利索-全球专利检索

  1. Login
  2. Sign Up

Search Results

6918 records (took 0.047 seconds)

    DETECTION OF CYBERSECURITY THREATS UTILIZING ESTABLISHED BASELINES
    71.
    发明公开
    DETECTION OF CYBERSECURITY THREATS UTILIZING ESTABLISHED BASELINES 审中-公开

    公开(公告)号：US20240089272A1

    公开(公告)日：2024-03-14

    申请号：US18361415

    申请日：2023-07-28

    Applicant: Wiz, Inc.

    Inventor： Itamar GILAD ,  Aviel FOGEL ,  Udi REITBLAT ,  Alon SCHINDEL ,  Ami LUTTWAK ,  Roy REZNIK ,  Yinon COSTICA

    IPC: H04L9/40

    CPC classification number: H04L63/1416 ,  H04L63/1441

    Abstract: A system and method for reducing false positive detection of cybersecurity events is disclosed. The method includes: configuring a plurality of resources to deploy a sensor, each sensor configured to listen on a data link layer for an event; receiving from each sensor a plurality of events, each event including an event type; generating a group of resources having a common attribute; generating a noise metric for the group of resources based on a number of events of an event type; generating a threshold based on the noise metric; configuring each sensor of a resource from the group of resources to detect a number of events exceeding the threshold; detecting a cybersecurity event in response to determining that a first resource from the group of resources has a number of events of a first type exceeding the threshold; and initiating a mitigation action based on the detected cybersecurity event

    INDIVIDUAL DATA UNIT AND METHODS AND SYSTEMS FOR ENHANCING THE SECURITY OF USER DATA
    72.
    发明公开
    INDIVIDUAL DATA UNIT AND METHODS AND SYSTEMS FOR ENHANCING THE SECURITY OF USER DATA 审中-公开

    公开(公告)号：US20240086572A1

    公开(公告)日：2024-03-14

    申请号：US18513407

    申请日：2023-11-17

    Applicant: Richard Jay LANGLEY

    Inventor： Richard Jay LANGLEY

    IPC: G06F21/62 ,  G06F11/14 ,  G06F21/60 ,  H04L9/08 ,  H04L9/40

    CPC classification number: G06F21/6245 ,  G06F11/1464 ,  G06F11/1469 ,  G06F21/602 ,  H04L9/0894 ,  H04L63/10 ,  H04L63/1441 ,  G06F2201/805

    Abstract: An individual data unit for enhancing the security of a user data record is provided that includes a processor and a memory configured to store data. The individual data unit is associated with a network and the memory is in communication with the processor. The memory has instructions stored thereon which, when read and executed by the processor cause the individual data unit to perform basic operations only. The basic operations include communicating securely with computing devices, computer systems, and a central user data server. Moreover, the basic operations include receiving a user data record, storing the user data record, retrieving the user data record, and transmitting the user data record. The individual data unit can be located in a geographic location associated with the user which can be different than the geographic locations of the computer systems and the central user data server.

    Domain-Specific Language Simulant for Simulating a Threat-Actor and Adversarial Tactics, Techniques, and Procedures
    74.
    发明公开
    Domain-Specific Language Simulant for Simulating a Threat-Actor and Adversarial Tactics, Techniques, and Procedures 审中-公开

    公开(公告)号：US20240080335A1

    公开(公告)日：2024-03-07

    申请号：US18385272

    申请日：2023-10-30

    Applicant: Qualys, Inc.

    Inventor： Mayuresh Vishwas Dani ,  Ankur S. Tyagi

    IPC: H04L9/40

    CPC classification number: H04L63/1433 ,  H04L63/14 ,  H04L63/1425 ,  H04L63/1441

    Abstract: The present describes simulating a threat-actor executing an attack execution operation. According to one aspect of the subject matter described in this disclosure, a method for generating a domain-specific language (DSL) simulant is disclosed. The method may comprise determining, a framework based on an attack repository, determining a first primitive based on the framework, and determining a second primitive based on the framework. In one implementation, the first primitive and the second primitive are fundamental structures or constructs within a DSL. The method further comprises combining the first primitive and the second primitive into a DSL simulant. In one implementation, the DSL simulant is executed to simulate a threat-actor executing an attack execution operation.

    Method and mechanism for detection of pass-the-hash attacks
    79.
    发明授权
    Method and mechanism for detection of pass-the-hash attacks 有权

    公开(公告)号：US11916953B2

    公开(公告)日：2024-02-27

    申请号：US16579215

    申请日：2019-09-23

    Applicant: Cybereason, Inc.

    Inventor： Phillip Tsukerman

    IPC: H04L9/40

    CPC classification number: H04L63/1441

    Abstract: A method of generating a baseline of expected behavior on a single machine or endpoint to accurately fingerprint the native behavior of the NTLM protocol on that particular endpoint in a network. By limiting the scope of a baseline to a single endpoint, the scope of the baseline can consist of expected behavior (including supported hash functions, version strings and various feature flags). Deviations from these behaviors are considered evidence of a redundant implementation of NTLM utilized by an attacker and thus as evidence of an attempted PTH attack. Using this method it is possible to accurately detect PTH attacks originating from all publicly known non-standard implementations of NTLM existing in tools such as Impacket, Metasploit, and Invoke-TheHash.

Patent Agency Ranking