Aspects of the disclosure relate to dynamically providing cybersecurity training based on user-specific threat information. A computing platform may receive, from a targeted attack protection (TAP) server, user-specific threat information indicating at least one threat that has been encountered by at least one user. The computing platform may identify one or more users to receive cybersecurity training in a first cybersecurity training topic based on the user-specific threat information indicating the at least one threat that has been encountered by the at least one user. Subsequently, the computing platform may load one or more cybersecurity training modules based on identifying the one or more users to receive the cybersecurity training in the first cybersecurity training topic. Then, the computing platform may provide the one or more cybersecurity training modules to one or more user computing devices.
H04L 51/212 - Monitoring or handling of messages using filtering or selective blocking
H04L 51/42 - Mailbox-related aspects, e.g. synchronisation of mailboxes
2.
USING A MACHINE LEARNING SYSTEM TO PROCESS A CORPUS OF DOCUMENTS ASSOCIATED WITH A USER TO DETERMINE A USER-SPECIFIC AND/OR PROCESS-SPECIFIC CONSEQUENCE INDEX
Aspects of the disclosure relate to using a machine learning system to process a corpus of documents associated with a user to determine a user-specific consequence index. A computing platform may load a corpus of documents associated with a user. Subsequently, the computing platform may create a first plurality of smart groups based on the corpus of documents, and then may generate a first user interface comprising a representation of the first plurality of smart groups. Next, the computing platform may receive user input applying one or more labels to a plurality of documents associated with at least one smart group. Subsequently, the computing platform may create a second plurality of smart groups based on the corpus of documents and the received user input. Then, the computing platform may generate a second user interface comprising a representation of the second plurality of smart groups.
Aspects of the disclosure relate to dynamic cybersecurity event detection and training functions. A computing platform may monitor a plurality of user devices to detect a cybersecurity training triggering event. In response to the detection, one or more cybersecurity training session prompts may be generated and transmitted to one or more user devices. User input providing a response to the cybersecurity training session prompt may be evaluated for accuracy and scored for the cybersecurity training session. In some examples, an overall cybersecurity score for a user may be maintained and modified based on the score for the cybersecurity training session. One or more modifications may be identified and executed based on the scores generated.
G09B 19/00 - Teaching not covered by other main groups of this subclass
G09B 7/02 - Electrically-operated teaching apparatus or devices working with questions and answers of the type wherein the student is expected to construct an answer to the question which is presented or wherein the machine gives an answer to the question presented by the student
Systems and methods for privacy-preserving transformer model training are provided. The system includes one or more data repositories in a computer network or cloud infrastructure having data stored therein. The system anonymizes the data in the one or more documents, and trains a transformer model on the data outside of the network. The data includes sensitive information. Anonymizing the data includes extracting the data from the one or more documents and irreversibly transforming the data in the one or more documents into context-preserving tensors. Training the transformer model on the data comprises using the context-preserving tensors instead of the data to train the transformer model on the data.
Aspects of the disclosure relate to dynamically generating simulated attack messages configured for annotation by users as part of cybersecurity training. A computing platform may generate a simulated attack message including a plurality of elements and send the simulated attack message to an enterprise user device. Subsequently, the computing platform may receive, from the enterprise user device, user selections annotating selected elements of the plurality of elements of the simulated attack message. The computing platform may thereafter identify one or more training areas for the user based on the user selections received from the enterprise user device, generate a customized training module specific to the identified one or more training areas, and send the customized training module to the enterprise user device. Sending the customized training module to the enterprise user device may cause the enterprise user device to display the customized training module.
Aspects of the disclosure relate to providing a flexible and automated system for automatically detecting when emails include harmful content, flagging the emails, providing interactive reporting functionality, and providing follow-up enforcement actions to protect users. A computing platform may intercept an email in transit to an email server. Subsequently, the computing platform may analyze the email and generate at least one unique link for reporting suspicious content associated with the email. Next, the computing platform may generate an email warning tag comprising text information and the at least one unique link for reporting the suspicious content associated with the email. Then, the computing platform may inject the email warning tag into the email to produce a modified email comprising content from the email and the email warning tag, and may send the modified email to the email server.
A method for identity unification in an organization network, including correlating activity across disparate cloud-based and on-premises identity access and management platforms, including identifying, across the multiple cloud-based and on-premises identity access and management platforms, shared unique identifiers between identities, identifying, across the multiple cloud-based and on-premises identity access and management platforms, prefixes or suffixes within usernames based on naming conventions, parsing configuration data, to match users with their corresponding roles across the multiple cloud-based and on-premises identity access and management platforms, and discovering, across the multiple cloud-based and on-premises identity access and management platforms, cross-referenced sessions and profiles residing on a device that represent the same person.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
8.
Executing Real-Time Message Monitoring to Identify Potentially Malicious Messages and Generate Instream Alerts
Aspects of the disclosure relate to identifying potentially malicious messages and generating instream alerts based on real-time message monitoring. A computing platform may monitor a plurality of messages received by a messaging server associated with an operator. Subsequently, the computing platform may detect that a message of the plurality of messages is potentially malicious. In response to detecting that the message of the plurality of messages is potentially malicious, the computing platform may execute one or more protection actions. In executing the one or more protection actions, the computing platform may generate an alert message comprising information indicating that the message of the plurality of messages is potentially malicious. Then, the computing platform may send the alert message to the messaging server, which may cause the messaging server to deliver the alert message to a computing device associated with an intended recipient of the message.
Aspects of the disclosure relate to automated simulated phishing lure generation for cybersecurity training. The computing platform may receive personalization data. The computing platform may generate, using a phishing lure generation model, one or more simulated synthetic phishing lures based on the personalization data. The computing platform may send the one or more simulated synthetic phishing lures to one or more user devices and one or more commands directing the one or more user devices to display the one or more simulated synthetic phishing lures, which may cause the one or more user devices to display the one or more simulated synthetic phishing lures. The computing platform may receive, from the one or more user devices, feedback data corresponding to user interactions with the simulated one or more synthetic phishing lures. The computing platform may update, using the feedback data, the phishing lure generation model.
42 - Scientific, technological and industrial services, research and design
Goods & Services
Providing on-line non-downloadable software for performing agentic tasks; Providing on-line non-downloadable software for enterprise software featuring agentic artificial intelligence for following up and responding to IT security events; Providing on-line non-downloadable software using artificial intelligence (AI) for natural language processing, generation, understanding and analysis of text and data; Software as a service (SAAS) services featuring software using artificial intelligence (AI) for performing agentic tasks; Software as a service (SAAS) services featuring software using artificial intelligence (AI) for natural language processing, generation, understanding and analysis of text and data; Artificial intelligence as a service (AIAAS) services featuring software using artificial intelligence (AI) for performing agentic tasks; Software as a service (SAAS) services featuring software for enterprise featuring agentic artificial intelligence for following up and responding to IT security events; Software as a service (SAAS) services featuring software for facilitating agentic workflows using artificial intelligence; Platform as a service (PAAS) featuring computer software platforms for enterprise featuring agentic artificial intelligence for following up and responding to IT security events; Platform as a service (PAAS) featuring computer software platforms for using artificial intelligence (AI) for performing agentic tasks; Platform as a service (PAAS) featuring computer software platforms for facilitating agentic workflows using artificial intelligence
11.
Preventing Disclosure of Sensitive Information In Attempts to Utilize Generative Artificial Intelligence (AI) Through a Web Browser Interface
A computer-implemented method is described for controlling disclosure of sensitive information to a remote network destination includes displaying a webpage on a graphical user interface of a computer with a web browser, receiving a data entry (e.g., a prompt for a generative artificial intelligence tool at the remote network destination) in a text box on the webpage at the computer, comparing the webpage's uniform resource locator to configuration information (e.g., that includes a list of web resources) stored in memory on the computer, and determining whether to scan the data entry for sensitive information (and potentially block transmission of the data entry) depending on whether the comparison identifies a match between the URL and the configuration information.
A computer-implemented method is disclosed for controlling the disclosure (e.g., flow) of sensitive information from a document in a computer application running on a computer endpoint device to a tool (e.g., a generative artificial intelligence tool) hosted at a remote network destination. The application is configured to selectively enable or disable in-line access to the remote generative artificial intelligence tool from within the document. The method includes receiving a notification (e.g., at a computer-implemented endpoint agent) that a document has been opened in the application, obtaining text from the open document, determining (e.g., with a computer-implemented scanning engine) whether the text from the open document contains sensitive information based, at least in part, on content of the text, and disabling the in-line access to the generative artificial intelligence tool at the application in response to determining that the content of the text from the open document contains sensitive information.
A computer-implemented method is disclosed that includes receiving a notification that a submit option has been selected on a chat interface to a tool (e.g., a generative artificial intelligence (AI) tool) hosted at a remote network destination, cancelling the transmission of text from the chat interface to the generative AI tool is canceled in response to the notification. Text, initially intended to be submitted to the generative artificial intelligence tool from the chat interface, is obtained and scanned to determine whether the content of the text contains sensitive information. Typically, this determination is made based, at least in part, on the content of the text. Depending on an outcome of the determination, the computer either enables or prevents transmittal of the text from the chat interface to the generative artificial intelligence tool. If enabled, the computer typically and automatically reselects the submit option (without further involvement from the user).
A method for document classification is described. A first dataset of labeled corporate data, a second dataset of internal labeled documents for a customer, and a third dataset of unlabeled documents for the customer are obtained. A classification model is trained using the first dataset. The classification model is further trained using the second dataset. Feature extraction is performed on each of the unlabeled documents of the third dataset by vectorizing content and metadata of each unlabeled document into one or more vectors and concatenating the one or more vectors to obtain a fixed length vector. Each of the unlabeled documents of the third dataset is clustered into one or more clusters based on similarity between the fixed length vectors for each unlabeled document. The unlabeled documents in each of the clusters are automatically labeled using text summarization. The classification model is retrained using the automatically labeled documents.
G06F 18/2415 - Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on parametric or probabilistic models, e.g. based on likelihood ratio or false acceptance rate versus a false rejection rate
Aspects of the disclosure relate to spear phishing simulation using machine learning. A computing platform may send, to an enterprise user device, a spear phishing message. The computing platform may receive initial user interaction information indicating how a user of the enterprise user device interacted with the spear phishing message. Based on the initial user interaction information and using a series of branching message templates, the computing platform may generate additional spear phishing messages. The computing platform may receive additional user interaction information indicating how the user interacted with the additional spear phishing messages. Based on the initial user interaction information and the additional user interaction information, the computing platform may compute spear phishing scores. Based on a comparison of the spear phishing scores to spear phishing thresholds, the computing platform may generate training modules for the user, and may send the training modules to the enterprise user device.
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
The technology disclosed relates to systems and methods for analyzing data posture in a computing environment. In one example, a computer-implemented method includes identifying one or more computing services in a target computing environment to scan for data posture analysis, obtaining an access permission corresponding to the one or more computing services in the target computing environment, and deploying, to a scanner cloud environment that is distinct from the target computing environment, a scanner in accordance with a scanner definition and based on the access permission corresponding to the one or more computing services. The method includes obtaining a scanner result from the scanner deployed to the scanner cloud environment. The scanner result represents a scan of storage resources in the one or more computing services in the target computing environment using the access permission. The method further includes generating a data posture analysis result based on the scanner result.
Aspects of the disclosure relate to generating threat intelligence information. A computing platform may receive forensics information corresponding to message attachments. For each message attachment, the computing platform may generate a feature representation. The computing platform may input the feature representations into a neural network, which may result in a numeric representation for each message attachments. The computing platform may apply a clustering algorithm to cluster each message attachments based on the numeric representations, which may result in clustering information. The computing platform may extract, from the clustering information, one or more indicators of compromise indicating that one or more attachments corresponds to a threat campaign. The computing platform may send, to an enterprise user device, user interface information comprising the one or more indicators of compromise, which may cause the enterprise user device to display a user interface identifying the one or more indicators of compromise.
Aspects of the disclosure relate to anomaly detection in cybersecurity training modules. A computing platform may receive information defining a training module. The computing platform may capture a plurality of screenshots corresponding to different permutations of the training module. The computing platform may input, into an auto-encoder, the plurality of screenshots corresponding to the different permutations of the training module, wherein inputting the plurality of screenshots corresponding to the different permutations of the training module causes the auto-encoder to output a reconstruction error value. The computing platform may execute an outlier detection algorithm on the reconstruction error value, which may cause the computing platform to identify an outlier permutation of the training module. The computing platform may generate a user interface comprising information identifying the outlier permutation of the training module. The computing platform may send the user interface to at least one user device.
42 - Scientific, technological and industrial services, research and design
Goods & Services
Providing on-line non-downloadable software for for cybersecurity education and employee training; Providing a website featuring non-downloadable software for for cybersecurity education and employee training
20.
COMPUTING SYSTEM DATA POSTURE ANALYSIS USING SIGNATURE ENCODERS WITH SIMILARITY QUERIES
The technology disclosed relates to a computer-implemented method for detecting data posture of a computing environment. The method includes performing a scan of one or more data structures, detecting a plurality of classified data substructures based on the scan of the one or more data structures and, for each respective data substructure, transforming a plurality of data items from the respective data substructure into a respective data substructure signature using a signature encoder. The method includes applying a similarity query to identify a set of data substructures, from the plurality of classified data substructures, having a threshold level of similarity based on data substructure signatures associated with the set of data substructures.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
G06F 16/25 - Integrating or interfacing systems involving database management systems
21.
Distributed Attribute Based Access Control as means of Data Protection and Collaboration in Sensitive (Personal) Digital Record and Activity Trail Investigations
A distributed system provides access by a principal to a resource associated with sensitive data. Micro-services in communication with an authorization engine each include a resource provider that receives a resource action request from the principal to access the resource, determines a context for the request, and transmits the context to the authorization engine in an authorization request. The authorization engine receives the authorization request, resolves the authorization request context against a plurality of pre-defined resource conditions, and responds to the resource provider with an authorization response of allow, deny, or allow-with-conditions. The context for the request includes metadata regarding attributes of the principal, and each of the resource conditions includes a logical expression operating upon the attributes.
Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive a uniform resource locator (URL). The computing platform may parse and/or tokenize the URL to reduce the URL into a plurality of components. The computing platform may identify human-engineered features of the URL. The computing platform may compute a vector representation of the URL to identify deep learned features of the URL. The computing platform may concatenate the human-engineered features of the URL to the deep learned features of the URL, resulting in a concatenated vector representation. By inputting the concatenated vector representation of the URL to a URL classifier, the computing platform may compute a phish classification score. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.
The technology disclosed relates to a system and method for detecting risk events in a cloud environment that obtains a set of risk signature definitions and deploys an event log scanner to the cloud environment. The event log scanner is configured to detect instances of candidate risk events in accordance with the set of risk signature definitions based on a scan of an event log and to label each detected instance with a signature identifier. Result metadata is received indicative of the detected instances. A cloud infrastructure graph is accessed that defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources. Context information is derived from the cloud infrastructure graph based on the result metadata. An output is generated representing a classification of one or more of the detected instances of candidate risk events as a risk event based on the context information relative to the set of risk signature definitions.
09 - Scientific and electric apparatus and instruments
42 - Scientific, technological and industrial services, research and design
Goods & Services
downloadable software suite featuring cybersecurity software, e-mail threat protection and intelligence software, cyber threat detection, prevention, and response software, software for digital impersonation protection, and software for cybersecurity education and employee training. Providing online non-downloadable software suite, namely, software as a service (SaaS) featuring cybersecurity software, e-mail threat protection and intelligence software, cyber threat detection, prevention, and response software, software for digital impersonation protection, and software for cybersecurity education and employee training; Providing online non-downloadable software suite, namely, platform as a service (PaaS) featuring cybersecurity software, e-mail threat protection and intelligence software, cyber threat detection, prevention, and response software, software for digital impersonation protection, and software for cybersecurity education and employee training
09 - Scientific and electric apparatus and instruments
41 - Education, entertainment, sporting and cultural services
42 - Scientific, technological and industrial services, research and design
Goods & Services
Downloadable and recorded computer software for searching, detecting, blocking, filtering, tagging, compiling, indexing, analyzing, and reporting on information over and in information networks, global information networks, individual workstations, personal computers, software, e-mail, and workgroup communications; Downloadable computer software for internet and network security, cyber threat detection and prevention, and secure and safe browsing Providing web-based, virtual, and in-person training courses in the fields of cybersecurity and IT Computer security service, namely, restricting access to and by computer networks to and of undesired web sites, media and individuals and facilities; Providing information in the field of cybersecurity via a website; Application service provider featuring application programming interface (API) software; Providing online non-downloadable software suite featuring platform as a service (PaaS) and software as a service (SaaS) all featuring cybersecurity software, e-mail threat protection and intelligence software, cyber threat detection, prevention, and response software, software for digital impersonation protection, system administration, monitoring, testing, analyzing, and reporting on internet traffic control and content control of the web sites of others, email filtering, and software for cybersecurity education and employee training; Platform as a service (PAAS) featuring computer software platforms using machine learning and artificial intelligence for real-time threat intelligence, risk analysis and identifying, preventing and mitigating risk to IT infrastructure, computer systems, email systems, and data systems from human and digital threats; Platform-as-a-Service (PaaS) and Software as a Service (SaaS) featuring computer software that aggregates and correlates threat data points across email, the cloud, mobile, local, and outside computer networks and uses a combination of advanced machine learning and artificial intelligence to detect and prevent cybersecurity attacks, software for comprehensive threat intelligence featuring artificial intelligence, software for detecting, analyzing, and monitoring cybersecurity threats, software for obtaining and navigating threat intelligence, running threat assessments on cloud storage, local networks, email, mobile, and social channels, and orchestrating response actions.
26.
Automatic risk remediation in multi-cloud environment
The technology disclosed relates to analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system and method of risk event detection and remediation. An event is detected in a cloud environment and a pre-defined risk signature is obtained that identifies one or more entities in the cloud environment and represents an instance of a risk event relative to the one or more entities. The pre-defined risk signature includes a reference to a remediation workflow having one or more commands for one or more remediation actions in the cloud environment. Th pre-defined risk signature is determined to have a threshold match to the event and, based on the determination that the pre-defined risk signature has a threshold match to the event, the remediation workflow is obtained based on the reference. The one or more commands are executed in the cloud environment.
The technology disclosed relates to a system and method for detecting risk events in cloud environment that obtains set of risk signature definitions and deploys an event log scanner to the cloud environment. The event log scanner is configured to detect instances of candidate risk events in accordance with the set of risk signature definitions based on a scan of event log and to label each detected instance with a signature identifier that identifies one or more risk signatures that corresponds to the detected instance. Result metadata is received indicative of the detected instances, based on the result metadata, context information associated with the detected instances is obtained based on cloud infrastructure graph. An output is generated representing a classification of one or more of the detected instances of candidate risk events as a risk event based on the context information relative to the set of risk signature definitions.
The technology disclosed relates to analysis of security posture of a cloud environment that invokes an incremental change detector to perform an infrastructure scan of the cloud environment and return a scan result that identifies one or more changes to one or more infrastructure assets in the cloud environment. The scan result includes, for each particular change in the one or more changes, first information indicative of the particular change. A data scan is constrained to the one or more infrastructure assets having the one or more changes and second information associated with the one or more changes is obtained based on the data scan. A cloud infrastructure graph is updated based on one or more of the first information or the second information. The cloud infrastructure graph defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources.
The disclosed technology receives a control input identifying a sampling criterion for classifying a data store storing a set of data objects in a computing environment as corresponding to a target data type and deploys one or more scanners configured to select a representative subset of data objects, from the set of data objects, based on the sampling criterion. A scanner result generated by the one or more scanners is received that represents detected instances, in the representative subset of data objects, of one or more pre-defined data patterns of the target data type. A classification result is generated based on a comparison of the number of detected instances of the one or more pre-defined data patterns to a threshold. The classification result represents a classification of the data store as having correspondence to the target data type. A computing action is performed based on the classification result.
The technology disclosed relates to detection of data traffic in computing environments, such as cloud environments. Example systems and methods detect a plurality of workloads in a virtual network in a computing environment and deploy a plurality of probe agents to the plurality of workloads. Each respective probe agent detects network traffic on a respective workload of the plurality of workloads, scans a data packet that is at least one of sent or received by the respective workload, generates a data classification relative to the data packet, and generates a scan result that includes packet payload information and an indication of the data classification. The scan results are received from the plurality of probe agents and a computing action is performed based on scan results.
A computer-implemented method includes detecting occurrence of an event in a cloud environment, obtaining an indication of an identity associated with the event, obtaining an indication of a usage time stamp representing usage time of a privilege in association with the identity for the event, and classifying the privilege into a classification group selected from a plurality of predefined classification groups. Each respective classification group groups a respective set of privileges defined in the cloud environment. The method includes obtaining a grant time stamp representing a grant time of at least one privilege, in the respective set of privileges in the classification group, to the identity and, based on the usage time stamp and the grant time stamp, generating an excessive privilege determination that indicates the classification group includes at least one excessive privilege. The method includes performing a computing action based on the excessive privilege determination.
The technology disclosed relates to analysis of data posture of a cloud environment. In particular, disclosed technology relates to a system and method for analyzing cloud assets, such as storage resources, compute resources, etc. to detect peak signals based on occurrences of sensitive data types or other data classifications in cloud assets. A computing system is configured to access data in plurality of cloud resources and, on a cloud resource-by-cloud resource basis, attribute a plurality of data sensitivity parameters to the data in a given cloud resource of the plurality of cloud resources, and generate a peak value indicating an appraisal of the data in given cloud resource based on the plurality of data sensitivity parameters attributed to the data. A graphical interface includes graphical objects configured to visually represent plurality of cloud resources, plurality of data sensitivity parameters, and the peak values generated for the plurality of cloud resources.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
H04L 29/06 - Communication control; Communication processing characterised by a protocol
33.
Database log analyzer in a cloud environment using microservice orchestration
The technology disclosed relates to analysis of security posture of a cloud environment. A computing system is configured to automatically discover a plurality of databases in the cloud environment and configure an orchestration engine to deploy a plurality of log analyzer microservices on the plurality of databases. Each log analyzer microservice, of the plurality of log analyzer microservices, is configured to scan a respective database log that represents database activities on a respective database of the plurality of databases. Analysis results are received from the plurality of log analyzer microservices. The analysis results represent detection of at least one of a performance criterion or a security criterion in one or more databases of the plurality of databases. An action signal representing the analysis results is generated.
42 - Scientific, technological and industrial services, research and design
Goods & Services
Computer services, namely, computer system administration for others; Cybersecurity services in the nature of restricting unauthorized access to computer systems; providing a platform as a service (PAAS) featuring computer software for information technology (IT) security; Computer services, namely, monitoring, testing, analyzing, and reporting on the Internet traffic control and content control of the web sites of others; Platform as a service (PAAS) featuring computer software platforms for the identification, detection, prevention, management, mitigation, and analysis of threats to IT infrastructure, computer systems, email systems, and data systems; Computer systems integration services; Computer services, namely, integration of computer software into multiple systems and networks; Platform-as-a-Service (PaaS) featuring computer software that aggregates and correlates threat data points across email, the cloud, mobile, local, and outside computer networks and uses a combination of advanced machine learning and artificial intelligence to detect and prevent cybersecurity attacks; Platform as a service (PAAS) featuring software for detecting, analyzing, and monitoring cybersecurity threats; Platform-as-a-service (PaaS) featuring computer software for obtaining and navigating threat intelligence, running threat assessments on cloud storage, local networks, email, mobile, and social channels, and orchestrating response actions; Computer security service, namely, restricting access to and by computer networks to and of undesired web sites, media and individuals and facilities; Platform as a service (PAAS) featuring computer software for risk analysis; Computer services, namely, filtering of unwanted e-mails; Platform as a service (PAAS) featuring computer software for comprehensive threat intelligence featuring artificial intelligence, [ ? ] machine learning and real-time threat intelligence; Platform as a service (PAAS) featuring computer software for conducting risk analysis and identifying, preventing and mitigating risk to computer systems from human and digital threats
42 - Scientific, technological and industrial services, research and design
Goods & Services
Computer services, namely, computer system administration for others excluding medical utilization review services; Cybersecurity services in the nature of restricting unauthorized access to computer systems; computer services, namely, IT security provided via platform as a service featuring computer software platforms for cybersecurity; Computer services, namely, monitoring, testing, analyzing, and reporting on the Internet traffic control and content control of the web sites of others; Platform as a service (PAAS) featuring computer software platforms for the identification, detection, prevention, management, mitigation, and analysis of threats to IT infrastructure, computer systems, email systems, and data systems; Computer systems integration services excluding medical utilization review services; Computer services, namely, integration of computer software into multiple systems and networks excluding medical utilization review services; Platform-as-a-Service (PaaS) featuring computer software that aggregates and correlates threat data points across email, the cloud, mobile, local, and outside computer networks and uses a combination of advanced machine learning and artificial intelligence to detect and prevent cybersecurity attacks; Platform as a service (PAAS) featuring software for detecting, analyzing, and monitoring cybersecurity threats; Platform-as-a-service (PaaS) featuring computer software for obtaining and navigating threat intelligence, running threat assessments on cloud storage, local networks, email, mobile, and social channels, and orchestrating response actions; Computer security service, namely, restricting access to and by computer networks to and of undesired web sites, media and individuals and facilities; Platform as a service (PAAS) featuring computer software for risk analysis; Computer services, namely, filtering of unwanted e-mails; Platform as a service (PAAS) featuring computer software for comprehensive threat intelligence featuring artificial intelligence, machine learning and real-time threat intelligence; Platform as a service (PAAS) featuring computer software for conducting risk analysis and identifying, preventing and mitigating risk to computer systems from human and digital threats
The technology disclosed relates to analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system and method for analysis of infrastructure posture of a cloud environment, that include detecting a triggering criterion corresponding to initiation of an update scan of the infrastructure posture of the cloud environment, and invoking an incremental change detector based on the triggering criterion. The incremental change detector is configured to scan the cloud environment and return a scan result that identifies one or more changes to a set of infrastructure assets in the cloud environment within a selected time period. A cloud infrastructure graph is updated based on the one or more changes to the set of infrastructure assets, wherein the cloud infrastructure graph defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources.
The technology disclosed relates to resource activity management in a cloud environment. A computer-implemented method includes detecting a plurality of virtual networks in the cloud environment and deploying a plurality of sensors in the plurality of virtual networks using an orchestration engine of the cloud environment. Each sensor, of the plurality of sensors, includes an executable package configured to execute in a respective virtual network, of the plurality of virtual networks, independent of other sensors, of the plurality of sensors, to manage activities in the respective virtual network. The method includes identifying an activity management task to be performed in a particular virtual network of the plurality of virtual networks, sending a task command representing the activity management task to the sensor deployed in the particular virtual network, and receiving an execution result representing execution of the activity management task by the sensor deployed in the particular virtual network.
The technology disclosed relates to analysis of data posture of a cloud environment. In particular, the disclosed technology relates to a system and method for analyzing cloud assets, such as storage resources, compute resources, etc. to detect peak signals based on occurrences of sensitive data types or other data classifications in the cloud assets. A system for prioritized presentation of high-value cloud resources susceptible to cloud security risks includes a processor, a display, and memory accessible by the processor and executable to, on a cloud resource-by-cloud resource basis, analyze data in a given cloud resource, and attribute a plurality of data sensitivity parameters to the data in the given cloud resource, and a peak value indicating an appraisal of the data in the given cloud resource. A graphical interface includes graphical objects configured to display the given cloud resource, the plurality of data sensitivity parameters, and the peak value.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
H04L 29/06 - Communication control; Communication processing characterised by a protocol
40.
Identifying threat similarity using forensics clustering
Systems, methods and products for identifying “similar” threats by clustering the threats based on corresponding forensics. A corpus of forensic data for a plurality of threat URLs is obtained by a threat protection system, the data including forensic elements corresponding to each threat URLs. For each pair of threat URLs, the corresponding forensic elements are examined to identify shared forensic elements. A similarity score is then generated for the pair of threat URLs based on the comparison of the corresponding forensic elements, including both malicious and non-malicious elements. Based on the similarity score generated for each pair of threat URLs, clusters of the threat URLs are identified, with each cluster including a subset of the plurality of threat URLs. Clusters of URLs similar to a selected URL may be identified by accessing the threat cluster information using a similar-threat search interface or through internal APIs of the threat protection system.
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to accessing permissions data and access control data for pairs of compute resources and storage resources, tracing network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data, accessing sensitivity classification data for objects in the storage resources, and qualifying a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack based on an evaluation of the permissions data, the access control data, and the sensitivity classification data against at least one risk criterion. A representation of propagation of the breach attack along the network communication paths is generated, the representation identifying relationships between the subset of the pairs of the compute resources and the storage resources.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules
The technology disclosed relates to a computing system configured to execute a cloud scanner in a cloud environment to discover one or more data stores in the cloud environment and return metadata representing a data schema of data objects in the one or more data stores, traverse the data objects in the one or more data stores based on the metadata to identify a plurality of data items, execute a content-based data classifier against the plurality of data items to identify a set of data items, in the plurality of data items, as conforming to one or more data profiles, and generate a graphical interface including one or more graphical objects configured to display a representation of the one or more data profiles, wherein the graphical interface is configured to filter the plurality of data items based on a selected data profile selected from the one or more data profiles.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules
43.
Cloud environment database log analyzer with risk signature detection
The technology disclosed relates to analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system and method that detects a triggering criterion and, in response to the triggering criterion, automatically discovers a plurality of databases in the cloud environment. An orchestration engine is configured to deploy a plurality of log analyzer microservices on the plurality of databases, each log analyzer microservice, of the plurality of log analyzer microservices, being configured to scan a respective database log that represents database activities on a respective database of the plurality of databases. Analysis results are received from the plurality of log analyzer microservices, the analysis results represent detection of at least one of a performance criterion or a security criterion in one or more databases of the plurality of databases. An action signal representing the analysis results is generated.
A URL velocity monitor is integrated with a message-hold decision maker of an electronic mail processing system that processes electronic messages for a protected computer network. The URL velocity monitor receives or obtains a URL, decomposes the URL into URL features based on logical boundaries, and determines features of interest from the URL features for velocity tracking. Examples of URL features can include a randomized URL segment. The velocity of each feature of interest is tracked over a period of time using a counting algorithm that employs a slow counter or a fast counter. The two different counters track two types of velocities which represent different domain behaviors targeting the protected computer network. The URL velocity monitor determines whether the velocity of a feature of interest is accelerating within the time period. If so, the URL is placed in a queue or a sandbox.
Threat detection systems and methods in which feature syntax language (FSL) statements are used to define functions that generate features corresponding to detected text within textual non-attachment, non-URL input data. Generated features are aggregated in a core object, and classification rules are applied to the core object to determine a threat classification and theme associated with the input data. Using FSL statements and classification rules enable the system to rapidly generate thematic threat classifications identifying socially engineered attacks. A user interface enables users to rapidly update the FSL statements that define the functions used to generate the features, as well as the threat classification rules that are applied to the features in the core object to classify the input data. The modified statements and rules can be immediately used by the system.
A system preventing upload of a source file to an upload destination includes a computer, a user application, and an agent application. The agent registers for a notification of a user interface action with the computer operating system (OS), and receives notice from the OS of the user interface action associated with the registering. The agent determines the user interface action is indicative of a data file upload operation of a source file to an upload destination. The agent compares a property of the source file and a property of the upload destination to a blocking criteria and prevents the user application from receiving the user interface action. The user interface action includes detection by the OS of a user interaction with a controller of a graphical user interface pointer and/or a pressing of one or more keys on a keyboard user interface.
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system that analyzes data posture in a cloud environment database using a snapshot of the database. A computer-implemented method includes receiving a request to access a database in the cloud environment, wherein the database includes a first authentication requirement. The method includes identifying a snapshot of the database, wherein the snapshot includes a second authentication requirement that is different than the first authentication requirement. The method includes accessing the snapshot using the second authentication requirement, generating a representation of the database using the snapshot, and generating a data posture analysis result indicative of a data posture of the database based on scanning the representation of the database.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules
A computer system detects whether a new document has been opened at a user computer on the computer system. The system includes a user computer, a user application accessible by a human user at the user computer, and an agent application hosted by the user computer. The agent is configured to register to receive notifications of user interface actions with an operating system (OS) of the user computer. The agent receives a notification from the OS of a user interface action, and determines whether a new document was opened at a display screen of the user computer by the user interface action.
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a graphical query builder for generating a subject path signature, for example representing a vulnerability path in the cloud environment. A computer-implemented method includes generating a graphical user interface having configurable node elements and edge elements and, in response to user input on the graphical user interface, configuring the node elements to represent entities in a subject path signature in the cloud environment and the edge elements to represent relationships between the entities in the subject path signature. The method also includes generating a query representing the subject path signature, executing the query to qualify a set of network paths in the cloud environment as conforming to the subject path signature, and outputting query results identifying the qualified set of network paths.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules
50.
Compact cloud access network based on role-to-resource detection with resource state change tracking and provenance
A system for streamlined analysis of access sub-networks in a cloud environment is disclosed. The system comprises memory storing access sub-networks in a cloud environment between a plurality of resources and a plurality of users, memory storing user-to-role mappings for roles assigned to the plurality of users, and accumulation logic having access to the access sub-networks and to the user-to-role mappings. The accumulation logic is configured to traverse the access sub-networks to build a number U user-to-resource mappings between the plurality of users and the plurality of resources, and evaluate the U user-to-resource mappings against the user-to-role mappings to accumulate a number R role-to-resource mappings between the roles and the plurality of resources.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules
51.
DETECTING INSIDER USER BEHAVIOR THREATS BY COMPARING A CURRENT (LATEST) USER ACTIVITY TO USER ACTIVITIES OF OTHERS
A computer method detect internal user behavior threats by recording user activity data at endpoints on a computer network associated with a tenant, generating a sampled activity matrix for each user, grouping users from the tenant into clusters based on similarity, assigning a user activity weight to each activity-set, creating a ranked list of the user activity-sets for all users within the tenant, computing a user behavior vector for each respective one of the users in the tenant, and comparing the user behavior vector for a particular one of the users in the tenant to other users in the tenant to determine whether the user behavior vector indicates that the user behavior deviates beyond a threshold amount from the other users in the tenant, and, if so, creating an internal user behavior threat notification that may, for example, prompt a real world response.
G06F 11/34 - Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation
G06F 21/55 - Detecting local intrusion or implementing counter-measures
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
52.
DETECTING INSIDER USER BEHAVIOR THREATS BY COMPARING A USER'S BEHAVIOR TO THE USER'S PRIOR BEHAVIOR
A computer method includes recording user activity data at endpoints on a computer network, generating a sampled activity matrix representing occurrences of activity-sets performed by the user over multiple time windows, computing a user activity weight for each activity-set based on a variance over the time windows, computing a historical user activity score and a contextual user activity score, computing a user behavior vector and user behavior score, using the user behavior scores to detect a deviation beyond a threshold amount from a baseline behavior for the user; creating an internal user behavior threat notification in response to detecting a deviation beyond the threshold amount and, optionally, taking real world steps, as a human, to react to the threat notification.
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to accessing permissions data and access control data for pairs of compute resources and storage resources in the cloud environment, tracing network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data, accessing sensitivity classification data for objects in the storage resources, qualifying a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack based on an evaluation of the permissions data, the access control data, and the sensitivity classification data against a set risk criterion, and generating a representation of propagation of the breach attack along the network communication paths, the representation identifying relationships between the subset of the pairs of the compute resources and the storage resources.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules
54.
System and methods for reducing an organization's cybersecurity risk by determining the function and seniority of employees
Systems, methods, and apparatuses directed to implementations of an approach and techniques for more effectively preparing for, detecting, and responding to cybersecurity threats directed at people or at groups of people. Embodiments are directed to classifying or segmenting employees by “predicting” what are believed to be two attributes of an employee that contribute to making them at a higher risk of being a target of a cybersecurity attack. These attributes are the employee's seniority level (e.g., employee, contractor, manager, executive, board member) and the employee's primary function or role in an organization (e.g., HR, Legal, Operations, Finance, Marketing, Sales, R&D, etc.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06Q 10/0637 - Strategic management or analysis, e.g. setting a goal or target of an organisationPlanning actions based on goalsAnalysis or evaluation of effectiveness of goals
G06Q 10/0635 - Risk analysis of enterprise or organisation activities
An intelligent clustering system has a dual-mode clustering engine for mass-processing and stream-processing. A tree data model is utilized to describe heterogenous data elements in an accurate and uniform way and to calculate a tree distance between each data element and a cluster representative. The clustering engine performs element clustering, through sequential or parallel stages, to cluster the data elements based at least in part on calculated tree distances and parameter values reflecting user-provided domain knowledge on a given objective. The initial clusters thus generated are fine-tuned by undergoing an iterative self-tuning process, which continues when new data is streamed from data source(s). The clustering engine incorporates stage-specific domain knowledge through stage-specific configurations. This hybrid approach combines strengths of user domain knowledge and machine learning power. Optimized clusters can be used by a prediction engine to increase prediction performance and/or by a network security specialist to identify hidden patterns.
Systems, apparatuses, and methods for more effectively preparing for and responding to cybersecurity threats directed at people or at groups of people. A segmentation process is described that evaluates multiple characteristics of a person that may make them a potential target or that may make a cybersecurity attack on that person more likely to be successful. Based on the segmentation, a security analyst can apply an appropriate risk reduction or security protocol to each person or group of similarly situated people to reduce the likelihood of an attack and/or the likelihood of a successful attack.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a data schema detection system that uses a content-based data classifier to classify data items in a cloud environment. A computer-implemented method includes accessing a data store in the cloud environment and obtaining metadata representing a structure of schema objects in the data store. The method includes executing, based on the metadata, a content-based data classifier to classify data items in the schema objects and outputting a classifier result that represents the classification of the data in the schema objects.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
The technology disclosed relates to streamlined analysis of infrastructure posture of a cloud environment. In particular, it relates to accessing permissions data and access control data for pairs of compute resources and storage resources in the cloud environment, tracing network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data, and constructing a cloud infrastructure map that graphically depicts the pairs of the compute resources and the storage resources as nodes, and the network communication paths as edges between the nodes.
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a graphical query builder for generating a subject path signature, for example representing a vulnerability path in the cloud environment. A computer-implemented method includes generating a graphical user interface having configurable node elements and edge elements and, in response to user input on the graphical user interface, configuring the node elements to represent entities in a subject path signature in the cloud environment and the edge elements to represent relationships between the entities in the subject path signature. The method also includes generating a query representing the subject path signature, executing the query to qualify a set of network paths in the cloud environment as conforming to the subject path signature, and outputting query results identifying the qualified set of network paths.
G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system that analyzes data posture in a cloud environment database using a snapshot of the database. A computer-implemented method includes receiving a request to access a database in the cloud environment, wherein the database includes a first authentication requirement. The method includes identifying a snapshot of the database, wherein the snapshot includes a second authentication requirement that is different than the first authentication requirement. The method includes accessing the snapshot using the second authentication requirement, generating a representation of the database using the snapshot, and generating a data posture analysis result indicative of a data posture of the database based on scanning the representation of the database.
H04L 9/06 - Arrangements for secret or secure communicationsNetwork security protocols the encryption apparatus using shift registers or memories for blockwise coding, e.g. D.E.S. systems
The technology disclosed relates to in-cloud, constant time content scanning. In particular, it relates to obtaining administrative access to a cloud environment account for bulk content scanning of storage resources, and deploying serverless, containerized scanners to run locally on the cloud environment account, including queuing objects in the cloud environment account, partitioning the objects into a plurality of object chunks, and depending upon a M number of object chunks in the plurality of object chunks, initializing a N number of instances of the serverless, containerized scanners, where M>>N. Each initialized serverless, containerized scanner scans a corresponding object chunk exactly once to detect a multiplicity of different data patterns.
A system and methods for determining the degree to which a vendor, supplier, or company's compliance or lack of compliance with a specific regulation or requirement contributes to, or could contribute to, the cybersecurity risk of an organization whose employees use that company's products or services. This source of risk may be evaluated for a plurality or set of vendors to determine an estimated total risk arising this source or set of sources. In response to evaluating the degree or level of this source of risk, the system and methods can be used to determine or select the apprFinal opriate security process or protocol that should be applied to employees, devices, systems, and networks to limit the risk to the organization.
G06Q 10/0637 - Strategic management or analysis, e.g. setting a goal or target of an organisationPlanning actions based on goalsAnalysis or evaluation of effectiveness of goals
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to accessing permissions data and access control data for pairs of compute resources and storage resources in the cloud environment, tracing network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data, accessing sensitivity classification data for objects in the storage resources, qualifying a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack based on an evaluation of the permissions data, the access control data, and the sensitivity classification data against a set risk criterion, and generating a representation of propagation of the breach attack along the network communication paths, the representation identifying relationships between the subset of the pairs of the compute resources and the storage resources.
Systems, methods and products for classifying images according to a visual concept where, in one embodiment, a system includes an object detector and a visual concept classifier, the object detector being configured to detect objects depicted in an image and generate a corresponding object data set identifying the objects and containing information associated with each of the objects, the visual concept classifier being configured to examine the object data set generated by the object detector, detect combinations of the information in the object data set that are high-precision indicators of the designated visual concept being contained in the image, generate a classification for the object data set with respect to the designated visual concept, and associate the classification with the image, wherein the classification identifies the image as either containing the designated visual concept or not containing the designated visual concept.
Systems, methods, and apparatuses directed to efficiently determining whether a device making a request to access an application or service is a managed device and using that information to set an appropriate security policy for the device or the request to access the application or service. In some embodiments, a service or server (referred to as a Managed Device Identification Service) is configured to request a client certificate from a device that is requesting access to a cloud-based application or service as part of a protocol handshake. If a certificate is received, it is compared to a stored certificate to determine if the device is a managed device and as a result, the appropriate security policy.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
66.
System and method for light data file duplication prevention
A system for preventing duplication of a computer source file to a destination file includes a user application accessed by a user of a computer. An agent application hosted by the computer registers for a notification of a user interface action with an operating system (OS) of the computer. The agent receives notice from the OS of the user interface action and determines if the user interface action is indicative of a data file duplication operation of a source file to a destination file location The Agent compares a property of the source file and a property of the destination file location to a blocking criteria, and blocks the user interface action from reaching the application.
G06F 3/0481 - Interaction techniques based on graphical user interfaces [GUI] based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
G06F 16/17 - Details of further file system functions
A query term analytics system receives a search query from a user device. The system has an engine enhanced with the ability to track query terms using in-memory counters and leveraging an inverted index of content stored in a content repository. The search query is run on the content and, contemporaneously the engine performs a query term analysis on the query terms to produce query term analytics. The query term analysis includes an impact analysis that determines an impact of removing a keyword or keyword criteria from the search query. A compressed bitset can be used to indicate whether a keyword is in the content. The engine can accumulate statistics using the in-memory counters while the search query is being processed. Using the statistics thus accumulated, a query term analytics report is generated and provided to the user device for presentation on the user device.
G06F 16/383 - Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually using metadata automatically derived from the content
Systems, methods and products for identifying IP mass hosts and determining whether they are good or bad. One embodiment is a method including selecting a first candidate IP address, identifying a set of domains hosted at the IP address, and identifying registrants of the domains. A number of unique ones of the registrants is determined and if the number of unique registrants exceeds a threshold number, the candidate IP address is deemed an IP mass host. Otherwise, the candidate IP address is deemed not to be an IP mass host. For an IP mass host, domains that have bad reputations are identified, and it is determined whether the bad domains comprise at least a threshold percentage of the total hosted domains. If the IP mass host has at least the threshold percentage of bad domains, the IP mass host is deemed a bad mass host.
H04L 61/5046 - Resolving address allocation conflictsTesting of addresses
H04L 61/4511 - Network directoriesName-to-address mapping using standardised directoriesNetwork directoriesName-to-address mapping using standardised directory access protocols using domain name system [DNS]
H04L 61/4552 - Lookup mechanisms between a plurality of directoriesSynchronisation of directories, e.g. metadirectories
Systems, methods and products for determining the trustworthiness of anonymous sensors, including a sensor health check, a data ballpark check, a reputation comparison, and optional “last resort” procedures. The sensor health check examines sensor operating parameters to see if they fall within an envelope of expected values. If not, the sensor is unhealthy and is not trusted. The data ballpark check determines whether the sensor's traffic data falls within a predefined envelope of values. If the sensor is healthy and the traffic is within expected ranges, the sensor is trusted. If the traffic data is outside expected ranges, the reputation comparison, determines whether IP addresses, domains or other IOCs in the traffic data are found in the reputation list which may corroborate the traffic as trustworthy because it represents malicious or not-in-the-wild traffic. “Last resort” procedures may include applying safelists/blocklists, signature controls etc. to verify sensor/data trustworthiness.
A computer-based method of reducing or limiting data transmissions from a computer to a remote network destination includes receiving an indication, at an agent on a computer, that a recent user activity has occurred at the computer. The indication typically includes data relevant to user context when the user activity occurred. The method further includes determining, with the agent, whether the data relevant to the user's context when the user activity occurred indicates that a change in user context relative to a user activity at the computer immediately prior to the recent user activity and conditioning a transmission of data relevant to the recent user activity from the computer to a remote network destination based on an outcome of the determination.
H04L 9/06 - Arrangements for secret or secure communicationsNetwork security protocols the encryption apparatus using shift registers or memories for blockwise coding, e.g. D.E.S. systems
Aspects of the disclosure relate to detecting and preventing transmission of spam messages using modified source numbers. A computing platform may detect that a first message, sent to a recipient device from a sender device, includes suspicious content. Subsequently, the computing platform may receive, from the recipient device, user interaction information indicating that a user of the recipient device has sent a reply message in response to the first message. Then, the computing platform may generate a modified message by modifying a first source number corresponding to the reply message. Next, the computing platform may cause transmission of the modified message with the modified first source number to the sender device. Thereafter, the computing platform may intercept one or more additional messages between the sender device and the modified first source number and redirect the one or more additional messages.
Aspects of the disclosure relate to detecting and protecting against cybersecurity attacks using unprintable tracking characters. A computing platform may receive a character-limited message sent to a user device. Subsequently, the computing platform may detect that the character-limited message sent to the user device includes suspicious content. Then, the computing platform may generate a modified character-limited message by inserting one or more special characters into the character-limited message and cause transmission of the modified character-limited message to the user device. Next, the computing platform may receive, from the user device, a spam report that includes the modified character-limited message. Then, the computing platform may identify a presence of the one or more special characters included in the modified character-limited message and adjust one or more filters based on the identification.
Aspects of the disclosure relate to providing commercial and/or spam messaging detection and enforcement. A computing platform may receive a plurality of text messages from a sender. It may then tokenize the plurality of text messages to yield a plurality of tokens. The computing platform may then match one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens. Next, it may detect one or more homoglyphs in the plurality of text messages, and then detect one or more URLs in the plurality of text messages. The computing platform may flag the sender based at least on the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs. Based on flagging the sender, the computing platform may block one or more messages from the sender.
Aspects of the disclosure relate to providing secure shortened URLs in character-limited messages. A computing platform may receive one or more character-limited messages sent to a user device. The computing platform may detect a URL within the one or more character-limited messages for replacement and generate a shortened URL corresponding to the detected URL, wherein a domain of the shortened URL is hosted by the message security system. The computing platform may then modify the one or more character-limited messages by replacing the URL with the shortened URL, and then cause transmission of the modified one or more character-limited messages to the user device. Next, the computing platform may receive, from the user device, a request to access the shortened URL, and redirect the user device to the detected URL corresponding to the shortened URL.
Aspects of the disclosure relate to dynamic cybersecurity event detection and training functions. A computing platform may monitor a plurality of user devices to detect a cybersecurity training triggering event. In response to the detection, one or more cybersecurity training session prompts may be generated and transmitted to one or more user devices. User input providing a response to the cybersecurity training session prompt may be evaluated for accuracy and scored for the cybersecurity training session. In some examples, an overall cybersecurity score for a user may be maintained and modified based on the score for the cybersecurity training session. One or more modifications may be identified and executed based on the scores generated.
G09B 19/00 - Teaching not covered by other main groups of this subclass
G09B 7/02 - Electrically-operated teaching apparatus or devices working with questions and answers of the type wherein the student is expected to construct an answer to the question which is presented or wherein the machine gives an answer to the question presented by the student
A system and method monitors access of an external storage device connected to a target device. A notification of a connection of the external storage device to the target device is received, a notification of an external file access on the external storage device is received, and activity of a user on the target device is monitored to detect a user operation accessing a source file stored on the target device. Events are logged based upon the connection, the user operation, and the external file access. Two or more of the events are associated with a copy of the source file to the external connected storage device and the source file history. An alert regarding the association is forwarded to a monitor application in communication with the target device.
G06F 21/53 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by executing in a restricted environment, e.g. sandbox or secure virtual machine
G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
G06F 21/83 - Protecting input, output or interconnection devices input devices, e.g. keyboards, mice or controllers thereof
G06F 21/84 - Protecting input, output or interconnection devices output devices, e.g. displays or monitors
77.
Detecting paste and other types of user activities in computer environment
A computer-based method includes: receiving an indication from a computer's operating system that a user has performed a first action that may have caused a context menu with a paste option to open on a screen of the computer, and subsequently receiving an indication from the computer's operating system that the user has performed a second action at the computer that may have amounted to a selection of the paste option on the context menu. In response to the indication from the computer's operating system that the user has performed the second action, the method includes determining if the second action by the user amounted to a selection of the paste option on the context menu and thereby cause a paste action to occur.
G06F 3/0484 - Interaction techniques based on graphical user interfaces [GUI] for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
G06F 3/0482 - Interaction with lists of selectable items, e.g. menus
G06F 3/0489 - Interaction techniques based on graphical user interfaces [GUI] using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser using dedicated keyboard keys or combinations thereof
78.
System and method for scalable file filtering using wildcards
A system monitors access to a computer file via a dynamically changeable non-heterogeneous collection load balanced across two hash tables. User activity is monitored on a target device to detect a user entered pattern including a wildcard character. A server in communication with the target device, receives the user entered pattern, selects one of the two hash tables, and calculates an index for the selected hash table based on the user entered pattern. The index is used to access the selected hash table to receive a stored pattern. The hash tables each have a plurality of entries, and each entry includes a list of one or more patterns that have the same hash index but different pattern values sorted by length in characters from longest to shortest.
G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
G06F 21/55 - Detecting local intrusion or implementing counter-measures
G06F 21/71 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
G06F 21/46 - Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
G06F 21/78 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
A domain processing system is enhanced with a first-pass domain filter configured for loading character strings representing a pair of domains consisting of a seed domain and a candidate domain in a computer memory, computing a similarity score and a dynamic threshold for the pair of domains, determining whether the similarity score exceeds the dynamic threshold, and iterating the loading, the computing, and the determining for each of a plurality of candidate domains paired with the seed domain. A similarity score between the seed domain and the candidate domain and a corresponding dynamic threshold for the pair are computed. If the similarity score exceeds the corresponding dynamic threshold, the candidate domain is provided to a downstream computing facility. Otherwise, it is dropped. In this way, the first-pass domain filter can significantly reduce the number of domains that otherwise would need to be processed by the downstream computing facility.
H04L 61/30 - Managing network names, e.g. use of aliases or nicknames
H04L 61/4511 - Network directoriesName-to-address mapping using standardised directoriesNetwork directoriesName-to-address mapping using standardised directory access protocols using domain name system [DNS]
80.
USING NEURAL NETWORKS TO PROCESS FORENSICS AND GENERATE THREAT INTELLIGENCE INFORMATION
Aspects of the disclosure relate to generating threat intelligence information. A computing platform may receive forensics information corresponding to message attachments. For each message attachment, the computing platform may generate a feature representation. The computing platform may input the feature representations into a neural network, which may result in a numeric representation for each message attachments. The computing platform may apply a clustering algorithm to cluster each message attachments based on the numeric representations, which may result in clustering information. The computing platform may extract, from the clustering information, one or more indicators of compromise indicating that one or more attachments corresponds to a threat campaign. The computing platform may send, to an enterprise user device, user interface information comprising the one or more indicators of compromise, which may cause the enterprise user device to display a user interface identifying the one or more indicators of compromise.
A domain processing system is enhanced with a first-pass domain filter configured for loading character strings representing a pair of domains consisting of a seed domain and a candidate domain in a computer memory, computing a similarity score and a dynamic threshold for the pair of domains, determining whether the similarity score exceeds the dynamic threshold, and iterating the loading, the computing, and the determining for each of a plurality of candidate domains paired with the seed domain. A similarity score between the seed domain and the candidate domain and a corresponding dynamic threshold for the pair are computed. If the similarity score exceeds the corresponding dynamic threshold, the candidate domain is provided to a downstream computing facility. Otherwise, it is dropped. In this way, the first-pass domain filter can significantly reduce the number of domains that otherwise would need to be processed by the downstream computing facility.
Aspects of the disclosure relate to generating threat intelligence information. A computing platform may receive forensics information corresponding to message attachments. For each message attachment, the computing platform may generate a feature representation. The computing platform may input the feature representations into a neural network, which may result in a numeric representation for each message attachments. The computing platform may apply a clustering algorithm to cluster each message attachments based on the numeric representations, which may result in clustering information. The computing platform may extract, from the clustering information, one or more indicators of compromise indicating that one or more attachments corresponds to a threat campaign. The computing platform may send, to an enterprise user device, user interface information comprising the one or more indicators of compromise, which may cause the enterprise user device to display a user interface identifying the one or more indicators of compromise.
Aspects of the disclosure relate to processing external messages using a secure email relay. A computing platform may receive, from a message source server associated with a first domain, a first email message and a first set of authentication credentials. Based on validating the first set of authentication credentials, the computing platform may inject, into the first email message, a DomainKeys Identified Mail (DKIM) signature of a second domain different from the first domain, which may produce a signed message that identifies itself as originating from the second domain. Based on scanning and validating content of the signed message, the computing platform may send the signed message to a message recipient server, which may cause the message recipient server to validate the DKIM signature of the signed message and determine that the signed message passes Domain-based Message Authentication, Reporting and Conformance (DMARC) with respect to the second domain.
Aspects of the disclosure relate to measuring user-specific fraud-susceptibility behavioral scores and dynamically generating customized cybersecurity training modules using fraud-susceptibility behavioral scores. A computing platform may generate a fraud-susceptibility personality survey and send the fraud-susceptibility personality survey to an enterprise user device. Subsequently, the computing platform may receive information indicating how a user of the enterprise user device responded to the fraud-susceptibility personality survey, calculate a fraud-susceptibility behavioral psychology score for the user based on the user information, and identify a user-specific predicted failure rate on one or more cybersecurity training modules based on the fraud-susceptibility behavioral psychology score. Based on the user-specific predicted failure rate and using a behavioral psychology training module, the computing platform may generate, and send to the enterprise user device, a dynamically adapted cybersecurity training template, which causes the enterprise user device to display one or more customized cybersecurity training modules.
G09B 7/08 - Electrically-operated teaching apparatus or devices working with questions and answers of the multiple-choice answer type, i.e. where a given question is provided with a series of answers and a choice has to be made from the answers characterised by modifying the teaching programme in response to a wrong answer, e.g. repeating the question, supplying further information
G09B 19/00 - Teaching not covered by other main groups of this subclass
G09B 7/077 - Electrically-operated teaching apparatus or devices working with questions and answers of the multiple-choice answer type, i.e. where a given question is provided with a series of answers and a choice has to be made from the answers providing for individual presentation of questions to a plurality of student stations different stations being capable of presenting different questions simultaneously
H04L 29/06 - Communication control; Communication processing characterised by a protocol
Aspects of the disclosure relate to providing training and information based on simulated cybersecurity attack difficulty. A computing platform may retrieve data associated with a plurality of attack templates for simulating cybersecurity attacks. Subsequently, the computing platform may use one or more models to compute a predicted failure rate for each template of the plurality of attack templates in order to yield a plurality of predicted failure rates for an organization. Based on the plurality of predicted failure rates, the computing platform may use one or more of the plurality of attack templates to configure a simulated cybersecurity attack on the organization. Then, the computing platform may send, via the communication interface, to an administrator user device associated with the organization, information about the simulated cybersecurity attack and may execute the simulated cybersecurity attack.
Aspects of the disclosure relate to dynamically generating simulated attack messages configured for annotation by users as part of cybersecurity training. A computing platform may generate a simulated attack message including a plurality of elements and send the simulated attack message to an enterprise user device. Subsequently, the computing platform may receive, from the enterprise user device, user selections annotating selected elements of the plurality of elements of the simulated attack message. The computing platform may thereafter identify one or more training areas for the user based on the user selections received from the enterprise user device, generate a customized training module specific to the identified one or more training areas, and send the customized training module to the enterprise user device. Sending the customized training module to the enterprise user device may cause the enterprise user device to display the customized training module.
Aspects of the disclosure relate to anomaly detection in cybersecurity training modules. A computing platform may receive information defining a training module. The computing platform may capture a plurality of screenshots corresponding to different permutations of the training module. The computing platform may input, into an auto-encoder, the plurality of screenshots corresponding to the different permutations of the training module, wherein inputting the plurality of screenshots corresponding to the different permutations of the training module causes the auto-encoder to output a reconstruction error value. The computing platform may execute an outlier detection algorithm on the reconstruction error value, which may cause the computing platform to identify an outlier permutation of the training module. The computing platform may generate a user interface comprising information identifying the outlier permutation of the training module. The computing platform may send the user interface to at least one user device.
Aspects of the disclosure relate to spear phishing simulation using machine learning. A computing platform may send, to an enterprise user device, a spear phishing message. The computing platform may receive initial user interaction information indicating how a user of the enterprise user device interacted with the spear phishing message. Based on the initial user interaction information and using a series of branching message templates, the computing platform may generate additional spear phishing messages. The computing platform may receive additional user interaction information indicating how the user interacted with the additional spear phishing messages. Based on the initial user interaction information and the additional user interaction information, the computing platform may compute spear phishing scores. Based on a comparison of the spear phishing scores to spear phishing thresholds, the computing platform may generate training modules for the user, and may send the training modules to the enterprise user device.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
Aspects of the disclosure relate to dynamically providing cybersecurity training based on user-specific threat information. A computing platform may receive, from a targeted attack protection (TAP) server, user-specific threat information indicating at least one threat that has been encountered by at least one user. The computing platform may identify one or more users to receive cybersecurity training in a first cybersecurity training topic based on the user-specific threat information indicating the at least one threat that has been encountered by the at least one user. Subsequently, the computing platform may load one or more cybersecurity training modules based on identifying the one or more users to receive the cybersecurity training in the first cybersecurity training topic. Then, the computing platform may provide the one or more cybersecurity training modules to one or more user computing devices.
A domain processing system receives or collects raw data containing sample domains each having a known class identity indicating whether a domain is conducting an email campaign. The domain processing system extracts features from each of the sample domains and selects features of interest from the features, including at least a feature particular to a seed domain and features particular to email activities over a time line that includes days before and after a domain creation date. The features of interest are used to create feature vectors which, in turn, are used to train a machine learning model, the training including optimizing a neural network structure iteratively until stopping criteria are satisfied. The trained model functions as an email campaign domain classifier operable to classify candidate domains with unknown class identities such that each of the candidate domain is classified as conducting or not conducting an email campaign.
A communication system includes multiple Point-of-Presence (POP) interfaces and one or more processors. The multiple POP interfaces are distributed in a Wide-Area Network (WAN) and are configured to communicate with at least a client and a server connected to the WAN. The one or more processors are coupled to the POP interfaces and are configured to (i) assign respective Internet Protocol (IP) addresses to the client and to the server, including embedding state information in the assigned IP addresses, and (ii) route traffic over the WAN between the client and the server, in a stateless manner, based on the state information embedded in the IP addresses.
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
H04L 41/0816 - Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events
H04L 69/325 - Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the network layer [OSI layer 3], e.g. X.25
A system assesses the susceptibility of an electronic device user to a cybersecurity threat by sensing a user action with respect to the electronic device. The system maps the sensed data to a training needs model to determine whether the sensed data corresponds to a pattern associated with a threat scenario in the training needs model. When the system determines that the sensed data corresponds to a pattern associated with a threat scenario in the training needs model, identify a cybersecurity threat scenario for which the user is at risk, and use the training needs model to estimate susceptibility of the user to the cybersecurity threat scenario.
G09B 7/02 - Electrically-operated teaching apparatus or devices working with questions and answers of the type wherein the student is expected to construct an answer to the question which is presented or wherein the machine gives an answer to the question presented by the student
G09B 19/00 - Teaching not covered by other main groups of this subclass
H04L 29/06 - Communication control; Communication processing characterised by a protocol
A63F 13/80 - Special adaptations for executing a specific game genre or game mode
G09B 5/06 - Electrically-operated educational appliances with both visual and audible presentation of the material to be studied
42 - Scientific, technological and industrial services, research and design
Goods & Services
Online non-downloadable software that aggregates and correlates threat data points across email, the cloud, computer networks, and social media and uses a combination of advanced machine learning and human researchers to detect and prevent cybersecurity attacks; Online non-downloadable software using artificial intelligence for machine learning in the field of cybersecurity
94.
Detecting, classifying, and enforcing policies on social networking activity
Technology is disclosed for detecting, classifying, and/or enforcing policies on social networking activity. The technology can store a content policy, classify content posted to a social network, determine that the classification corresponds to the content policy, and apply an action specified by the content policy to the posted content.
G06F 16/11 - File system administration, e.g. details of archiving or snapshots
G06Q 50/00 - Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
95.
System, apparatus and method for dynamically updating the configuration of a network device
A system, apparatus and method are provided for dynamically updating a configuration of a network device when relevant sources and destinations of network traffic are added, removed or migrated in a network. A configuration of a network device is associated with a set of network addresses representing a set of relevant sources and destinations of network traffic. The set is dynamic in that the membership of the set can change over time to include different network addresses as the set of relevant sources and destinations of network traffic changes over time. One or more data sources are monitored to obtain the network addresses for the set of relevant sources and destinations and to determine if the membership of the set has changed. When a change is detected, the configuration of the network device is updated on the network device to reflect the network addresses that are currently in the set.
H04L 41/0893 - Assignment of logical groups to network elements
H04L 41/0816 - Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events
96.
Systems and methods for security analysis of applications on user mobile devices while maintaining user application privacy
Systems and methods for analyzing applications (“apps”) on a mobile device for security risks for a company while maintaining the mobile device owner's privacy and confidentiality concerning the applications. The mobile device may be a user's personal device (a “bring your own device”). In an example method, a process generates one or more cryptographic representations of application information for each application on the mobile device. The cryptographic representations may comprise a hash or composite hash. The cryptographic representations may be transmit outside the mobile device to a system which makes a determination and provides an indication whether the application is permitted or not permitted for use at the company. The company can be associated with a hashed permitted or not permitted list. The application information can include application name, executable code, and a version number. The method may include automatically remediating the application if it matches a known risk.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/10 - Protecting distributed programs or content, e.g. vending or licensing of copyrighted material
G06F 21/51 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
G06F 21/55 - Detecting local intrusion or implementing counter-measures
G06F 21/64 - Protecting data integrity, e.g. using checksums, certificates or signatures
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
H03K 19/17728 - Reconfigurable logic blocks, e.g. lookup tables
H03K 19/17768 - Structural details of configuration resources for security
A message-hold decision maker system used with an electronic mail processing system that processes electronic messages for a protected computer network improves the electronic mail processing system's performance by increasing the throughput performance of the system. The improvements are achieved by providing an electronic mail processing gateway with additional logic that makes fast and intelligent decisions on whether to hold, block, allow, or sandbox electronic messages in view of potential threats such as viruses or URL-based threats. A message hold decision maker uses current and stored information from a plurality of specialized classification engines to quickly make the decisions. In some examples, the message hold decision maker will instruct an email gateway to hold an electronic mail message while the classification engines perform further analysis.
Disclosed is a domain filter capable of determining an n-gram distance between a seed domain and each of a plurality of candidate domains. The domain filter loads a seed domain n-gram for the seed domain and a candidate domain n-gram for each candidate domain in memory, compares the seed domain n-gram and the candidate domain n-gram to identify any identical grams, removes any identical grams from the seed domain n-gram, and determines how many grams are left in the seed domain n-gram, representing the n-gram distance between the seed domain and the candidate domain. The domain filter then compares n-gram distances thus determined with a predetermined threshold, eliminates any candidate domain having an n-gram distance from the seed domain that exceeds the predetermined threshold, and provides remaining candidate domains to a downstream computing facility such as a user interface or an analytical module operating in an enterprise computing environment.
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
H04L 29/12 - Arrangements, apparatus, circuits or systems, not covered by a single one of groups characterised by the data terminal
G06F 16/9535 - Search customisation based on user profiles and personalisation
99.
SYSTEMS AND METHODS FOR PUSHING UNIVERSAL PROFILE UPDATES
A universal profile management system receives a profile update to multiple user profiles stored on disparate media platforms, the multiple user profiles associated with a public-facing individual, the public-facing individual registered with the universal profile management system and subject to regulatory requirements. The universal profile management system applies a rule to the profile update and determines whether the profile update violates the rule. If so, publication of the profile update to the multiple user profiles on the disparate media platforms is denied. If the profile update does not violate the rule, the universal profile management system modifies a universal profile stored in a central repository for the public-facing individual and publishes the profile update to the multiple user profiles on the disparate media platforms. Re-application of the rule can trigger an update to the universal profile and publication of the update to the multiple user profiles across disparate media platforms.
G06Q 50/00 - Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
Technology is disclosed for detecting imposters of a brand account. The technology can store a brand profile of the brand account, detect that a message has been publicly communicated to the brand account from a social media account, monitor messages sent publicly to the social media account from other social media accounts by repeatedly comparing the brand profile to metadata of each of the monitored messages, and identify at least one of the other social media accounts as an imposter account based on the comparing. The technology can cease the comparing at predetermined expiration time occurring after the detection of the message that was sent publicly to the brand account.
G06Q 40/02 - Banking, e.g. interest calculation or account maintenance
G06Q 99/00 - Subject matter not provided for in other groups of this subclass
G06Q 50/00 - Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
