Methods and apparatus for augmenting training data using large language models

    公开(公告)号:US12130923B2

    公开(公告)日:2024-10-29

    申请号:US17710127

    申请日:2022-03-31

    申请人: Sophos Limited

    摘要: In some embodiments, a processor receives natural language data for performing an identified cybersecurity task. The processor can provide the natural language data to a first machine learning (ML) model. The first ML model can automatically infer a template query based on the natural language data. The processor can receive user input indicating a finalized query and to provide the finalized query as input to a system configured to perform the identified computational task. The processor can provide the finalized query as a reference phrase to a second ML model, the second ML model configured to generate a set of natural language phrases similar to the reference phrase. The processor can generate supplemental training data using the set of natural language phrases similar to the reference phrase to augment training data used to improve performance of the first ML model and/or the second ML model.

    SYSTEMS AND METHODS FOR EXECUTING A COMMAND LINE INTERFACE COMMAND ON REMOTE DEVICES FROM A CENTRAL LOCATION

    公开(公告)号:US20240283849A1

    公开(公告)日:2024-08-22

    申请号:US18169475

    申请日:2023-02-15

    申请人: Sophos Limited

    IPC分类号: H04L67/55 G06F9/448

    CPC分类号: H04L67/55 G06F9/448

    摘要: In an embodiment, an apparatus includes one or more processors configured to receive at least one command line interface command, generate a push notification associated with the at least one command line interface command, send the push notification to at least one managed device, responsive to the at least one managed device receiving the push notification, receive a pull request from the at least one managed device, responsive to receiving the pull request, send the at least one command line interface command to a device-specific adaptor of the at least one managed device such that the device-specific adaptor converts the at least one command line interface command to a device-specific command associated with the at least one managed device, and receive an execution status from the at least one managed device in response to the device-specific command being executed by the at least one managed device.

    Network security
    7.
    发明授权

    公开(公告)号:US12021831B2

    公开(公告)日:2024-06-25

    申请号:US15179547

    申请日:2016-06-10

    申请人: Sophos Limited

    IPC分类号: H04L9/00 G06F21/52 H04L9/40

    摘要: A gateway or other network device may be configured to monitor endpoint behavior, and to request a verification of user presence at the endpoint under certain conditions suggesting, e.g., malware or other endpoint compromise. For example, when a network request is directed to a low-reputation or unknown network address, user presence may be verified to ensure that this action was initiated by a human user rather than automatically by malware or the like. User verification may be implicit, based on local behavior such as keyboard or mouse activity, or the user verification may be explicit, such as where a notification is presented on a display of the endpoint requesting user confirmation to proceed.

    MISCONFIGURED MIRROR PORT DETECTION
    9.
    发明公开

    公开(公告)号:US20240179043A1

    公开(公告)日:2024-05-30

    申请号:US18071132

    申请日:2022-11-29

    申请人: Sophos Limited

    摘要: A method includes monitoring a plurality of packets received by a network sensor associated with a port of a network, determining a ratio of unicast, multicast or broadcast packets to a total number of packets for the plurality of packets, determining that the ratio is outside the bounds of a threshold range, detecting that a port is misconfigured based on the determination that the ratio is outside the bounds of a threshold range, and automatically notifying a network administrator that the port is misconfigured based on the determination that the ratio is outside the bounds of a threshold range. Further disclosed is a computer system and computer program product configured to perform the method.