Abstract: Systems and methods for efficiently detecting and monitoring transmitted documents. The invention provides efficient, scalable, and accurate means to identify anomalous or suspicious access patterns, and related and similar documents based upon their content and their structural characteristics. Transmitted documents that are encrypted may be monitored without revealing the encrypted information.
Abstract: Systems and methods for generating and deploying decoy files and decoy applications that appear to be authentic files and applications. The content of the decoy files may be configurable, and the decoy files may be beaconized. The extent to which decoy files are and decoy applications are deployed may depend on the authentication level or change in authentication level of a user.
Abstract: A system that generates decoy emails and documents by automatically detecting concepts such as dates, times, people, and locations in e-mails and documents, and shifting those concepts. The system may also generate an email or document reciting a URL associated with a fake website and purported login credentials for the fake website. The system may send an alert to a user of the system when someone seeks to access the fake website.
Abstract: The interaction of a plurality of users with a computer system is monitored and measurements are made of different features of this interaction such as process creation, registry key changes, and file system actions. These measurements are then analyzed to identify those features that are more discriminatory. The set of features is then used to develop for each user a model of his/her interaction with the computer system that can then be used to authenticate that user when interacting with the computer system at a later time. Advantageously, these steps are performed automatically and may be performed periodically or even continuously to verify that each user of the computer system is indeed the individual he/she purports to be. Illustratively, the feature extraction is performed using Fisher's criteria; and the user model is developed using a Gaussian mixture model. A method for updating the user model is also disclosed.
Abstract: The interaction of a plurality of users with a computer system is monitored and measurements are made of different features of this interaction such as process creation, registry key changes, and file system actions. These measurements are then analyzed to identify those features that are more discriminatory. The set of features is then used to develop for each user a model of his/her interaction with the computer system that can then be used to authenticate that user when interacting with the computer system at a later time. Advantageously, these steps are performed automatically and may be performed periodically or even continuously to verify that each user of the computer system is indeed the individual he/she purports to be. Illustratively, the feature extraction is performed using Fisher's criteria; and the user model is developed using a Gaussian mixture model. A method for updating the user model is also disclosed.