公开(公告)号：US20220129806A1

公开(公告)日：2022-04-28

申请号：US17568684

申请日：2022-01-04

Applicant: Palantir Technologies Inc.

Inventor： Alexander Maass ,  Ben Regev ,  Duncan Hoffman ,  Eugene Mak ,  Elise Norman ,  Elizabeth Patitucci ,  Yevhen Shevchuk ,  Harkirat Singh ,  Joshua Aschheim ,  Juan Jimenez Puig ,  Jorien Van Den Bergh ,  Kai Kamberger ,  Maciej Biskupiak ,  Marissa Miracolo ,  Matthew Julius Wilson ,  Nicolas Prettejohn ,  Patrick Walter ,  Rootul Patel ,  Stephen Heitkamp ,  Richard Deitch

IPC: G06Q10/06 ,  G06Q20/10

Abstract: A customer risk trigger associated with a customer may be identified. A response to the customer risk trigger may be detected. First risk analysis data related to the customer risk trigger may be gathered, based on the response, from a first datastore. Second risk analysis data related to the customer risk trigger may be gathered, based on the response, from a second datastore. A customer risk profile to model risk attribute(s) of the customer may be gathered. The risk attributes may represent a risk correlation between the customer and a prohibited act. Customer risk visualization tool(s) configured to facilitate visual user interaction with the customer risk profile may be gathered. The customer risk visualization tools may be rendered in a display of the computing system. The customer risk visualization tools provide a customer-centric view of risk for various applications, including anti-money laundering applications.

公开(公告)号：US20180337952A1

公开(公告)日：2018-11-22

申请号：US15923949

申请日：2018-03-16

Applicant: Palantir Technologies Inc.

Inventor： Jacob Albertson ,  Melody Hildebrandt ,  Harkirat Singh ,  Shyam Sankar ,  Rick Ducott ,  Peter Maag ,  Marissa Kimball

IPC: H04L29/06 ,  G06F21/50 ,  G06F21/55

CPC classification number: H04L63/20 ,  G06F21/50 ,  G06F21/55 ,  H04L63/14 ,  H04L63/1441

Abstract: Systems and techniques for sharing security data are described herein. Security rules and/or attack data may be automatically shared, investigated, enabled, and/or used by entities. A security rule may be enabled on different entities comprising different computing systems to combat similar security threats and/or attacks. Security rules and/or attack data may be modified to redact sensitive information and/or configured through access controls for sharing.

公开(公告)号：US20180159874A1

公开(公告)日：2018-06-07

申请号：US15891873

申请日：2018-02-08

Applicant: Palantir Technologies Inc.

Inventor： Juan Ricafort ,  Harkirat Singh ,  Philip Martin

IPC: H04L29/06 ,  H04L29/12 ,  G06F21/55

CPC classification number: H04L63/1416 ,  G06F21/556 ,  H04L61/2007 ,  H04L63/0272 ,  H04L63/1425 ,  H04L63/1441

Abstract: Various systems and methods are provided that detect malicious network tunneling. For example, VPN logs and data connection logs may be accessed. The VPN logs may list client IP addresses that have established a VPN connection with an enterprise network. The data connection logs may list client IP addresses that have requested connections external to the enterprise network and remote IP addresses to which connections are requested. The VPN logs and the data connection logs may be parsed to identify IP addresses that are present in the VPN logs as a client IP address and in the data connection logs as a remote IP address. If an IP address is so present, user data and traffic data associated with the IP address may be retrieved to generate a risk score. If the risk score exceeds a threshold, an alert to be displayed in a GUI is generated.

公开(公告)号：US09419992B2

公开(公告)日：2016-08-16

申请号：US14823935

申请日：2015-08-11

Applicant: Palantir Technologies Inc.

Inventor： Juan Ricafort ,  Harkirat Singh ,  Philip Martin

IPC: G06F12/14 ,  H04L29/06 ,  H04L29/12 ,  G06F21/55

CPC classification number: H04L63/1416 ,  G06F21/556 ,  H04L61/2007 ,  H04L63/0272 ,  H04L63/1425 ,  H04L63/1441

Abstract: Various systems and methods are provided that detect malicious network tunneling. For example, VPN logs and data connection logs may be accessed. The VPN logs may list client IP addresses that have established a VPN connection with an enterprise network. The data connection logs may list client IP addresses that have requested connections external to the enterprise network and remote IP addresses to which connections are requested. The VPN logs and the data connection logs may be parsed to identify IP addresses that are present in the VPN logs as a client IP address and in the data connection logs as a remote IP address. If an IP address is so present, user data and traffic data associated with the IP address may be retrieved to generate a risk score. If the risk score exceeds a threshold, an alert to be displayed in a GUI is generated.

Abstract translation: 提供了检测恶意网络隧道的各种系统和方法。 例如，可以访问VPN日志和数据连接日志。 VPN日志可以列出已经与企业网络建立VPN连接的客户端IP地址。 数据连接日志可能列出已请求企业网络外部连接的客户端IP地址以及请求连接的远程IP地址。 可以解析VPN日志和数据连接日志，以将VPN日志中存在的IP地址识别为客户端IP地址，并将数据连接日志标识为远程IP地址。 如果IP地址如此存在，则可以检索与IP地址相关联的用户数据和流量数据以产生风险分数。 如果风险分数超过阈值，则生成要在GUI中显示的警报。

公开(公告)号：US11593374B2

公开(公告)日：2023-02-28

申请号：US16933688

申请日：2020-07-20

Applicant: Palantir Technologies Inc.

Inventor： Huw Pryce ,  James Neale ,  Robert Fink ,  Jared Newman ,  Graham Dennis ,  Viktor Nordling ,  Artur Jonkisz ,  Daniel Fox ,  Felix de Souza ,  Harkirat Singh ,  Mark Elliot

IPC: G06F16/00 ,  G06F16/2455 ,  G06F16/25 ,  G06F16/2458

Abstract: Computer-implemented techniques for data extraction are described. The techniques include a method and system for retrieving an extraction job specification, wherein the extraction job specification comprises a source repository identifier that identifies a source repository comprising a plurality of data records; a data recipient identifier that identifies a data recipient; and a schedule that indicates a timing of when to retrieve the plurality of data records. The method and system further include retrieving the plurality of data records from the source repository based on the schedule, creating an extraction transaction from the plurality of data records, wherein the extraction transaction comprises a subset of the plurality of data records and metadata, and sending the extraction transaction to the data recipient.

公开(公告)号：US11587177B2

公开(公告)日：2023-02-21

申请号：US14919506

申请日：2015-10-21

Applicant: Palantir Technologies Inc.

Inventor： Shyam Sankar ,  Jacob Albertson ,  Melody Hildebrandt ,  Harkirat Singh ,  Rick Ducott ,  Peter Maag ,  Marissa Kimball

IPC: H04L29/06 ,  G06Q40/08 ,  H04L9/40

Abstract: Methods, devices, systems and computer program products enable monitoring and responding to cyber security attacks. One such system relates to a consortium of monitoring companies and an infrastructure including one or more central monitoring stations or local handling stations for a monitoring company are provided. A central monitoring station of a monitoring company detects a cyberattack that has been launched against a client computer system, and requests a local station to respond to the cyberattack via onsite visits or requests additional resources from other monitoring companies through the consortium system. The central monitoring station also sends to the consortium system updates on a cyberattack that is detected or mitigated by a central monitoring station or local handling station of the monitoring company. The monitoring consortium enables stronger capabilities than any individual monitoring company can offer by the combination and coordination of the efforts and resources of the members.

公开(公告)号：US20220239672A1

公开(公告)日：2022-07-28

申请号：US17658893

申请日：2022-04-12

Applicant: Palantir Technologies Inc.

Inventor： Harkirat Singh ,  Geoffrey Stowe ,  Brendan Weickert ,  Matthew Sprague ,  Michael Kross ,  Adam Borochoff ,  Parvathy Menon ,  Michael Harris

IPC: H04L9/40 ,  G06Q40/00 ,  G06F16/2457 ,  G06F16/23 ,  G06F16/242 ,  G06F16/28 ,  G06F16/9535 ,  G06Q10/10 ,  G06Q40/02 ,  G06F16/335 ,  G06F16/35 ,  G06F16/26 ,  G06F16/2458 ,  G06Q20/40 ,  G06Q30/00 ,  G06Q20/38

Abstract: In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

公开(公告)号：US10264014B2

公开(公告)日：2019-04-16

申请号：US14928512

申请日：2015-10-30

Applicant: Palantir Technologies Inc.

Inventor： Geoff Stowe ,  Harkirat Singh ,  Stefan Bach ,  Matthew Sprague ,  Michael Kross ,  Adam Borochoff ,  Parvathy Menon ,  Michael Harris

IPC: G06Q40/00 ,  H04L29/06 ,  G06Q20/38 ,  G06F17/30

Abstract: In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

公开(公告)号：US20190034488A1

公开(公告)日：2019-01-31

申请号：US16147687

申请日：2018-09-29

Applicant: Palantir Technologies Inc.

Inventor： HUW PRYCE ,  James Neale ,  Robert Fink ,  Jared Newman ,  Graham Dennis ,  Viktor Nordling ,  Artur Jonkisz ,  Daniel Fox ,  Felix de Souza ,  Harkirat Singh ,  Mark Elliot

IPC: G06F17/30

Abstract: Computer-implemented techniques for data extraction are described. The techniques include a method and system for retrieving an extraction job specification, wherein the extraction job specification comprises a source repository identifier that identifies a source repository comprising a plurality of data records; a data recipient identifier that identifies a data recipient; and a schedule that indicates a timing of when to retrieve the plurality of data records. The method and system further include retrieving the plurality of data records from the source repository based on the schedule, creating an extraction transaction from the plurality of data records, wherein the extraction transaction comprises a subset of the plurality of data records and metadata, and sending the extraction transaction to the data recipient.

公开(公告)号：US20180032575A1

公开(公告)日：2018-02-01

申请号：US15225437

申请日：2016-08-01

Applicant: Palantir Technologies Inc.

Inventor： HUW PRYCE ,  James Neale ,  Robert Fink ,  Jared Newman ,  Graham Dennis ,  Viktor Nordling ,  Artur Jonkisz ,  Daniel Fox ,  Felix de Souza ,  Harkirat Singh ,  Mark Elliot

IPC: G06F17/30

CPC classification number: G06F17/30477 ,  G06F17/30533 ,  G06F17/30563

Abstract: Computer-implemented techniques for data extraction are described. The techniques include a method and system for retrieving an extraction job specification, wherein the extraction job specification comprises a source repository identifier that identifies a source repository comprising a plurality of data records; a data recipient identifier that identifies a data recipient; and a schedule that indicates a timing of when to retrieve the plurality of data records. The method and system further include retrieving the plurality of data records from the source repository based on the schedule, creating an extraction transaction from the plurality of data records, wherein the extraction transaction comprises a subset of the plurality of data records and metadata, and sending the extraction transaction to the data recipient.