected user entity with the additional events associated with the selected user entity.
  • step 164 if there are any unselected user entities 100 (i.e., in step 156), then the method continues with step 156. If there are no unselected user entities 100, then the method ends.
  • step 158 if processor 48 did not detect, based on the user entity profile, any suspicious activity in the additional events, then the method continues with step 162.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)
  • Information Transfer Between Computers (AREA)
  • Electrically Operated Instructional Devices (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Diaphragms For Electromechanical Transducers (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
PCT/IB2022/059544 2021-10-20 2022-10-06 User entity normalization and association Ceased WO2023067425A1 (en)

Priority Applications (4)

Application Number Priority Date Filing Date Title
IL309373A IL309373A (en) 2021-10-20 2022-10-06 Normalization and connection between user entities
AU2022370400A AU2022370400B2 (en) 2021-10-20 2022-10-06 User entity normalization and association
EP22797849.1A EP4420020B1 (en) 2021-10-20 2022-10-06 User entity normalization and association
JP2024505476A JP2024540794A (ja) 2021-10-20 2022-10-06 ユーザエンティティの正規化および関連付け

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US17/505,673 US12039017B2 (en) 2021-10-20 2021-10-20 User entity normalization and association
US17/505,673 2021-10-20

Publications (1)

Publication Number Publication Date
WO2023067425A1 true WO2023067425A1 (en) 2023-04-27

Family

ID=83945046

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/IB2022/059544 Ceased WO2023067425A1 (en) 2021-10-20 2022-10-06 User entity normalization and association

Country Status (6)

Country Link
US (1) US12039017B2 (https=)
EP (1) EP4420020B1 (https=)
JP (1) JP2024540794A (https=)
AU (1) AU2022370400B2 (https=)
IL (1) IL309373A (https=)
WO (1) WO2023067425A1 (https=)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024226432A1 (en) * 2023-04-24 2024-10-31 Cisco Technology, Inc. Device identifier correlation between security events within monitored data in extended detection and response systems
US12609955B2 (en) 2023-04-24 2026-04-21 Cisco Technology, Inc. Tracking computer devices in extended detection and response systems
US12615282B2 (en) 2023-07-23 2026-04-28 Palo Alto Networks, Inc. Security incident ranking and ranking explanation

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6347374B1 (en) * 1998-06-05 2002-02-12 Intrusion.Com, Inc. Event detection
US20070073519A1 (en) * 2005-05-31 2007-03-29 Long Kurt J System and Method of Fraud and Misuse Detection Using Event Logs
US20200285737A1 (en) * 2019-03-05 2020-09-10 Microsoft Technology Licensing, Llc Dynamic cybersecurity detection of sequence anomalies

Family Cites Families (276)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5991881A (en) 1996-11-08 1999-11-23 Harris Corporation Network surveillance system
US7003790B1 (en) 1998-01-31 2006-02-21 Sony Corporation Broadcast-program selection history information acquisition apparatus and its method
US6282175B1 (en) 1998-04-23 2001-08-28 Hewlett-Packard Company Method for tracking configuration changes in networks of computer systems through historical monitoring of configuration status of devices on the network.
US6321338B1 (en) 1998-11-09 2001-11-20 Sri International Network surveillance
US7007301B2 (en) 2000-06-12 2006-02-28 Hewlett-Packard Development Company, L.P. Computer architecture for an intrusion detection system
US7181769B1 (en) 2000-08-25 2007-02-20 Ncircle Network Security, Inc. Network security system having a device profiler communicatively coupled to a traffic monitor
AU2001295016A1 (en) 2000-09-01 2002-03-13 Sri International, Inc. Probabilistic alert correlation
US9525696B2 (en) 2000-09-25 2016-12-20 Blue Coat Systems, Inc. Systems and methods for processing data flows
US20020133586A1 (en) 2001-01-16 2002-09-19 Carter Shanklin Method and device for monitoring data traffic and preventing unauthorized access to a network
US7603709B2 (en) 2001-05-03 2009-10-13 Computer Associates Think, Inc. Method and apparatus for predicting and preventing attacks in communications networks
US6988124B2 (en) 2001-06-06 2006-01-17 Microsoft Corporation Locating potentially identical objects across multiple computers based on stochastic partitioning of workload
US7561517B2 (en) 2001-11-02 2009-07-14 Internap Network Services Corporation Passive route control of data networks
US7543056B2 (en) 2002-01-15 2009-06-02 Mcafee, Inc. System and method for network vulnerability detection and reporting
US7257630B2 (en) 2002-01-15 2007-08-14 Mcafee, Inc. System and method for network vulnerability detection and reporting
US7178164B1 (en) 2002-02-01 2007-02-13 Consul Risk Management System and method for ensuring proper implementation of computer security policies
JP2004032679A (ja) 2002-02-28 2004-01-29 Matsushita Electric Ind Co Ltd 通信装置及び通信システム
WO2003083660A1 (en) 2002-03-29 2003-10-09 Global Dataguard, Inc. Adaptive behavioral intrusion detection systems and methods
US7373666B2 (en) 2002-07-01 2008-05-13 Microsoft Corporation Distributed threat management
US7752665B1 (en) 2002-07-12 2010-07-06 TCS Commercial, Inc. Detecting probes and scans over high-bandwidth, long-term, incomplete network traffic information using limited memory
US20040117658A1 (en) 2002-09-27 2004-06-17 Andrea Klaes Security monitoring and intrusion detection system
US9009084B2 (en) 2002-10-21 2015-04-14 Rockwell Automation Technologies, Inc. System and methodology providing automation security analysis and network intrusion protection in an industrial environment
US7716737B2 (en) 2002-11-04 2010-05-11 Riverbed Technology, Inc. Connection based detection of scanning attacks
US8327442B2 (en) 2002-12-24 2012-12-04 Herz Frederick S M System and method for a distributed application and network security system (SDI-SCAM)
US7716736B2 (en) 2003-04-17 2010-05-11 Cybersoft, Inc. Apparatus, methods and articles of manufacture for computer virus testing
JP2004318552A (ja) 2003-04-17 2004-11-11 Kddi Corp Ｉｄｓログ分析支援装置、ｉｄｓログ分析支援方法及びｉｄｓログ分析支援プログラム
US7246156B2 (en) 2003-06-09 2007-07-17 Industrial Defender, Inc. Method and computer program product for monitoring an industrial network
US7496959B2 (en) 2003-06-23 2009-02-24 Architecture Technology Corporation Remote collection of computer forensic evidence
WO2005017690A2 (en) 2003-08-11 2005-02-24 Chorus Systems, Inc. Systems and methods for creation and use of an adaptive reference model
US20050060295A1 (en) 2003-09-12 2005-03-17 Sensory Networks, Inc. Statistical classification of high-speed network data through content inspection
US7613300B2 (en) 2003-09-26 2009-11-03 Genesis Microchip Inc. Content-protected digital link over a single signal line
US7634090B2 (en) 2003-09-26 2009-12-15 Genesis Microchip Inc. Packet based high definition high-bandwidth digital content protection
US7684568B2 (en) 2003-11-24 2010-03-23 Intellon Corporation Encrypting data in a communication network
US7002943B2 (en) 2003-12-08 2006-02-21 Airtight Networks, Inc. Method and system for monitoring a selected region of an airspace associated with local area networks of computing devices
US20050183120A1 (en) 2004-01-13 2005-08-18 Saurabh Jain Multi-user personalized digital multimedia distribution methods and systems
US7669059B2 (en) 2004-03-23 2010-02-23 Network Equipment Technologies, Inc. Method and apparatus for detection of hostile software
US8171553B2 (en) 2004-04-01 2012-05-01 Fireeye, Inc. Heuristic based capture with replay to virtual machine
US8375444B2 (en) 2006-04-20 2013-02-12 Fireeye, Inc. Dynamic signature creation and enforcement
US7225468B2 (en) 2004-05-07 2007-05-29 Digital Security Networks, Llc Methods and apparatus for computer network security using intrusion detection and prevention
US7761919B2 (en) 2004-05-20 2010-07-20 Computer Associates Think, Inc. Intrusion detection with automatic signature generation
US20050268112A1 (en) 2004-05-28 2005-12-01 Microsoft Corporation Managing spyware and unwanted software through auto-start extensibility points
US7694150B1 (en) 2004-06-22 2010-04-06 Cisco Technology, Inc System and methods for integration of behavioral and signature based security
US7929534B2 (en) 2004-06-28 2011-04-19 Riverbed Technology, Inc. Flow logging for connection-based anomaly detection
US7748040B2 (en) 2004-07-12 2010-06-29 Architecture Technology Corporation Attack correlation using marked information
US9154511B1 (en) 2004-07-13 2015-10-06 Dell Software Inc. Time zero detection of infectious messages
US7904956B2 (en) 2004-10-01 2011-03-08 Microsoft Corporation Access authorization with anomaly detection
US7287279B2 (en) 2004-10-01 2007-10-23 Webroot Software, Inc. System and method for locating malware
US8181219B2 (en) 2004-10-01 2012-05-15 Microsoft Corporation Access authorization having embedded policies
KR100612452B1 (ko) 2004-11-08 2006-08-16 삼성전자주식회사 악성 코드 탐지 장치 및 그 방법
US20060242694A1 (en) 2004-11-08 2006-10-26 Jeffrey Gold Mitigation and mitigation management of attacks in networked systems
US7540025B2 (en) 2004-11-18 2009-05-26 Cisco Technology, Inc. Mitigating network attacks using automatic signature generation
US8117659B2 (en) 2005-12-28 2012-02-14 Microsoft Corporation Malicious code infection cause-and-effect analysis
US7409719B2 (en) 2004-12-21 2008-08-05 Microsoft Corporation Computer security management, such as in a virtual machine or hardened operating system
US7607170B2 (en) 2004-12-22 2009-10-20 Radware Ltd. Stateful attack protection
US7703138B2 (en) 2004-12-29 2010-04-20 Intel Corporation Use of application signature to identify trusted traffic
US7571474B2 (en) 2004-12-30 2009-08-04 Intel Corporation System security event notification aggregation and non-repudiation
US20060149848A1 (en) 2005-01-04 2006-07-06 Trusted Network Technologies, Inc. System, apparatuses, and method for linking and advising of network events related to resource access
US7546471B2 (en) 2005-01-14 2009-06-09 Microsoft Corporation Method and system for virus detection using pattern matching techniques
US7784099B2 (en) 2005-02-18 2010-08-24 Pace University System for intrusion detection and vulnerability assessment in a computer network using simulation and machine learning
US7653869B2 (en) 2005-02-18 2010-01-26 Sony Corporation System and method for error correction in high definition TV signal
US7809013B2 (en) 2005-03-24 2010-10-05 Intel Corporation Channel scanning
US20060259967A1 (en) 2005-05-13 2006-11-16 Microsoft Corporation Proactively protecting computers in a networking environment from malware
TW200644495A (en) 2005-06-10 2006-12-16 D Link Corp Regional joint detecting and guarding system for security of network information
US7979368B2 (en) 2005-07-01 2011-07-12 Crossbeam Systems, Inc. Systems and methods for processing data flows
US7908655B1 (en) 2005-08-16 2011-03-15 Sprint Communications Company L.P. Connectionless port scan detection on a network
CN1917426B (zh) 2005-08-17 2010-12-08 国际商业机器公司 端口扫描方法与设备及其检测方法与设备、端口扫描系统
US20070072661A1 (en) 2005-09-27 2007-03-29 Alexander Lototski Windows message protection
KR100724825B1 (ko) 2005-11-17 2007-06-04 삼성전자주식회사 스케일러블 비디오 코딩에서 다차원 스케일러빌리티에 따른 조건적 접근제어를 위한 스케일러블 비디오 비트스트림 암복호화 방법 및 암복호화 시스템
US8112513B2 (en) 2005-11-30 2012-02-07 Microsoft Corporation Multi-user display proxy server
US8516573B1 (en) 2005-12-22 2013-08-20 At&T Intellectual Property Ii, L.P. Method and apparatus for port scan detection in a network
CA2531410A1 (en) 2005-12-23 2007-06-23 Snipe Network Security Corporation Behavioural-based network anomaly detection based on user and group profiling
US7712134B1 (en) 2006-01-06 2010-05-04 Narus, Inc. Method and apparatus for worm detection and containment in the internet core
US8397284B2 (en) 2006-01-17 2013-03-12 University Of Maryland Detection of distributed denial of service attacks in autonomous system domains
US8429177B2 (en) 2006-02-08 2013-04-23 Yahoo! Inc. Using exceptional changes in webgraph snapshots over time for internet entity marking
JP2007235323A (ja) 2006-02-28 2007-09-13 Toshiba Corp 高度機密情報の保存／記録方法、高度機密情報を利用する再生装置および高度機密情報を格納するメモリ
JP2007235324A (ja) 2006-02-28 2007-09-13 Toshiba Corp 復号または暗号化を行う情報処理装置および情報処理方法
US20070218874A1 (en) 2006-03-17 2007-09-20 Airdefense, Inc. Systems and Methods For Wireless Network Forensics
US7530105B2 (en) 2006-03-21 2009-05-05 21St Century Technologies, Inc. Tactical and strategic attack detection and prediction
US8006306B2 (en) 2006-03-21 2011-08-23 Riverbed Technology, Inc. Exploit-based worm propagation mitigation
US8966630B2 (en) 2006-04-27 2015-02-24 The Invention Science Fund I, Llc Generating and distributing a malware countermeasure
US20140373144A9 (en) 2006-05-22 2014-12-18 Alen Capalik System and method for analyzing unauthorized intrusion into a computer network
US20070283166A1 (en) 2006-06-05 2007-12-06 Kabushiki Kaisha Toshiba System and method for state transition intrusion detection
US20080016339A1 (en) 2006-06-29 2008-01-17 Jayant Shukla Application Sandbox to Detect, Remove, and Prevent Malware
US8490190B1 (en) 2006-06-30 2013-07-16 Symantec Corporation Use of interactive messaging channels to verify endpoints
US9824107B2 (en) 2006-10-25 2017-11-21 Entit Software Llc Tracking changing state data to assist in computer network security
US7877795B2 (en) 2006-10-30 2011-01-25 At&T Intellectual Property I, Lp Methods, systems, and computer program products for automatically configuring firewalls
US20100071063A1 (en) 2006-11-29 2010-03-18 Wisconsin Alumni Research Foundation System for automatic detection of spyware
US20080134296A1 (en) 2006-11-30 2008-06-05 Ofer Amitai System and method of network authorization by scoring
US7523016B1 (en) 2006-12-29 2009-04-21 Google Inc. Detecting anomalies
US7847687B2 (en) 2007-02-16 2010-12-07 Accenture Global Services Limited Context-sensitive alerts
US7894358B2 (en) 2007-03-15 2011-02-22 Cisco Technology, Inc. Detection of heavy users of network resources
US8429713B2 (en) 2007-04-02 2013-04-23 Sony Corporation Method and apparatus to speed transmission of CEC commands
US8131745B1 (en) 2007-04-09 2012-03-06 Rapleaf, Inc. Associating user identities with different unique identifiers
US8707431B2 (en) 2007-04-24 2014-04-22 The Mitre Corporation Insider threat detection
US7882217B2 (en) 2007-05-17 2011-02-01 Verint Systems Inc. Network identity clustering
US8285206B2 (en) * 2007-06-01 2012-10-09 Research In Motion Limited Proximity-dependent events
US20090007100A1 (en) 2007-06-28 2009-01-01 Microsoft Corporation Suspending a Running Operating System to Enable Security Scanning
US8522344B2 (en) 2007-06-29 2013-08-27 Verizon Patent And Licensing Inc. Theft of service architectural integrity validation tools for session initiation protocol (SIP)-based systems
KR100922582B1 (ko) 2007-07-20 2009-10-21 한국전자통신연구원 중심점 분할 기법을 이용한 로그 기반의 역추적 시스템 및방법
EP2201720B1 (en) 2007-10-23 2014-02-26 Unify Inc. Method and system for multicast statistic collection
EP2056559B1 (en) 2007-11-02 2017-05-17 Deutsche Telekom AG Method and system for network simulation
US8624733B2 (en) 2007-11-05 2014-01-07 Francis John Cusack, JR. Device for electronic access control with integrated surveillance
US8434140B2 (en) 2007-11-06 2013-04-30 Barracuda Networks, Inc. Port hopping and seek you peer to peer traffic control method and system
KR20090065267A (ko) 2007-12-17 2009-06-22 한국전자통신연구원 침입 탐지 기법을 이용한 웹 서버 로그 분석 장치 및 방법
WO2009085239A2 (en) 2007-12-20 2009-07-09 E-Fense, Inc. Computer forensics, e-discovery and incident response methods and systems
US20100268818A1 (en) 2007-12-20 2010-10-21 Richmond Alfred R Systems and methods for forensic analysis of network behavior
EP2227889B1 (en) 2007-12-31 2011-07-13 Telecom Italia S.p.A. Method of detecting anomalies in a communication system using symbolic packet features
CA2619092C (en) 2008-01-29 2015-05-19 Solutioninc Limited Method of and system for support of user devices roaming between routing realms by a single network server
US8429180B1 (en) 2008-03-31 2013-04-23 Symantec Corporation Cooperative identification of malicious remote objects
WO2009132047A2 (en) 2008-04-21 2009-10-29 Zytron Corp. Collaborative and proactive defense of networks and information systems
US8745703B2 (en) 2008-06-24 2014-06-03 Microsoft Corporation Identifying exploitation of vulnerabilities using error report
US8781003B2 (en) 2008-07-17 2014-07-15 Cisco Technology, Inc. Splicing of encrypted video/audio content
US8769681B1 (en) 2008-08-11 2014-07-01 F5 Networks, Inc. Methods and system for DMA based distributed denial of service protection
US8023504B2 (en) 2008-08-27 2011-09-20 Cisco Technology, Inc. Integrating security server policies with optimized routing control
US20100107257A1 (en) 2008-10-29 2010-04-29 International Business Machines Corporation System, method and program product for detecting presence of malicious software running on a computer system
US8135964B2 (en) 2008-12-09 2012-03-13 Nvidia Corporation Apparatus, system, method, and computer program product for executing a program utilizing a processor to generate keys for decrypting content
US8868925B2 (en) 2008-12-09 2014-10-21 Nvidia Corporation Method and apparatus for the secure processing of confidential content within a virtual machine of a processor
US8266448B2 (en) 2008-12-09 2012-09-11 Nvidia Corporation Apparatus, system, method, and computer program product for generating and securing a program capable of being executed utilizing a processor to decrypt content
GB0822619D0 (en) 2008-12-11 2009-01-21 Scansafe Ltd Malware detection
US8321509B2 (en) 2009-02-02 2012-11-27 Waldeck Technology, Llc Handling crowd requests for large geographic areas
US20100235915A1 (en) 2009-03-12 2010-09-16 Nasir Memon Using host symptoms, host roles, and/or host reputation for detection of host infection
US9736251B1 (en) 2009-04-17 2017-08-15 Ca, Inc. Capture and replay of RDP session packets
US8762288B2 (en) 2009-04-22 2014-06-24 The Western Union Company Methods and systems for establishing an identity confidence database
US8385542B2 (en) 2009-04-27 2013-02-26 Nagrastar L.L.C. Methods and apparatus for securing communications between a decryption device and a television receiver
US8213326B2 (en) 2009-04-30 2012-07-03 Alcatel Lucent Method and apparatus for the classification of ports on a data communication network node
US8156055B2 (en) 2009-05-04 2012-04-10 ThinkEco, Inc. System and method for utility usage, monitoring and management
US20100299430A1 (en) 2009-05-22 2010-11-25 Architecture Technology Corporation Automated acquisition of volatile forensic evidence from network devices
US9270542B2 (en) 2009-07-31 2016-02-23 Ixia Apparatus and methods for forwarding data packets captured from a network
WO2011056952A2 (en) 2009-11-04 2011-05-12 Aware, Inc. Forensic diagnostic capability including g.inp
US20110125770A1 (en) 2009-11-25 2011-05-26 Nokia Corporation Method and apparatus for facilitating identity resolution
JP5723888B2 (ja) 2009-12-04 2015-05-27 ソニック アイピー， インコーポレイテッド 基本ビットストリーム暗号材料伝送システムおよび方法
US20110138463A1 (en) 2009-12-07 2011-06-09 Electronics And Telecommunications Research Institute Method and system for ddos traffic detection and traffic mitigation using flow statistics
US20110153748A1 (en) 2009-12-18 2011-06-23 Electronics And Telecommunications Research Institute Remote forensics system based on network
US8438270B2 (en) 2010-01-26 2013-05-07 Tenable Network Security, Inc. System and method for correlating network identities and addresses
WO2011094312A1 (en) 2010-01-26 2011-08-04 Silver Tail Systems, Inc. System and method for network security including detection of man-in-the-browser attacks
SG183332A1 (en) 2010-03-01 2012-09-27 Silver Tail Systems System and method for network security including detection of attacks through partner websites
US8756684B2 (en) 2010-03-01 2014-06-17 Emc Corporation System and method for network security including detection of attacks through partner websites
US8707427B2 (en) 2010-04-06 2014-04-22 Triumfant, Inc. Automated malware detection and remediation
US8578345B1 (en) 2010-04-15 2013-11-05 Symantec Corporation Malware detection efficacy by identifying installation and uninstallation scenarios
US9530166B2 (en) 2010-04-21 2016-12-27 Facebook, Inc. Social graph that includes web pages outside of a social networking system
KR101122650B1 (ko) 2010-04-28 2012-03-09 한국전자통신연구원 정상 프로세스에 위장 삽입된 악성코드 탐지 장치, 시스템 및 방법
US20110270957A1 (en) 2010-04-30 2011-11-03 The Phan Method and system for logging trace events of a network device
US20110317770A1 (en) 2010-06-24 2011-12-29 Worldplay (Barbados) Inc. Decoder for multiple independent video stream decoding
US9147071B2 (en) 2010-07-20 2015-09-29 Mcafee, Inc. System and method for proactive detection of malware device drivers via kernel forensic behavioral monitoring and a back-end reputation system
US8607353B2 (en) 2010-07-29 2013-12-10 Accenture Global Services Gmbh System and method for performing threat assessments using situational awareness
US8990380B2 (en) 2010-08-12 2015-03-24 Citrix Systems, Inc. Systems and methods for quality of service of ICA published applications
US9245114B2 (en) 2010-08-26 2016-01-26 Verisign, Inc. Method and system for automatic detection and analysis of malware
US20120136802A1 (en) 2010-11-30 2012-05-31 Zonar Systems, Inc. System and method for vehicle maintenance including remote diagnosis and reverse auction for identified repairs
US8875286B2 (en) 2010-12-01 2014-10-28 Cisco Technology, Inc. Method and apparatus for detecting malicious software using machine learning techniques
US20120143650A1 (en) 2010-12-06 2012-06-07 Thomas Crowley Method and system of assessing and managing risk associated with compromised network assets
WO2012103236A1 (en) 2011-01-26 2012-08-02 Viaforensics, Llc Systems, methods, apparatuses, and computer program products for forensic monitoring
KR20120096983A (ko) 2011-02-24 2012-09-03 삼성전자주식회사 악성 프로그램 검출 방법 및 이를 구현하는 휴대 단말기
US9026644B2 (en) 2011-03-10 2015-05-05 Verizon Patent And Licensing Inc. Anomaly detection and identification using traffic steering and real-time analytics
US8966625B1 (en) 2011-05-24 2015-02-24 Palo Alto Networks, Inc. Identification of malware sites using unknown URL sites and newly registered DNS addresses
US8555388B1 (en) 2011-05-24 2013-10-08 Palo Alto Networks, Inc. Heuristic botnet detection
US20120308008A1 (en) 2011-05-31 2012-12-06 Broadcom Corporation Wireless Transmission of Protected Content
US10356106B2 (en) 2011-07-26 2019-07-16 Palo Alto Networks (Israel Analytics) Ltd. Detecting anomaly action within a computer network
EP2737404A4 (en) 2011-07-26 2015-04-29 Light Cyber Ltd METHOD FOR DETECTING AN ANALYSIS ACTION WITHIN A COMPUTER NETWORK
US8984581B2 (en) 2011-07-27 2015-03-17 Seven Networks, Inc. Monitoring mobile application activities for malicious traffic on a mobile device
US20150304346A1 (en) 2011-08-19 2015-10-22 Korea University Research And Business Foundation Apparatus and method for detecting anomaly of network
US8909922B2 (en) 2011-09-01 2014-12-09 Sonic Ip, Inc. Systems and methods for playing back alternative streams of protected content protected using common cryptographic information
ES2755780T3 (es) 2011-09-16 2020-04-23 Veracode Inc Análisis estático y de comportamiento automatizado mediante la utilización de un espacio aislado instrumentado y clasificación de aprendizaje automático para seguridad móvil
US20130083700A1 (en) 2011-10-04 2013-04-04 Juniper Networks, Inc. Methods and apparatus for centralized management of access and aggregation network infrastructure
US8677487B2 (en) 2011-10-18 2014-03-18 Mcafee, Inc. System and method for detecting a malicious command and control channel
US8909930B2 (en) 2011-10-31 2014-12-09 L-3 Communications Corporation External reference monitor
JP5454960B2 (ja) 2011-11-09 2014-03-26 株式会社東芝 再暗号化システム、再暗号化装置及びプログラム
CN102497362B (zh) 2011-12-07 2018-01-05 北京润通丰华科技有限公司 异常网络流量的攻击源追踪方法及装置
US8851929B2 (en) 2012-02-01 2014-10-07 Rad Data Communications Ltd. SFP functionality extender
US9092616B2 (en) 2012-05-01 2015-07-28 Taasera, Inc. Systems and methods for threat identification and remediation
US8898782B2 (en) 2012-05-01 2014-11-25 Harris Corporation Systems and methods for spontaneously configuring a computer network
US20130333041A1 (en) 2012-06-12 2013-12-12 International Business Machines Corporation Method and Apparatus for Automatic Identification of Affected Network Resources After a Computer Intrusion
JP5856015B2 (ja) 2012-06-15 2016-02-09 日立マクセル株式会社 コンテンツ送信装置
US9038178B1 (en) 2012-06-25 2015-05-19 Emc Corporation Detection of malware beaconing activities
US20140010367A1 (en) 2012-07-05 2014-01-09 Changliang Wang Systems and methods for providing content to a wireless display screen
US9088606B2 (en) 2012-07-05 2015-07-21 Tenable Network Security, Inc. System and method for strategic anti-malware monitoring
US11126720B2 (en) 2012-09-26 2021-09-21 Bluvector, Inc. System and method for automated machine-learning, zero-day malware detection
EP2725512B1 (en) 2012-10-23 2019-03-27 Verint Systems Ltd. System and method for malware detection using multi-dimensional feature clustering
US9531736B1 (en) 2012-12-24 2016-12-27 Narus, Inc. Detecting malicious HTTP redirections using user browsing activity trees
US9378361B1 (en) 2012-12-31 2016-06-28 Emc Corporation Anomaly sensor framework for detecting advanced persistent threat attacks
WO2014111863A1 (en) 2013-01-16 2014-07-24 Light Cyber Ltd. Automated forensics of computer systems using behavioral intelligence
US9078021B2 (en) 2013-01-16 2015-07-07 Kabushiki Kaisha Toshiba Information processing apparatus, content transmission method and storage medium
US9363151B2 (en) 2013-01-17 2016-06-07 International Business Machines Corporation Dynamically determining packet sampling rates
US9860278B2 (en) 2013-01-30 2018-01-02 Nippon Telegraph And Telephone Corporation Log analyzing device, information processing method, and program
WO2014160062A1 (en) 2013-03-14 2014-10-02 TechGuard Security, L.L.C. Internet protocol threat prevention
US9264442B2 (en) 2013-04-26 2016-02-16 Palo Alto Research Center Incorporated Detecting anomalies in work practice data by combining multiple domains of information
GB2516894A (en) 2013-08-05 2015-02-11 Ibm User evaluation
US20150047032A1 (en) 2013-08-07 2015-02-12 Front Porch Communications, Inc. System and method for computer security
CN103561048B (zh) 2013-09-02 2016-08-31 北京东土科技股份有限公司 一种确定tcp端口扫描的方法及装置
US9491727B2 (en) 2013-09-10 2016-11-08 Anue Systems, Inc. System and method for monitoring network synchronization
US10123063B1 (en) * 2013-09-23 2018-11-06 Comscore, Inc. Protecting user privacy during collection of demographics census data
US9319421B2 (en) 2013-10-14 2016-04-19 Ut-Battelle, Llc Real-time detection and classification of anomalous events in streaming data
WO2015056170A1 (en) 2013-10-16 2015-04-23 Implisit Insights Ltd. Automatic crm data entry
US9438620B2 (en) 2013-10-22 2016-09-06 Mcafee, Inc. Control flow graph representation and classification
US20150121461A1 (en) 2013-10-24 2015-04-30 Cyber-Ark Software Ltd. Method and system for detecting unauthorized access to and use of network resources with targeted analytics
US9231962B1 (en) 2013-11-12 2016-01-05 Emc Corporation Identifying suspicious user logins in enterprise networks
US9910718B2 (en) 2014-01-20 2018-03-06 Lenovo Enterprise Solutions (Singapore) Pte. Ltd. Selective locking of operations on joint and disjoint sets
US11405410B2 (en) 2014-02-24 2022-08-02 Cyphort Inc. System and method for detecting lateral movement and data exfiltration
US9407647B2 (en) 2014-03-11 2016-08-02 Vectra Networks, Inc. Method and system for detecting external control of compromised hosts
US9509669B2 (en) 2014-04-14 2016-11-29 Lattice Semiconductor Corporation Efficient routing of streams encrypted using point-to-point authentication protocol
KR101761737B1 (ko) 2014-05-20 2017-07-26 한국전자통신연구원 제어 시스템의 이상행위 탐지 시스템 및 방법
US10652240B2 (en) 2014-05-29 2020-05-12 Entersekt International Limited Method and system for determining a compromise risk associated with a unique device identifier
US9721212B2 (en) 2014-06-04 2017-08-01 Qualcomm Incorporated Efficient on-device binary analysis for auto-generated behavioral models
US10038703B2 (en) 2014-07-18 2018-07-31 The Regents Of The University Of Michigan Rating network security posture and comparing network maliciousness
US9280661B2 (en) 2014-08-08 2016-03-08 Brighterion, Inc. System administrator behavior analysis
US9773112B1 (en) 2014-09-29 2017-09-26 Fireeye, Inc. Exploit detection of malware and malware families
US9948661B2 (en) 2014-10-29 2018-04-17 At&T Intellectual Property I, L.P. Method and apparatus for detecting port scans in a network
US20160142746A1 (en) 2014-11-14 2016-05-19 Thales Avionics, Inc. Method of encrypting, streaming, and displaying video content using selective encryption
US9118582B1 (en) 2014-12-10 2015-08-25 Iboss, Inc. Network traffic management using port number redirection
US9690933B1 (en) 2014-12-22 2017-06-27 Fireeye, Inc. Framework for classifying an object as malicious with machine learning for deploying updated predictive models
TWI541662B (zh) 2014-12-31 2016-07-11 中原大學 估計熵值之方法與系統
US10140453B1 (en) 2015-03-16 2018-11-27 Amazon Technologies, Inc. Vulnerability management using taxonomy-based normalization
US9596249B2 (en) 2015-04-23 2017-03-14 Dell Software, Inc. Detecting shared or compromised credentials through analysis of simultaneous actions
US10728281B2 (en) 2015-04-28 2020-07-28 Nippon Telegraph And Telephone Corporation Connection control apparatus, connection control method, and connection control program
US9749340B2 (en) 2015-04-28 2017-08-29 Arbor Networks, Inc. System and method to detect and mitigate TCP window attacks
US10075461B2 (en) 2015-05-31 2018-09-11 Palo Alto Networks (Israel Analytics) Ltd. Detection of anomalous administrative actions
US9923915B2 (en) 2015-06-02 2018-03-20 C3 Iot, Inc. Systems and methods for providing cybersecurity analysis based on operational technologies and information technologies
JP2017018176A (ja) * 2015-07-07 2017-01-26 富士通株式会社 出力装置、出力方法及び出力プログラム
US10476891B2 (en) 2015-07-21 2019-11-12 Attivo Networks Inc. Monitoring access of network darkspace
US10757136B2 (en) 2015-08-28 2020-08-25 Verizon Patent And Licensing Inc. Botnet beaconing detection and mitigation
JP6641819B2 (ja) 2015-09-15 2020-02-05 富士通株式会社 ネットワーク監視装置、ネットワーク監視方法及びネットワーク監視プログラム
US10237875B1 (en) 2015-09-25 2019-03-19 Amazon Technologies, Inc. Routing-aware network limiter
US10742664B2 (en) 2015-10-20 2020-08-11 International Business Machines Corporation Probabilistically detecting low-intensity, multi-modal threats using synthetic events
US9531614B1 (en) 2015-10-30 2016-12-27 AppDynamics, Inc. Network aware distributed business transaction anomaly detection
US10291634B2 (en) 2015-12-09 2019-05-14 Checkpoint Software Technologies Ltd. System and method for determining summary events of an attack
GB2562423B (en) 2016-02-25 2020-04-29 Sas Inst Inc Cybersecurity system
US10230749B1 (en) 2016-02-29 2019-03-12 Palo Alto Networks, Inc. Automatically grouping malware based on artifacts
US10027694B1 (en) 2016-03-28 2018-07-17 Amazon Technologies, Inc. Detecting denial of service attacks on communication networks
US10003606B2 (en) 2016-03-30 2018-06-19 Symantec Corporation Systems and methods for detecting security threats
US9836952B2 (en) 2016-04-06 2017-12-05 Alcatel-Lucent Usa Inc. Alarm causality templates for network function virtualization
US10372910B2 (en) 2016-06-20 2019-08-06 Jask Labs Inc. Method for predicting and characterizing cyber attacks
US10257214B2 (en) 2016-06-23 2019-04-09 Cisco Technology, Inc. Using a machine learning classifier to assign a data retention priority for network forensics and retrospective detection
US10616184B2 (en) 2016-06-30 2020-04-07 Intel Corporation Wireless display streaming of protected content
US10313365B2 (en) 2016-08-15 2019-06-04 International Business Machines Corporation Cognitive offense analysis using enriched graphs
US10706144B1 (en) 2016-09-09 2020-07-07 Bluerisc, Inc. Cyber defense with graph theoretical approach
US10567415B2 (en) 2016-09-15 2020-02-18 Arbor Networks, Inc. Visualization of network threat monitoring
CN106506556B (zh) 2016-12-29 2019-11-19 北京神州绿盟信息安全科技股份有限公司 一种网络流量异常检测方法及装置
US10356115B2 (en) 2017-03-31 2019-07-16 Level 3 Communications, Llc Creating aggregate network flow time series in network anomaly detection systems
RU2651196C1 (ru) 2017-06-16 2018-04-18 Акционерное общество "Лаборатория Касперского" Способ обнаружения аномальных событий по популярности свертки события
US20180373820A1 (en) 2017-06-26 2018-12-27 Akselos S.A. Methods and Systems for Constructing and Analyzing Component-Based Models of Engineering Systems Having Linear and Nonlinear Regions
US10181032B1 (en) * 2017-07-17 2019-01-15 Sift Science, Inc. System and methods for digital account threat detection
US10560487B2 (en) 2017-07-26 2020-02-11 International Business Machines Corporation Intrusion detection and mitigation in data processing
US11611574B2 (en) 2017-08-02 2023-03-21 Code42 Software, Inc. User behavior analytics for insider threat detection
CA3011936A1 (en) * 2017-08-03 2019-02-03 Interset Software, Inc. Systems and methods for discriminating between human and non-human interactions with computing devices on a computer network
US10530787B2 (en) 2017-08-30 2020-01-07 International Business Machines Corporation Detecting malware attacks using extracted behavioral features
US20190207966A1 (en) 2017-12-28 2019-07-04 Fireeye, Inc. Platform and Method for Enhanced Cyber-Attack Detection and Response Employing a Global Data Store
US10904277B1 (en) 2018-02-27 2021-01-26 Amazon Technologies, Inc. Threat intelligence system measuring network threat levels
US10999304B2 (en) 2018-04-11 2021-05-04 Palo Alto Networks (Israel Analytics) Ltd. Bind shell attack detection
US10762444B2 (en) 2018-09-06 2020-09-01 Quickpath, Inc. Real-time drift detection in machine learning systems and applications
US10880319B2 (en) 2018-04-26 2020-12-29 Micro Focus Llc Determining potentially malware generated domain names
US11212299B2 (en) * 2018-05-01 2021-12-28 Royal Bank Of Canada System and method for monitoring security attack chains
US10609208B2 (en) * 2018-05-08 2020-03-31 Apple Inc. Managing device usage
US10360367B1 (en) * 2018-06-07 2019-07-23 Capital One Services, Llc Multi-factor authentication devices
US11100199B2 (en) * 2018-08-30 2021-08-24 Servicenow, Inc. Automatically detecting misuse of licensed software
US10742481B2 (en) * 2018-10-31 2020-08-11 Microsoft Technology Licensing, Llc Near real time analytics
TWI729320B (zh) 2018-11-01 2021-06-01 財團法人資訊工業策進會 可疑封包偵測裝置及其可疑封包偵測方法
WO2020102696A1 (en) * 2018-11-15 2020-05-22 Airside Mobile, Inc. Methods and apparatus for encrypting, storing, and/or sharing sensitive data
US10958677B2 (en) 2018-12-18 2021-03-23 At&T Intellectual Property I, L.P. Risk identification for unlabeled threats in network traffic
US11184376B2 (en) 2019-01-30 2021-11-23 Palo Alto Networks (Israel Analytics) Ltd. Port scan detection using destination profiles
US11070569B2 (en) 2019-01-30 2021-07-20 Palo Alto Networks (Israel Analytics) Ltd. Detecting outlier pairs of scanned ports
US11316872B2 (en) 2019-01-30 2022-04-26 Palo Alto Networks (Israel Analytics) Ltd. Malicious port scan detection using port profiles
US11184377B2 (en) 2019-01-30 2021-11-23 Palo Alto Networks (Israel Analytics) Ltd. Malicious port scan detection using source profiles
US11501261B1 (en) * 2019-01-31 2022-11-15 Slack Technologies, Llc Aggregating an event occurrence feedback report within a group-based communication system
US11310257B2 (en) 2019-02-27 2022-04-19 Microsoft Technology Licensing, Llc Anomaly scoring using collaborative filtering
US11531908B2 (en) 2019-03-12 2022-12-20 Ebay Inc. Enhancement of machine learning-based anomaly detection using knowledge graphs
US11126711B2 (en) 2019-04-09 2021-09-21 Jpmorgan Chase Bank, N.A. System and method for implementing a log source value tool for security information event management
US11899786B2 (en) 2019-04-15 2024-02-13 Crowdstrike, Inc. Detecting security-violation-associated event data
US12056922B2 (en) * 2019-04-26 2024-08-06 Samsara Inc. Event notification system
US11943237B2 (en) 2019-05-24 2024-03-26 International Business Machines Corporation Malicious peer identification for database block sequence
US11238154B2 (en) 2019-07-05 2022-02-01 Mcafee, Llc Multi-lateral process trees for malware remediation
US11477214B2 (en) 2019-12-10 2022-10-18 Fortinet, Inc. Cloud-based orchestration of incident response using multi-feed security event classifications with machine learning
US20210182387A1 (en) 2019-12-12 2021-06-17 International Business Machines Corporation Automated semantic modeling of system events
US11550902B2 (en) * 2020-01-02 2023-01-10 Microsoft Technology Licensing, Llc Using security event correlation to describe an authentication process
US20210224676A1 (en) 2020-01-17 2021-07-22 Microsoft Technology Licensing, Llc Systems and methods for distributed incident classification and routing
US11775639B2 (en) 2020-10-23 2023-10-03 Sophos Limited File integrity monitoring
US20220138856A1 (en) * 2020-11-04 2022-05-05 Td Ameritrade Ip Company, Inc. Recommendation System For Generating Personalized And Themed Recommendations On A User Interface Based On User Similarity
US11943235B2 (en) 2021-01-04 2024-03-26 Saudi Arabian Oil Company Detecting suspicious user logins in private networks using machine learning
US12238081B2 (en) 2021-12-01 2025-02-25 Paypal, Inc. Edge device representation learning

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6347374B1 (en) * 1998-06-05 2002-02-12 Intrusion.Com, Inc. Event detection
US20070073519A1 (en) * 2005-05-31 2007-03-29 Long Kurt J System and Method of Fraud and Misuse Detection Using Event Logs
US20200285737A1 (en) * 2019-03-05 2020-09-10 Microsoft Technology Licensing, Llc Dynamic cybersecurity detection of sequence anomalies

Also Published As

Publication number Publication date
EP4420020A1 (en) 2024-08-28
EP4420020B1 (en) 2026-04-01
US20230117268A1 (en) 2023-04-20
IL309373A (en) 2024-02-01
AU2022370400A1 (en) 2023-12-07
JP2024540794A (ja) 2024-11-06
US12039017B2 (en) 2024-07-16
AU2022370400B2 (en) 2024-09-12

Similar Documents

Publication Publication Date Title
US11831785B2 (en) Systems and methods for digital certificate security
US11647043B2 (en) Identifying security actions based on computing asset relationship data
EP4420020B1 (en) User entity normalization and association
US9049221B1 (en) Detecting suspicious web traffic from an enterprise network
US8554907B1 (en) Reputation prediction of IP addresses
US8495737B2 (en) Systems and methods for detecting email spam and variants thereof
EP2933973B1 (en) Data protection method, apparatus and system
US8856928B1 (en) Protecting electronic assets using false profiles in social networks
US10630676B2 (en) Protecting against malicious discovery of account existence
US11770388B1 (en) Network infrastructure detection
JP6490502B2 (ja) サイバー攻撃対策範囲優先度付けシステム、サイバー攻撃対策範囲優先度付け方法
US12039084B2 (en) Systems and methods for detecting and remedying theft of data
US10326731B2 (en) Domain name service information propagation
US11630895B2 (en) System and method of changing the password of an account record under a threat of unlawful access to user data
EP3311555A1 (en) Advanced security for domain names
AU2022441431B2 (en) Agent prevention augmentation based on organizational learning
EP3674933B1 (en) System and method of changing the password of an account record under a threat of unlawful access to user data
Mokhov et al. Automating MAC spoofer evidence gathering and encoding for investigations
Steffens Attack Infrastructure
JP2025007306A (ja) 情報処理装置、情報処理方法、及びプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22797849

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022370400

Country of ref document: AU

Ref document number: AU2022370400

Country of ref document: AU

ENP Entry into the national phase

Ref document number: 2022370400

Country of ref document: AU

Date of ref document: 20221006

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 309373

Country of ref document: IL

ENP Entry into the national phase

Ref document number: 2024505476

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2022797849

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022797849

Country of ref document: EP

Effective date: 20240521

WWG Wipo information: grant in national office

Ref document number: 2022797849

Country of ref document: EP