A method for defending against malicious profiles on the web comprises the steps of: i) inspecting a profile to determine its relevance to a brand that it is desired to protect from malicious activity; ii) determining whether said profile is relevant to said brand; iii) if it is determined that said profile is relevant, analyzing it to determine whether it is legitimate or malicious; and iv) if it is determined that the profile is malicious, assembling proof of its malicious activity and submitting same together with a takedown request to the administrator of the website where the profile was located.
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on multiple baseline profiles associated with the operational activity, the security platform may use a probabilistic graph to determine a behavioral anomaly. The security platform may, based on the behavioral anomaly, identify a cyberattack.
A method and system for detecting anomalous network activity in a cloud-based compute environment. The method comprises receiving configuration data and network activity observations for a set of virtual entities in the cloud-based compute environment; creating a profile for each virtual entity in the set of virtual entities, when the virtual entity does not already have an associated profile; dynamically updating the virtual entity of a profile with the respective network activity observations of the virtual entity; and determining whether anomalies have been detected.
H04L 41/142 - Network analysis or design using statistical or mathematical methods
H04L 41/40 - Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
H04L 43/062 - Generation of reports related to network traffic
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on multiple baseline profiles associated with the operational activity, the security platform may use a probabilistic graph to determine a behavioral anomaly. The security platform may, based on the behavioral anomaly, identify a cyberattack.
A method and system for detecting anomalous network activity in a cloud-based compute environment. The method comprises receiving configuration data and network activity observations for a set of virtual entities in the cloud-based compute environment; creating a profile for each virtual entity in the set of virtual entities, when the virtual entity does not already have an associated profile; dynamically updating the virtual entity of a profile with the respective network activity observations of the virtual entity; and determining whether anomalies have been detected.
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on a domain specific graph representative of factor data and dependencies between factor data, the security platform may determine a behavioral anomaly that is associated with a cyberattack.
G06F 3/0484 - Interaction techniques based on graphical user interfaces [GUI] for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on multiple baseline profiles associated with the operational activity, the security platform may use a probabilistic graph to determine a behavioral anomaly. The security platform may, based on the behavioral anomaly, identify a cyberattack.
G06F 3/0484 - Interaction techniques based on graphical user interfaces [GUI] for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
A method for defending against malicious profiles on the web, the method including: i) inspecting a profile to determine its relevance to a brand that it is desired to protect from malicious activity; ii) determining whether the profile is relevant to the brand; iii) if it is determined that the profile is relevant, analyzing it to determine whether it is legitimate or malicious; and iv) if it is determined that the profile is malicious, assembling proof of its malicious activity and submitting same together with a takedown request to the administrator of the website where the profile was located.
Systems and methods of mitigating leakage of credentials of a user of a computer network, including monitoring at least one data source to scrape data that is compatible with credential data, applying a machine learning algorithm to the scraped data to identify at least one potential leaked credential, wherein the at least one potential leaked credential is identified using at least one neural network, authenticating the identified at least one potential leaked credential by a database of valid credentials of the computer network, and replacing credentials corresponding to the at least one leaked credential.
A method and system for detecting anomalous network activity in a cloud-based compute environment. The method comprises receiving configuration data and network activity observations for a set of virtual entities in the cloud-based compute environment; creating a profile for each virtual entity in the set of virtual entities, when the virtual entity does not already have an associated profile; dynamically updating the virtual entity of a profile with the respective network activity observations of the virtual entity; and determining whether anomalies have been detected.
A system and a method of obtaining a location of a document on a computer network based on a document property. The method may include: receiving at least one basic marker and an encoding function associated with the document property; generating a search term according to the encoding function, based on the at least one basic marker; providing the search term to at least one search engine and obtaining therefrom one or more search results corresponding, where each search result may include one or more references to locations of documents on the computer network; discovering at least one document having the document property from the one or more search results and obtaining a discovered location of the document on the computer network; and performing at least one rule-based action, according to at least one document property of the discovered document.
A system and a method of obtaining a location of a document on a computer network based on a document property. The method may include: receiving at least one basic marker and an encoding function associated with the document property; generating a search term according to the encoding function, based on the at least one basic marker; providing the search term to at least one search engine and obtaining therefrom one or more search results corresponding, where each search result may include one or more references to locations of documents on the computer network; discovering at least one document having the document property from the one or more search results and obtaining a discovered location of the document on the computer network; and performing at least one rule-based action, according to at least one document property of the discovered document.
System and method of detecting malicious interactions in a computer network, the method including generating, by a processor, at least one decoy segment, broadcasting, by the processor, the generated at least one decoy segment in a public database, monitoring, by the processor, communication within the computer network to identify interactions associated with the generated at least one decoy segment, determining, by the processor, at least one indicator of compromise (IOC) for the identified interactions, and blocking communication between the computer network and any computer associated with the determined at least one IOC.
Systems and methods of blocking phishing attempts in a computer network, including receiving a list of assets of the computer network, wherein each asset is associated with at least one computer network address, generating at least one address permutation on the at least one computer network address of each asset of the computer network, wherein the generated at least one address permutation is different from the address associated with each asset of the computer network, receiving a communication request at a gateway server of the computer network, determining a destination address of the communication request, comparing the determined destination address with the at least one address permutation, and when the determined destination address is the same as at least one address permutation, blocking the communication request at the gateway server.
Systems and methods of mitigating leakage of credentials of a user of a computer network, including monitoring at least one data source to scrape data that is compatible with credential data, applying a machine learning algorithm to the scraped data to identify at least one potential leaked credential, wherein the at least one potential leaked credential is identified using at least one neural network, authenticating the identified at least one potential leaked credential by a database of valid credentials of the computer network, and replacing credentials corresponding to the at least one leaked credential.
A method and system for detecting anomalous network activity in a cloud-based compute environment. The method comprises receiving configuration data and network activity observations for a set of virtual entities in the cloud-based compute environment; creating a profile for each virtual entity in the set of virtual entities, when the virtual entity does not already have an associated profile; dynamically updating the virtual entity of a profile with the respective network activity observations of the virtual entity; and determining whether anomalies have been detected.
A system and a method of obtaining a location of a document on a computer network based on a document property. The method may include: receiving at least one basic marker and an encoding function associated with the document property; generating a search term according to the encoding function, based on the at least one basic marker; providing the search term to at least one search engine and obtaining therefrom one or more search results corresponding, where each search result may include one or more references to locations of documents on the computer network; discovering at least one document having the document property from the one or more search results and obtaining a discovered location of the document on the computer network; and performing at least one rule-based action, according to at least one document property of the discovered document.
i) inspecting a profile to determine its relevance to a brand that it is desired to protect from malicious activity; ii) determining whether said profile is relevant to said brand; iii) if it is determined that said profile is relevant, analyzing it to determine whether it is legitimate or malicious; and iv) if it is determined that the profile is malicious, assembling proof of its malicious activity and submitting same together with a takedown request to the administrator of the website where the profile was located.
Systems and methods of blocking phishing attempts in a computer network, including receiving a list of assets of the computer network, wherein each asset is associated with at least one computer network address, generating at least one address permutation on the at least one computer network address of each asset of the computer network, wherein the generated at least one address permutation is different from the address associated with each asset of the computer network, receiving a communication request at a gateway server of the computer network, determining a destination address of the communication request, comparing the determined destination address with the at least one address permutation, and when the determined destination address is the same as at least one address permutation, blocking the communication request at the gateway server.
Systems and methods of mitigating leakage of credentials of a user of a computer network, including monitoring at least one data source to scrape data that is compatible with credential data, applying a machine learning algorithm to the scraped data to identify at least one potential leaked credential, wherein the at least one potential leaked credential is identified using at least one neural network, authenticating the identified at least one potential leaked credential by a database of valid credentials of the computer network, and replacing credentials corresponding to the at least one leaked credential.
A method and system for detecting anomalous network activity in a cloud-based compute environment. The method comprises receiving configuration data and network activity observations for a set of virtual entities in the cloud-based compute environment; creating a profile for each virtual entity in the set of virtual entities, when the virtual entity does not already have an associated profile; dynamically updating the virtual entity of a profile with the respective network activity observations of the virtual entity; and determining whether anomalies have been detected.
A system and a method of obtaining a location of a document on a computer network based on a document property. The method may include: receiving at least one basic marker and an encoding function associated with the document property; generating a search term according to the encoding function, based on the at least one basic marker; providing the search term to at least one search engine and obtaining therefrom one or more search results corresponding, where each search result may include one or more references to locations of documents on the computer network; discovering at least one document having the document property from the one or more search results and obtaining a discovered location of the document on the computer network; and performing at least one rule-based action, according to at least one document property of the discovered document.
There is provided a computer implemented method of vaccination of a computing device against infection by malicious code, comprising: obtaining a vaccination profile including vaccination artifact system calls indicative of a malicious code attempting to identify another instance of the malicious code executing on the computing device prior to the malicious code infecting the computing device, monitoring the computing device for an indication of execution of at least one of the vaccination artifact system calls by the malicious code, and providing a false response to the at least one of the vaccination artifact system calls for emulating an existing infection of the computing device by another instance of the malicious code according to the indication of execution of at least one of the plurality of vaccination artifact system calls, wherein the emulation of the existing infection prevents infection of the computing device by the malicious code.
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/53 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by executing in a restricted environment, e.g. sandbox or secure virtual machine
24.
Systems and methods for protecting a computing device against malicious code
There is provided a computer implemented method of generating a vaccination profile of malicious code for vaccination against other instances of the malicious code, comprising: providing malicious code, analyzing the malicious code to identify at least one vaccination artifact system call indicative of an attempt to identify malicious code executing on a client computing device prior to another instance of the malicious code infecting the client computing device, generating according to the analysis of the malicious code, a vaccination profile including the at least one vaccination artifact system call, and providing the vaccination profile to a plurality of client computing devices for vaccination of the plurality of client computing devices uninfected by the malicious code, wherein an existing infection by the malicious code is emulated based on the vaccination profile for prevention of infection of the plurality of computing devices by another instance of the malicious code.
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/53 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by executing in a restricted environment, e.g. sandbox or secure virtual machine
25.
System and method for detection of malicious interactions in a computer network
System and method of detecting malicious interactions in a computer network, the method including generating, by a processor, at least one decoy segment, broadcasting, by the processor, the generated at least one decoy segment in a public database, monitoring, by the processor, communication within the computer network to identify interactions associated with the generated at least one decoy segment, determining, by the processor, at least one indicator of compromise (IOC) for the identified interactions, and blocking communication between the computer network and any computer associated with the determined at least one IOC.
A system and a method for mitigating phishing attacks against a secured computing device. The method may include: obtaining at least one first domain name; attributing a registration time stamp (RTS) associated with timing of a registration of the at least one domain name at a domain registrar; and configuring at least one perimeter module to restrict at least one data transmission between the secured computing device and a computing device that is associated with the first domain name, based on the RTS.
Systems and methods of blocking phishing attempts in a computer network, including receiving a list of assets of the computer network, wherein each asset is associated with at least one computer network address, generating at least one address permutation on the at least one computer network address of each asset of the computer network, wherein the generated at least one address permutation is different from the address associated with each asset of the computer network, receiving a communication request at a gateway server of the computer network, determining a destination address of the communication request, comparing the determined destination address with the at least one address permutation, and when the determined destination address is the same as at least one address permutation, blocking the communication request at the gateway server.
A method for processing files as a preemptive measure against a ransomware activity. The method comprises scanning a plurality of file operation requests sent to an operating system (OS) executed on a computing device to detect a guarded file operation request that comprises instructions to process a file managed by a file system used by said OS, delaying an execution of said guarded file operation request, temporarily storing a copy of said file in a backup storage in response to said detection of said guarded file operation request, and stop delaying said execution of said guarded file operation request when said copy is stored in said backup storage.
G06F 21/00 - Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result
H04L 29/06 - Communication control; Communication processing characterised by a protocol
A method for emulating at least one resource in a host computer to a querying hosted code. The method comprises monitoring a plurality of operating system (OS) queries received from a plurality of code executed on a monitored computing unit, the plurality of OS queries are designated to an OS of the monitored computing unit, detecting among the plurality of OS queries at least one query for receiving at least one characteristic of at least one resource of the monitored computing unit among the plurality of OS queries, the at least one query is received from querying code of the plurality of code, preparing a response of the OS to the at least one query, the response comprising a false indication at least one false characteristic of the at least one resource, and sending the response to the querying code in response to the at least one query.
09 - Scientific and electric apparatus and instruments
42 - Scientific, technological and industrial services, research and design
Goods & Services
Computer software for inspecting electronic files to detect and prevent computer security attacks, computer and email viruses, spam, spyware, adware and malware; computer software for use in controlling, managing, auditing and analyzing data access and usage; computer hardware and computer software in the field of internet and network security; computer software for protecting and securing computer systems and networks; software for ensuring the security of electronic mail. Computer consultation in the field of computer security; design and development of electronic data security systems; providing online, non-downloadable software for inspecting electronic files to detect and prevent computer security attacks, computer and email viruses, spam, spyware, adware and malware; research in the field of intelligence and security technology; computer services, namely, on-line scanning, detecting, quarantining and eliminating of viruses, worms, trojans, spyware, adware, malware and unauthorized data and programs on computers and electronic devices; providing online, non-downloadable software for protecting and securing computer systems and networks; providing computer and information technology security services; computer virus protection services.
09 - Scientific and electric apparatus and instruments
42 - Scientific, technological and industrial services, research and design
Goods & Services
Computer software for inspecting electronic files to detect and prevent computer security attacks, computer and email viruses, spam, spyware, adware and malware; computer software for use in controlling, managing, auditing and analyzing data access and usage; computer hardware and computer software in the field of internet and network security; computer software for protecting and securing computer systems and networks; software for ensuring the security of electronic mail. Computer consultation in the field of computer security; design and development of electronic data security systems; providing online, non-downloadable software for inspecting electronic files to detect and prevent computer security attacks, computer and email viruses, spam, spyware, adware and malware; research in the field of intelligence and security technology; computer services, namely, on-line scanning, detecting, quarantining and eliminating of viruses, worms, trojans, spyware, adware, malware and unauthorized data and programs on computers and electronic devices; providing online, non-downloadable software for protecting and securing computer systems and networks; providing computer and information technology security services; computer virus protection services.
32.
Systems and methods for malware evasion management
A method for emulating at least one resource in a host computer to a querying hosted code. The method comprises monitoring a plurality of operating system (OS) queries received from a plurality of code executed on a monitored computing unit, the plurality of OS queries are designated to an OS of the monitored computing unit, detecting among the plurality of OS queries at least one query for receiving at least one characteristic of at least one resource of the monitored computing unit among the plurality of OS queries, the at least one query is received from querying code of the plurality of code, preparing a response of the OS to the at least one query, the response comprising a false indication at least one false characteristic of the at least one resource, and sending the response to the querying code in response to the at least one query.
Systems, methods, and software products prevent malware attacks on networks, which include endpoint devices, by providing an environment to the endpoint device which simulates an environment, for example, a security environment, where malware is known to refrain from executing.
