-
公开(公告)号：US10826756B2
公开(公告)日：2020-11-03
申请号：US16056157
申请日：2018-08-06
Applicant: MICROSOFT TECHNOLOGY LICENSING, LLC
Inventor： Ben Kliger , Moshe Israel , Dotan Patrich , Michael Zeev Bargury
Abstract: A computing system utilizes crowd sourcing to generate remediation files for systems experiencing alert conditions. During the generation of the remediation files the computing system identifies a plurality of different types of alerts associated with a plurality of different client systems. The computing system also generates a plurality of different client remediation process sets for each type of alert based on a correlation of process proximity and time to the alert conditions and determines which of the plurality of processes are related to the identified alert based on values in a correlation vector. Then, client remediation process sets are created to include the processes that are determined to be related to the identified alert and are clustered together to identify the processes to include in the generated composite remediation file for each type of alert, based on correlations existing between the plurality of different client remediation process sets.
-
公开(公告)号：US20190005225A1
公开(公告)日：2019-01-03
申请号：US15637515
申请日：2017-06-29
Applicant: MICROSOFT TECHNOLOGY LICENSING, LLC
Inventor： Dotan Patrich , Vlad Korsunsky , Maya Maimon , Moshe Israel , Oran Brill , Tomer Teller
Abstract: Methods are provided for building and tuning a correlation data structure. The correlation data structure includes relationship correlations with relationship scores that reflect the level of correlation between alert conditions and feature set events that occurred in a machine. Each relationship correlation further includes a time of influence associated with the times of occurrence for each alert condition and corresponding feature set event. The correlation data structure is built and tuned using sourcing to leverage the alert conditions and feature set events on each machine for all machines in the network. Methods are also provided to use the correlation data structure to monitor the machines in a network, detect feature set events, and detect if alert conditions correlated with those feature set events are likely to occur. The methods further provide for mitigating those alert conditions.
-
公开(公告)号：US11196746B2
公开(公告)日：2021-12-07
申请号：US16027304
申请日：2018-07-04
Applicant: MICROSOFT TECHNOLOGY LICENSING, LLC
Inventor： Omer Karin , Hani Hana Neuvirth , Dotan Patrich , Tomer Koren , Ram Haim Pliskin , Josef Weizman , Yotam Livny
Abstract: “Sensitive” URIs for a website can be determined. Access attempts to a sensitive URI can be extracted from server logs. As used herein, sensitive URIs are URIs which if breached are likely to result in harm to the website owner. Access to sensitive URIs can be restricted to trusted accessors. Trusted accessors can be determined by filtering out untrusted accessors using thresholds and/or machine learning techniques. After filtering out untrusted accessors, any remaining accessors can be identified as trusted accessors. Trusted accessors can be added to a whitelist. Access requests to access-restricted URIs by an accessor not in the whitelist can be denied and an alert can be generated. Access requests to access-restricted URIs by an accessor in the whitelist can be granted.
-
公开(公告)号：US10474966B2
公开(公告)日：2019-11-12
申请号：US15444124
申请日：2017-02-27
Applicant: Microsoft Technology Licensing, LLC
Inventor： Moshe Israel , Dotan Patrich
Abstract: Providing network entities with notifications of attacks on the entities. A method includes collecting alerts from a plurality of network entities in a cluster computing environment. Alerts are grouped into heterogeneous groups of alerts. Each group includes a plurality of different types of alerts. Each alert has corresponding properties, including at least one property identifying the type of alert. Each group of alerts corresponds to a timeline of alerts for a particular entity. Groups of alerts that correspond to a valid cyber-kill chain are identified. Different groups of alerts that correspond to a valid cyber-kill chain are correlated into clusters of groups of alerts by correlating the types of alerts and corresponding properties. At least one cluster is identified as having some characteristic of interest. Entities corresponding to groups of alerts in the cluster are notified of the characteristic of interest.
-
公开(公告)号：US20180351783A1
公开(公告)日：2018-12-06
申请号：US15613708
申请日：2017-06-05
Applicant: Microsoft Technology Licensing, LLC
Inventor： Dotan Patrich , Tomer Koren , Mathias Scherman
Abstract: Methods, systems, and apparatuses are provided for evaluating a chain of alerts. Historical alerts may be grouped together to form sets of alerts based on a predetermined relationship between the alerts. A score is determined for each set of alerts representing a statistical likelihood that one alert in the set is correlated to another alert in the set, generating a plurality of scores for the sets of alerts. The scores may be placed into a model containing a score for each set of alerts. After the model is formed, a received chain of alerts may be evaluated by examining whether the chain of alerts, or a sub-chain of alerts, corresponds to a score in the model through an iterative process. If the chain of alerts corresponds to a score in the model and meets a predetermined criteria, a system administrator can be alerted of the chain of alerts.
-
Patent Agency Ranking
公开(公告)号：US20180248893A1
公开(公告)日：2018-08-30
申请号：US15444124
申请日：2017-02-27
Applicant: Microsoft Technology Licensing, LLC
Inventor： Moshe Israel , Dotan Patrich
Abstract: Providing network entities with notifications of attacks on the entities. A method includes collecting alerts from a plurality of network entities in a cluster computing environment. Alerts are grouped into heterogeneous groups of alerts. Each group includes a plurality of different types of alerts. Each alert has corresponding properties, including at least one property identifying the type of alert. Each group of alerts corresponds to a timeline of alerts for a particular entity. Groups of alerts that correspond to a valid cyber-kill chain are identified. Different groups of alerts that correspond to a valid cyber-kill chain are correlated into clusters of groups of alerts by correlating the types of alerts and corresponding properties. At least one cluster is identified as having some characteristic of interest. Entities corresponding to groups of alerts in the cluster are notified of the characteristic of interest.
-
7.发明授权公开(公告)号：US10887326B2
公开(公告)日：2021-01-05
申请号：US15941593
申请日：2018-03-30
Applicant: Microsoft Technology Licensing, LLC
Inventor： Josef Weizman , Tomer Koren , Ram Haim Pliskin , Hani Hana Neuvirth , Dotan Patrich
Abstract: A method includes obtaining a dictionary, data for a set of web requests, and definitions of a first set of clusters associated with vulnerability scanners. The method includes identifying a set of clients that transmitted the second set of web requests. The method includes generating a second set of feature vectors, which each corresponds to one of the clients. Each element in each feature vector corresponds respectively to an entry in the dictionary. The method includes clustering the second set of feature vectors into a second set of clusters. The method includes, in response to a first distance between a selected cluster of the second set of clusters and one of the first set of clusters being less than a first predetermined distance, (i) identifying one of the set of web services that received web requests corresponding to feature vectors in the selected cluster and (ii) generating a scanning alert.
-
8.发明申请公开(公告)号：US20200151326A1
公开(公告)日：2020-05-14
申请号：US16190658
申请日：2018-11-14
Applicant: MICROSOFT TECHNOLOGY LICENSING, LLC
Inventor： Dotan Patrich , Yaakov Garyani , Moshe Israel , Yotam Livny
Abstract: Techniques are provided to dynamically generate response actions that may be used to investigate and respond to a security alert. Different prediction models are initially trained using a corpus of training data. This training data is obtained by identifying previous security alerts and then grouping together alert clusters. An analysis is performed to identify which steps were used to respond to the alerts in each group. These steps are fed into a prediction model to train the model. After multiple models are trained and after a new security alert is received, one model is selected to operate on the new alert, where the model is selected because it is identified as being most compatible with the new alert. When the selected model is applied to the new alert, the model generates a set of recommended steps that may be followed to investigate and/or respond to the new alert.
-
公开(公告)号：US20200045075A1
公开(公告)日：2020-02-06
申请号：US16056052
申请日：2018-08-06
Applicant: MICROSOFT TECHNOLOGY LICENSING, LLC
Inventor： Ben Kliger , Moshe Israel , Dotan Patrich , Michael Zeev Bargury
Abstract: A computing system performs real-time mitigations for unfamiliar threat scenarios by identifying a particular threat scenario for a client system that has not previously experienced the threat scenario and for which a remediation process is unknown. The computing system responds to the unknown threat scenario by generating and providing the client system a mitigation file that includes a predictive set of mitigation processes for responding to the threat scenario. The mitigation file is generated by first generating a threat vector that identifies a plurality of different threat scenario characteristics for the particular threat scenario. Then, a classification model is applied to the threat vector to identify a predictive set of mitigation processes that are determined to be a best fit for the threat vector and that are included in the mitigation file.
-
10.发明申请公开(公告)号：US20200044911A1
公开(公告)日：2020-02-06
申请号：US16056157
申请日：2018-08-06
Applicant: MICROSOFT TECHNOLOGY LICENSING, LLC
Inventor： Ben Kliger , Moshe Israel , Dotan Patrich , Michael Zeev Bargury
Abstract: A computing system utilizes crowd sourcing to generate remediation files for systems experiencing alert conditions. During the generation of the remediation files the computing system identifies a plurality of different types of alerts associated with a plurality of different client systems. The computing system also generates a plurality of different client remediation process sets for each type of alert based on a correlation of process proximity and time to the alert conditions and determines which of the plurality of processes are related to the identified alert based on values in a correlation vector. Then, client remediation process sets are created to include the processes that are determined to be related to the identified alert and are clustered together to identify the processes to include in the generated composite remediation file for each type of alert, based on correlations existing between the plurality of different client remediation process sets.
-
-
-
-
-
-
-
-
-
Search Results
25
records
(took 0.016 seconds)
