-
公开(公告)号:US20180255083A1
公开(公告)日:2018-09-06
申请号:US15754282
申请日:2015-09-21
Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
Inventor: Prasad V. Rao , Sandeep N. Bhatt , William G. Home , Pratyusa K. Manadhata , Miranda Jane Felicity Mowbray
CPC classification number: H04L63/1425 , H04L61/1511 , H04L61/3015 , H04L63/0236 , H04L63/1416 , H04L63/1441
Abstract: Examples determine a number of hosts, within an enterprise, which are resolving a particular domain. Based on the number of hosts within the enterprise resolving the particular domain, the examples identify whether the particular domain is benign.
-
公开(公告)号:US20180234445A1
公开(公告)日:2018-08-16
申请号:US15433136
申请日:2017-02-15
Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
Inventor: Sandeep N. Bhatt , Pratyusa K. Manadhata , Tomas Sander
Abstract: A technique includes receiving data identifying behavior anomalies that are exhibited by entities that are associated with a computer system. The technique includes associating the behavior anomalies with contexts based at least in part on threat intelligence to provide modified anomalies. The threat intelligence associates the contexts with indicators of potential breach. The technique includes characterizing the behavior anomaly identification based at least in part on the threat intelligence. The characterization includes applying machine learning to features of the modified anomalies to classify the identified behavior anomalies.
-
公开(公告)号:US20180165225A1
公开(公告)日:2018-06-14
申请号:US15577698
申请日:2015-09-17
Applicant: Hewlett Packard Enterprise Development LP
Inventor: William G. Horne , Amro J. Awad , Pratyusa K. Manadhata
IPC: G06F12/14 , G06F12/0875 , H04L9/06 , H04L9/08
CPC classification number: G06F12/1408 , G06F12/0875 , G06F12/0895 , G06F2212/1052 , H04L9/065 , H04L9/08
Abstract: Examples relate to efficient storage of initialization vectors in a system. One example facilitates determining an initialization vector for use in encrypting a first cache line of a first page of memory, wherein determining the initialization vector comprises concatenating a page-level counter with a first set of hierarchical counters. The first set of hierarchical counters includes a first counter associated with the first cache line; a first group counter associated with a first group of cache lines, the first group of cache lines comprising the first cache line; and a first cluster counter associated with a first cluster of cache line groups, the first cluster comprising the first group of cache lines.
-
公开(公告)号:US11240263B2
公开(公告)日:2022-02-01
申请号:US15420521
申请日:2017-01-31
Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
Inventor: Pratyusa K. Manadhata , William G. Horne , Tomas Sander , Manish Marwah , Tomasz Jaroslaw Bania
IPC: H04L29/06
Abstract: In some examples, an alert relating to an issue in a computing arrangement is received. It is determined that the received alert is similar to a given alert in an information repository containing information of past processes performed to address respective issues, the determining comprising comparing a property associated with the received alert to a property of alerts associated with the past processes, and the information contained in the information repository comprising actions taken in the past processes to address the respective issues. Performance of a remediation action is triggered that comprises an action, identified by the information in the information repository, taken to respond to the given alert.
-
公开(公告)号:US10649917B2
公开(公告)日:2020-05-12
申请号:US15577698
申请日:2015-09-17
Applicant: Hewlett Packard Enterprise Development LP
Inventor: William G. Horne , Amro J. Awad , Pratyusa K. Manadhata
IPC: G06F12/14 , H04L9/06 , G06F12/0895 , G06F12/0875 , H04L9/08
Abstract: Examples relate to efficient storage of initialization vectors in a system. One example facilitates determining an initialization vector for use in encrypting a first cache line of a first page of memory, wherein determining the initialization vector comprises concatenating a page-level counter with a first set of hierarchical counters. The first set of hierarchical counters includes a first counter associated with the first cache line; a first group counter associated with a first group of cache lines, the first group of cache lines comprising the first cache line; and a first cluster counter associated with a first cluster of cache line groups, the first cluster comprising the first group of cache lines.
-
公开(公告)号:US20180219911A1
公开(公告)日:2018-08-02
申请号:US15420521
申请日:2017-01-31
Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
Inventor: Pratyusa K. Manadhata , William G. Horne , Tomas Sander , Manish Marwah , Tomasz Jaroslaw Bania
IPC: H04L29/06
CPC classification number: H04L63/1441 , H04L63/1416 , H04L63/20
Abstract: In some examples, an alert relating to an issue in a computing arrangement is received. It is determined that the received alert is similar to a given alert in an information repository containing information of past processes performed to address respective issues, the determining comprising comparing a property associated with the received alert to a property of alerts associated with the past processes, and the information contained in the information repository comprising actions taken in the past processes to address the respective issues. Performance of a remediation action is triggered that comprises an action, identified by the information in the information repository, taken to respond to the given alert.
-
公开(公告)号:US20180219875A1
公开(公告)日:2018-08-02
申请号:US15420417
申请日:2017-01-31
Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
Inventor: Tomasz Jaroslaw Bania , William G. Horne , Renato Keshet , Pratyusa K. Manadhata , Manish Marwah , Brent James Miller , Barak Raz , Tomas Sander
IPC: H04L29/06
CPC classification number: H04L63/14 , H04L63/1416 , H04L63/1425 , H04L63/20
Abstract: In some examples, a plurality of alerts relating to issues in a computing arrangement are received, where the plurality of alerts generated based on events in the computing arrangement. A subset of the plurality of alerts is grouped into a bundle of alerts, the grouping being based on a criterion. The bundle of alerts is communicated to cause processing of the alerts in the bundle of alerts together.
-
公开(公告)号:US11128641B2
公开(公告)日:2021-09-21
申请号:US15754617
申请日:2015-08-28
Applicant: Hewlett Packard Enterprise Development LP
Inventor: Loai Zomlot , Pratyusa K. Manadhata
Abstract: Example embodiments disclosed herein relate to propagating belief information about malicious and benign nodes. In one example, a domain name system (DNS) resolution graph including multiple nodes is determined. In this example, a first subset of nodes is determined based on an initial benign value or an initial unknown value associated with the respective nodes. In the example, benign belief information is propagated for the first subset based on the respective initial benign values. Moreover, in the example, a second subset of the nodes is determined based on an initial malicious value or an initial unknown value. Malicious belief information is propagated for the second subset based on the respective malicious values. The propagated belief information is copied to a DNS resolution graph.
-
公开(公告)号:US11049026B2
公开(公告)日:2021-06-29
申请号:US15463562
申请日:2017-03-20
Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
Inventor: Pratyusa K. Manadhata , Sandeep Bhatt , Tomas Sander
Abstract: Updating ground truth data in a security management platform is disclosed. One example is a system including at least one processor and a memory storing instructions executable by the at least one processor to receive, in a security management platform, event data relating to a plurality of events corresponding to operation of a computing arrangement in a current time interval, and computing ground truth data for the current time interval based on the received event data, and threat intelligence data from time intervals preceding the current time interval. A prediction model is applied to generate predictions for the current time interval based on the received event data. Ground truth data is re-computed for the time intervals preceding the current time interval based on a comparison of the generated predictions and the computed ground truth data.
-
公开(公告)号:US10671546B2
公开(公告)日:2020-06-02
申请号:US15573597
申请日:2015-09-30
Applicant: Hewlett Packard Enterprise Development LP
Inventor: Amro J. Awad , Pratyusa K. Manadhata , Stuart Haber , William G. Horne
Abstract: A technique includes receiving a request to initialize a region of a memory. Content that is stored in the region is encrypted based at least in part on a stored nonce value and a key. The technique includes, in response to the request, performing cryptographic-based initialization of the memory, including altering the stored nonce value to initialize the region of the memory.
-
-
-
-
-
-
-
-
-