Abstract: A process tree embedding is generated corresponding to a process tree. The process tree comprises a plurality of processes. The process tree embedding is processed with a machine learning model to generate an identification of malware associated with the process tree. In some embodiments, processing the process tree embedding with the machine learning model to generate the identification of malware associated with the process tree includes: processing the process tree embedding with the machine learning model to generate a classification of the process tree as being associated with malware; and, responsive to the classification indicating that the process tree is associated with malware, generating the identification of a first process of the plurality of processes that is relevant to the classification of the process tree as being associated with malware.

Abstract: Techniques are provided to detect irregular interactive command prompt activity. Interactive command prompt activity that is irregular for one user may be regular for another, and therefore the disclosed techniques determine whether interactive command prompt activity is irregular on a user-by-user basis. A sensor in a customer network can detect interactive command prompt use and send event data to a cloud service configured to score the irregularity of the interactive command prompt use. The score can optionally be combined with other information to determine whether alerting the customer network of potentially malicious activity is warranted.

Abstract: A creation of a first process is detected in a kernel space of the operating system executing on a computing device. An exec parent of the first process is determined. The exec parent identifies a second process within an ancestry of the first process that last performed an exec operation prior to the creation of the first process. A unique process identifier (UPID) associated with a process identifier (PID) of the first process is generated. The UPID is associated with the exec parent in a first mapping store that maps the PID to the UPID. Process activity of the first process executing in the operating system is tracked to generate process activity data that comprises the exec parent.

Abstract: Methods and systems for designing a default-deny network egress control architecture in a virtual private cloud (VPC) environment are described herein. According to an implementation, the system may create a first subnet in a private computer network to perform egress control. The system implements a private network address translation (NAT) gateway, a network access control list (NACL), and a private elastic network interface (ENI) in the first subnet. The first subnet may be referred to a “blackhole subnet” or a “terminating subnet.” Upon receiving a traffic destined to a public computer network, e.g., Internet, the private NAT gateway may determine whether the traffic is authorized to egress based on the NACL. The private NAT gateway forwards the traffic to the private ENI to discard the traffic if the traffic is not authorized to egress and logs the information associated with the traffic.

Abstract: A system and method of predicting the probability of exploitation of vulnerabilities of a computing environment. The method includes acquiring one or more environment variables associated with a computing environment. The method includes identifying a vulnerability in the computing environment based on a vulnerability database (VDB) and the one or more environment variables associated with the computing environment. The method includes generating an input dataset based on behavioral-based endpoint detection and response (EDR) data associated with the vulnerability. The method includes providing the input dataset to one or more predictive models respectively trained to predict probabilities of exploitation of vulnerabilities of computing environments based on the input dataset. The method includes generating, by a processing device, a vulnerability risk score for the vulnerability of the computing environment based on the input dataset and the one or more predictive models.

Abstract: The present disclosure provides techniques for red teaming with artificial intelligence (AI) models. A processing device generates, via a first AI model, an agent action space based on security data, where the agent action space is indicative of actions to perform to potentially compromise at least one of a computing system, a network, or an application. The processing device performs a reinforcement learning process with an agent based on the agent action space to obtain a log of the reinforcement learning process. The processing device generates, via a second AI model, a report based on the security data and at least a portion of the log, where the report is indicative of a security weakness of the at least one of the computing system, the network, or the application.

Abstract: Data is received. Each datum therein has one of a plurality of categorical values associated with a categorical variable. Each datum is deterministically mapped to a respective one of a plurality of colors in a color space based on its categorical value. The color to which each datum is deterministically mapped is then transformed to yield a minimum threshold separation between the respective colors. A graphical representation comprising the color to which each datum is respectively deterministically mapped, and as transformed to yield the minimum threshold separation between the respective colors, is displayed.

Abstract: A permissive computing resource service detects unauthorized hardware processing assigned to an auxiliary data processing unit (DPU). The DPU is commonly a graphics processing unit (GPU), but unauthorized hardware processing may be detected in other hardware accelerators. When tasks are assigned to the DPU/GPU, responsible parties are notified of the tasks assigned to the DPU/GPU. The responsible parties may thus respond with hardware processing authorizations that authorize the DPU/GPU to execute the tasks. If, however, one or more of the responsible parties fails to reply, or denies, then the DPU/GPU is not authorized to execute the tasks. The tasks, for example, may represent impermissible usage of the DPU/GPU or unsafe/abnormal behavior. The tasks may thus represent DPU hardware processing theft.

Abstract: Contextual session-based operational prediction greatly improves computer functioning. As a cloud service is provided, a current contextual session is generated using multiple events provided by the cloud service. The current contextual session is compared to a contextual session profile. The contextual session profile represents historical contextual sessions that have been historically logged in associated with the cloud service. If the current contextual session conforms to the contextual session profile, then the cloud service is normally operating as historically observed and may be predicted as normal operation. If, however, the current contextual session fails to conform to the contextual session profile, then the cloud service is not operating as historically observed and may be predicted as abnormal operation. Alerts and warning may be generated to notify of abnormal cloud service operation.

Abstract: An artificial intelligence (AI) monitoring service detects, in real time or in near real time, misbehaving AI. The AI monitoring service monitors any of inputs to the AI, incoming/outgoing communications, API calls, inter-service/inter-container activities associated with the AI, and/or an output generated by the AI. Any activity conducted by, or associated with, the AI may be compared to an AI behavior profile defining permissible/impermissible activities. If any activity fails to conform to the AI behavior profile, alerts are sent and threat procedures are implemented. Very early stages of abnormal AI behavior are detected, thus quickly exposing abnormal AI behavior before the artificial intelligence can implement undesirable, or even harmful, actions.

Abstract: A cybersecurity event validation service provides a user-friendly scheme for detecting a cyberattack or threat. The cybersecurity event validation service accepts very simple, high-level, user-friendly descriptions of the cyberattack or threat. A user of the cybersecurity event validation service thus need not input detailed hardware/software events that specify the potential cyberattack or threat. The cybersecurity event validation service, instead, validates the user's very simple descriptions for correctness. If the user's very simple descriptions conform to basic rules or requirements, then the cybersecurity event validation service elegantly fills in the deep hardware and software details using context and inferences. The cybersecurity event validation service thus elaborates and enhances the user's very simple descriptions by supplying specific hardware/software details needed to detect the cyberattack or threat.

Abstract: Prediction of matches between CPEs and banners greatly improves computer functioning. Many web services have an unknown common platform enumeration (CPE). When the CPE is unknown, a computer system is unable to obtain cybersecurity flaws and software fixes for a software product or web service. A similarity between the CPE and a service banner, though, accurately predicts a match the CPE and the web service. CPEs, for example, may thus be identified for old, obsolete, and uncomment software products and services.

Abstract: A value is assigned to a rate threshold for adding child nodes to a distinct parent node in a tree data structure. A first datum comprising a first variable assigned a first value and a second variable assigned a first value is added to the tree at a first timestamp, by adding to the first level in the tree a first parent node representing the first variable assigned the first value and adding to the second level in the tree a first child node representing the second variable assigned the first value and connected by a first directed edge from the first parent node. A second datum comprising the first variable assigned the first value and the second variable assigned a second value is received at a second timestamp. The method blocks adding to the second level in the tree a second child node representing the second variable assigned the second value and connected by a second directed edge from the first parent node when a rate based on the first timestamp and the second timestamp exceeds the rate threshold.

Abstract: Techniques for using supervised machine learning to train risk models used to analyze group data for security risks are discussed herein. A system can receive a user input identifying risk values associated with categories or attributes of a group having access to computing resources. The system can use the risk model to generate a risk score for the group. The risk score can be used to further analyze aspects of the group or provide recommendations to reduce or eliminate security risks.

Abstract: Deception-based techniques for responding to security attacks are described herein. The techniques include transitioning a security attack to a monitored computing device posing as a computing device impacted by the security attack and enabling the adversary to obtain deceptive information from the monitored computing device. Also, the adversary may obtain a document configured to report identifying information of an entity opening the document, thereby identifying the adversary associated with the attack. Further, the techniques include determining that a domain specified in a domain name request is associated with malicious activity and responding to the request with a network address of a monitored computing device to cause the requesting process to communicate with the monitored computing device in place of an adversary server. Additionally, a service may monitor dormant domains names associated with malicious activity and, in response to a change, respond with an alert or a configuration update.

Abstract: Multi-modal query processing greatly improves computer functioning. A single cybersecurity sensory nodal server concurrently processes standing queries, agent point queries, and agent fleet queries. The single cybersecurity sensory nodal server is dedicated to locally storing electronic data associated with a cybersecurity sensory agent installed at a client device. Because the single cybersecurity sensory nodal server locally stores the single source of the electronic data, the single cybersecurity sensory nodal server answers the standing queries, agent point queries, and agent fleet queries using less hardware resources, less network resources, less electrical energy, and less time.

Abstract: A system and method of using generative AI to identify exposures of computing devices on computing networks to actual and/or potential threats. The method includes collecting a plurality of responses from a plurality of devices to a target device on a private network. The method includes providing the plurality of responses to a classification model trained to assign device descriptions for device responses based on semantic matching of the device responses to database data. The method includes assigning, by the processing device using the classification model, a plurality of device descriptions for the plurality of responses to the target device, each response is respectively associated with one or more device descriptions of the plurality of device descriptions. The method includes generating, based on the plurality of device descriptions, a status report comprising a list of network addresses associated with a group of devices having access to the target device.

Abstract: The present disclosure provides techniques for AI model-based detection explainability. A processing device obtains computer-readable text and an indication of a false positive detection of malicious behavior with respect to the computer-readable text by a cybersecurity system, The processing device obtains, via an artificial intelligence (AI) model trained to generate language, a reason for the false positive detection of the malicious behavior. The processing device provides an indication of the reason for the false positive detection to a destination device.

Abstract: IT asset discovery services and external attack surface management (or EASM) services identify computers, servers, smartphones, and other devices that are exposed to the public Internet. Any device that can connect to the public Internet may be vulnerable to cybersecurity attacks. The services identify a device exposed to the public Internet by generating an asset inventory discovery graph. Graphical nodes describe asset inventory investigative records, and edges between the graphical nodes describe asset inventory investigative methods. The nodes thus capture asset investigatory details (such as website URL, IP addresses, and HTML content), and the edges capture how the asset investigatory details were discovered (such as Internet searches, DNS records, and WHOIS records). The services use the asset inventory discovery graph to identify an entity's Internet-facing assets.

Abstract: A cloud-based file integrity monitoring service identifies content changes to a computer file. An endpoint cybersecurity agent monitors its host client device for read/write and other operating system events associated with the computer file. When the endpoint cybersecurity agent detects each operating system event, the endpoint cybersecurity agent captures and reports, in real time or near real time, a snapshot of the file content representing the computer file. So, as the host client device changes the computer file with each operating system event, the endpoint cybersecurity agent uploads timestamped snapshots of the file content to a cloud-based file integrity monitoring service. The cloud-based file integrity monitoring service stores each snapshot of the file content, thus logging a change history for the computer file.