-
公开(公告)号:US11750619B2
公开(公告)日:2023-09-05
申请号:US16913876
申请日:2020-06-26
Applicant: Microsoft Technology Licensing, LLC
Inventor: Naama Kraus , Tamer Salman , Moshe Israel , Moshe Shalala , Idan Hen , Avihai Dvir , Rotem Lurie
IPC: H04L9/40
CPC classification number: H04L63/105 , H04L63/102
Abstract: According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to identify a privilege level assigned to a principal over a resource and determine whether the assigned privilege level is to be maintained or modified for the principal over the resource. Based on a determination that the assigned privilege level is to be maintained for the principal, the processor may determine whether access by the principal over the resource is to be limited and based on a determination that access to the resource is to be limited, apply a limited access by the principal over the resource.
-
公开(公告)号:US12282546B2
公开(公告)日:2025-04-22
申请号:US17516183
申请日:2021-11-01
Applicant: Microsoft Technology Licensing, LLC
Inventor: Idan Hen , Ilay Grossman , Avichai Ben David
Abstract: A system to detect an abnormal classic authorizations, such as in a classic authorization system of a resource access management system, and take action is described. The system determines an anomaly score in from a model applied to a classic assignment event. An indicator score is determined from the classic assignment event applied to domain-based rules. The security action is taken based on a combination of the anomaly score and the indicator score.
-
公开(公告)号:US12039042B2
公开(公告)日:2024-07-16
申请号:US17516226
申请日:2021-11-01
Applicant: Microsoft Technology Licensing, LLC
Inventor: Idan Hen , Ilay Grossman , Avichai Ben David
CPC classification number: G06F21/554 , G06F21/552 , G06F21/577 , G06F21/604 , G06N20/20
Abstract: A system to detect abnormal cross authorizations and take action is described. The system determines whether cross authorization event applied to a first trained anomaly detection model and activity post cross authorization event applied to a second trained anomaly detection model is suspicious. An indicator score is determined from rule-based security indications applied to the cross authorization. A security action is taken based on application of the indicator score applied to a threshold.
-
4.
公开(公告)号:US11843626B2
公开(公告)日:2023-12-12
申请号:US17246391
申请日:2021-04-30
Applicant: Microsoft Technology Licensing, LLC
CPC classification number: H04L63/1433 , H04L63/102 , H04L63/1441
Abstract: A system to determine an intrusion risk and take action is described. The system collaboratively filters a combination based on a user access and a network item in a computer network to determine an associated recommendation score. The system determines connected components of a model of the computer network and separately collaboratively filters the connected components to determine the recommendation score as a measure of intrusion risk. An action is taken on the user access based on the intrusion risk.
-
公开(公告)号:US20210120014A1
公开(公告)日:2021-04-22
申请号:US16660359
申请日:2019-10-22
Applicant: Microsoft Technology Licensing, LLC
Inventor: Itay Argoety , Jonathan Moshe Monsonego , Idan Hen , Payal Rani , Sridhar Periyasamy
Abstract: Techniques for user impact potential based security alert management in computer systems are disclosed. One example technique includes receiving an alert indicating that a security rule has been violated by a user. The example technique can also include, in response to receiving the data representing the alert, determining an impact score of the user based on the profile of the user. The impact score represents a deviation of an assigned value to the profile of the user and a mean value of assigned values of profiles of all users in the organization. The example technique can further include calculating a ranking value of the alert in relation to other alerts based on the determine impact score and other impacts scores corresponding to the other alerts and selectively surfacing the alert to a system analyst based on the calculated ranking value in relation to other alerts.
-
公开(公告)号:US20230403289A1
公开(公告)日:2023-12-14
申请号:US17806889
申请日:2022-06-14
Applicant: MICROSOFT TECHNOLOGY LICENSING, LLC
Inventor: Andrey Karpovsky , Idan Hen
CPC classification number: H04L63/1425 , H04L41/16 , G06N20/20
Abstract: A computing system generates from received user input an initial profile. The initial profile specifies expected behavioral patterns of datasets that are to be received by the computing system. The computing system extracts from received datasets features that are indicative of behavioral patterns of the received datasets. The computing system provides the initial profile to first machine-learning models. The first machine-learning models have been trained using a subset of the received datasets. The first machine-learning models use the initial profile to determine if the behavioral patterns of the received datasets are anomalous. The computing system includes second machine-learning models that have been trained using a subset of the received datasets. The second machine-learning models train a second profile based on the extracted features to specify behavioral patterns of the received datasets that are learned by the second machine-learning model.
-
公开(公告)号:US20230135186A1
公开(公告)日:2023-05-04
申请号:US17516226
申请日:2021-11-01
Applicant: Microsoft Technology Licensing, LLC
Inventor: Idan Hen , Ilay Grossman , Avichai Ben David
Abstract: A system to detect abnormal cross authorizations and take action is described. The system determines whether cross authorization event applied to a first trained anomaly detection model and activity post cross authorization event applied to a second trained anomaly detection model is suspicious. An indicator score is determined from rule-based security indications applied to the cross authorization. A security action is taken based on application of the indicator score applied to a threshold.
-
公开(公告)号:US20230132611A1
公开(公告)日:2023-05-04
申请号:US17516183
申请日:2021-11-01
Applicant: Microsoft Technology Licensing, LLC
Inventor: Idan Hen , Ilay Grossman , Avichai Ben David
IPC: G06F21/55
Abstract: A system to detect an abnormal classic authorizations, such as in a classic authorization system of a resource access management system, and take action is described. The system determines an anomaly score in from a model applied to a classic assignment event. An indicator score is determined from the classic assignment event applied to domain-based rules. The security action is taken based on a combination of the anomaly score and the indicator score.
-
公开(公告)号:US12265616B2
公开(公告)日:2025-04-01
申请号:US17536995
申请日:2021-11-29
Applicant: Microsoft Technology Licensing, LLC.
Inventor: Amit Magen Medina , Dotan Patrich , Josef Weizman , Idan Hen
Abstract: A computing system is configured to detect a request for a deployment of a container at a container orchestration service. One or more datasets associated with the deployment of the container are collected, and a plurality of features associated with the deployment are extracted based on the one or more datasets. A probability score is then generated based on the plurality of features, using a machine-learning model trained on datasets associated with historical deployments of containers that have been performed via the container orchestration service. The probability score indicates a probability that the deployment of the container is anomalous compared to the historical deployments of containers. When the probability score is greater than a threshold, the deployment of the container is determined as anomalous.
-
公开(公告)号:US12132747B2
公开(公告)日:2024-10-29
申请号:US16660359
申请日:2019-10-22
Applicant: Microsoft Technology Licensing, LLC
Inventor: Itay Argoety , Jonathan Moshe Monsonego , Idan Hen , Payal Rani , Sridhar Periyasamy
IPC: H04L9/40 , G06F21/55 , G06F21/57 , H04L41/0604
CPC classification number: H04L63/1416 , G06F21/552 , G06F21/554 , G06F21/577 , H04L41/0609 , H04L63/102 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/20
Abstract: Techniques for user impact potential based security alert management in computer systems are disclosed. One example technique includes receiving an alert indicating that a security rule has been violated by a user. The example technique can also include, in response to receiving the data representing the alert, determining an impact score of the user based on the profile of the user. The impact score represents a deviation of an assigned value to the profile of the user and a mean value of assigned values of profiles of all users in the organization. The example technique can further include calculating a ranking value of the alert in relation to other alerts based on the determine impact score and other impacts scores corresponding to the other alerts and selectively surfacing the alert to a system analyst based on the calculated ranking value in relation to other alerts.
-
-
-
-
-
-
-
-
-