Responding to alerts
    14.
    发明授权

    公开(公告)号:US11240263B2

    公开(公告)日:2022-02-01

    申请号:US15420521

    申请日:2017-01-31

    Abstract: In some examples, an alert relating to an issue in a computing arrangement is received. It is determined that the received alert is similar to a given alert in an information repository containing information of past processes performed to address respective issues, the determining comprising comparing a property associated with the received alert to a property of alerts associated with the past processes, and the information contained in the information repository comprising actions taken in the past processes to address the respective issues. Performance of a remediation action is triggered that comprises an action, identified by the information in the information repository, taken to respond to the given alert.

    Efficiently storing intialization vectors

    公开(公告)号:US10649917B2

    公开(公告)日:2020-05-12

    申请号:US15577698

    申请日:2015-09-17

    Abstract: Examples relate to efficient storage of initialization vectors in a system. One example facilitates determining an initialization vector for use in encrypting a first cache line of a first page of memory, wherein determining the initialization vector comprises concatenating a page-level counter with a first set of hierarchical counters. The first set of hierarchical counters includes a first counter associated with the first cache line; a first group counter associated with a first group of cache lines, the first group of cache lines comprising the first cache line; and a first cluster counter associated with a first cluster of cache line groups, the first cluster comprising the first group of cache lines.

    RESPONDING TO ALERTS
    16.
    发明申请

    公开(公告)号:US20180219911A1

    公开(公告)日:2018-08-02

    申请号:US15420521

    申请日:2017-01-31

    CPC classification number: H04L63/1441 H04L63/1416 H04L63/20

    Abstract: In some examples, an alert relating to an issue in a computing arrangement is received. It is determined that the received alert is similar to a given alert in an information repository containing information of past processes performed to address respective issues, the determining comprising comparing a property associated with the received alert to a property of alerts associated with the past processes, and the information contained in the information repository comprising actions taken in the past processes to address the respective issues. Performance of a remediation action is triggered that comprises an action, identified by the information in the information repository, taken to respond to the given alert.

    Propagating belief information about malicious and benign nodes

    公开(公告)号:US11128641B2

    公开(公告)日:2021-09-21

    申请号:US15754617

    申请日:2015-08-28

    Abstract: Example embodiments disclosed herein relate to propagating belief information about malicious and benign nodes. In one example, a domain name system (DNS) resolution graph including multiple nodes is determined. In this example, a first subset of nodes is determined based on an initial benign value or an initial unknown value associated with the respective nodes. In the example, benign belief information is propagated for the first subset based on the respective initial benign values. Moreover, in the example, a second subset of the nodes is determined based on an initial malicious value or an initial unknown value. Malicious belief information is propagated for the second subset based on the respective malicious values. The propagated belief information is copied to a DNS resolution graph.

    Updating ground truth data in a security management platform

    公开(公告)号:US11049026B2

    公开(公告)日:2021-06-29

    申请号:US15463562

    申请日:2017-03-20

    Abstract: Updating ground truth data in a security management platform is disclosed. One example is a system including at least one processor and a memory storing instructions executable by the at least one processor to receive, in a security management platform, event data relating to a plurality of events corresponding to operation of a computing arrangement in a current time interval, and computing ground truth data for the current time interval based on the received event data, and threat intelligence data from time intervals preceding the current time interval. A prediction model is applied to generate predictions for the current time interval based on the received event data. Ground truth data is re-computed for the time intervals preceding the current time interval based on a comparison of the generated predictions and the computed ground truth data.

Patent Agency Ranking