Abstract: A system and method for machine learning training is presented. A method includes clustering cybersecurity alerts from different alert sources into clusters based on features distances between alerts. A subset of the cybersecurity alerts is selected from each cluster based on the cluster center of the cluster. Each subset is presented via a user device in order to obtain a set of user inputs with respect to each presented subset. A training set is created based on the user inputs with respect to each presented subset. The training set includes the cybersecurity alerts and corresponding training prioritizations. A prioritization machine learning model is trained to prioritize cybersecurity alerts from the plurality of alert sources using the training set.

Abstract: A system and method for parsing. A method includes iteratively refining outputs of a language model in a series of iterations until a set of expected results output by the language model at an iteration matches at least a portion of a parser output of a parser at the iteration. Each iteration includes: querying the language model using a query, wherein the query includes a target file structure to be output by the language model and a set of example code, wherein the language model outputs the file and a set of expected results; inputting a file to the parser in order to obtain a parser output; and comparing the set of expected results output by the language model to at least a portion of the parser output.

Abstract: A system and method for machine learning training. A method includes clustering cybersecurity alerts from different alert sources into clusters based on features distances between alerts. A subset of the cybersecurity alerts is selected from each cluster based on the cluster center of the cluster. Each subset is presented via a user device in order to obtain a set of user inputs with respect to each presented subset. A training set is created based on the user inputs with respect to each presented subset. The training set includes the cybersecurity alerts and corresponding training prioritizations. A prioritization machine learning model is trained to prioritize cybersecurity alerts from the plurality of alert sources using the training set.

Abstract: A system and method for software container remediation. A method includes determining that a vulnerability of a software container resides in a first origin image of the software container at least partially by identifying a plurality of derived container images referencing the origin image which have the vulnerability, wherein a first derived container image of the plurality of derived container images is used to run the software container; and rebuilding the first derived container image using contents of a second origin image, wherein the second origin image avoids the vulnerability.

Abstract: A system and method for temporal cause analysis of cybersecurity events. A method includes: creating a plurality of time series pairs for a computing environment, wherein each time series pair includes a first time series and a second time series, wherein each time series includes a series of data points arranged by time; determining a temporal relationship for at least one first time series pair of the plurality of time series pairs based on the series of data points of each time series of each of the plurality of time series pairs; identifying a root cause of a cyber event based on the temporal relationship of the at least one first time series pair; and remediating the cyber event based on the identified root cause.

Abstract: A system and method for temporal cause analysis of cybersecurity events. A method includes creating a time series pair including a first time series and a second time series each including a series of data points arranged by time. A distance is determined between the first and second time series based on the data points of the first and second time series. A match is identified between the first and second time series based on the distance. An antecedent-consequent relationship is determined for the time series pair based on the match. The first time series is determined as an antecedent time series and the second time series is determined as a consequent time series. A root cause of a cyber event is identified based on the antecedent-consequent relationship where the cyber event is represented in the second time series, and the root cause is represented in the first time series.

Abstract: A system and method for code fingerprinting. A method includes scanning a code repository including software components by executing fingerprinting code on the code repository in order to generate statistics vectors for the software components. The fingerprinting code includes instructions for performing a text search to identify instances of patterns in the code repository and to generate the statistics vectors based on the identified pattern instances. The statistics vectors are clustered with respect to groupings of software components. The statistics vectors are aggregated by combining values of respective statistics in the statistics vectors belonging to the same clusters. An anomaly is detected based on the aggregated statistics vectors. One or more remedial actions are performed with respect to the software components based on the detected anomaly.

Abstract: A system and method for code fingerprinting. A method includes generating fingerprinting code based on a knowledge base, wherein the knowledge base includes a plurality of nodes representing respective software components of a plurality of software components, wherein the fingerprinting code includes instructions that, when executed by a processing circuitry, configure the processing circuitry to perform a text search in order to identify patterns in at least one code repository defined with respect to the knowledge base and to generate statistical data about the identified patterns; and causing the fingerprinting code to run on the at least one code repository, wherein causing the fingerprinting code to run further comprises executing the instructions of the fingerprinting code in order to scan the at least one code repository.

Abstract: A system and method for mitigating alerts using network path resolution. A method includes identifying resolution routes based on communications between entities. Each resolution route is a series of connections among the plurality of connections beginning at a starting entity of the plurality of entities and concluding at an ending entity of the plurality of entities. Paths correspond to respective resolution routes are created in a graph. A heatmap is generated based on a number of instances in which each path resolved to a respective workload. Nodes of the heatmap include heat values determined based on the number of instances in which each path resolved to one of the workloads. A first path is identified among the paths based on the heatmap and an alert, wherein the identified first path leads to a first computing resource of the plurality of computing resources indicated in the alert.

Abstract: A system and method for machine learning training. A method includes clustering cybersecurity alerts from different alert sources into clusters based on features distances between alerts. A subset of the cybersecurity alerts is selected from each cluster based on the cluster center of the cluster. Each subset is presented via a user device in order to obtain a set of user inputs with respect to each presented subset. A training set is created based on the user inputs with respect to each presented subset. The training set includes the cybersecurity alerts and corresponding training prioritizations. A prioritization machine learning model is trained to prioritize cybersecurity alerts from the plurality of alert sources using the training set.

Abstract: A system and method for alert mitigation. A method includes identifying timestamps in log data with respect to a graph. The nodes include computing resource nodes representing computing resources and user nodes representing entities which make changes to the computing infrastructure with respect to the computing resources. Temporal variations of the graph are created by assigning a time value to each edge based on the identified timestamps, where the time value assigned to each edge represents a time of a change in the computing infrastructure. A temporal variation is retrieved from the graph based on a time. The retrieved temporal variation includes a subset of the nodes and edges determined based on the time value assigned to each edge. A root cause of an alert is determined based on the retrieved temporal variation. Mitigation actions are performed based on the root cause.

Abstract: A system and method for securing deployment of computing infrastructure resources.

Abstract: Systems and methods for alert deduplication. A method includes querying a software component associations database based on a plurality of software containers indicated by a plurality of alerts in order to identify a plurality of correlations between software containers among the plurality of software containers, wherein the software component associations database stores at least associations between configuration files of the plurality of software containers and build files used to build the plurality of software containers; identifying at least one set of duplicate alerts among the plurality of alerts based on the identified plurality of correlations, wherein each set of duplicate alerts includes at least two alerts of the plurality of alerts which indicate correlated software containers among the plurality of software containers; and deduplicating the plurality of alerts based on the identified at least one set of duplicate alerts in order to produce a deduplicated set of alerts.

Abstract: A system and method for remediating cybersecurity events. A method includes creating a semantic concepts dictionary defining semantic concepts representing characteristics of software components. An entity graph is created based on correlations between entities, where the entity graph has nodes representing respective entities and the entities include software components of a software infrastructure as well as event logic components of cybersecurity event logic deployed with respect to the software infrastructure. A knowledge base is built such that the knowledge base includes the semantic concepts dictionary and the entity graph. The knowledge base is queried using a query generated based on one or more semantic concepts and one or more entity-identifying values extracted from cybersecurity event data. The query includes at least one semantic concept and at least one entity-identifying value. One or more remedial actions are performed based on one or more query results from the knowledge base.

Abstract: A system and method for software containers attribution are provided. The method includes de-compiling a configuration file of a container image of a software container; identifying at least one candidate build file in the de-compiled configuration file, wherein the at least one candidate build potentially formed the container image; determining if at least one matching condition is satisfied between each of the at least one candidate build file and the de-compiled configuration file; associating the configuration file with each candidate build file satisfying the matching condition; and updating an inventory with the associated configuration file and the respective candidate build, wherein such association provides a direct mapping between the container image and the build files formed the container image.

Abstract: A system and method for alert prioritization. A method includes applying a prioritization machine learning model with respect to a plurality of second cybersecurity alerts from a plurality of alert sources. The prioritization machine learning model is trained based on a training set to prioritize cybersecurity alerts across the plurality of alert sources. The training set includes a plurality of first cybersecurity alerts from the plurality of alert sources and a plurality of corresponding training prioritizations for the plurality of first cybersecurity alerts. A priority is determined for the plurality of cybersecurity alerts based on outputs of the prioritization model. A plurality of remediation actions is performed based on the determined priority.

Abstract: Systems and methods for alert management. A method includes analyzing alerts with respect to cybersecurity issues indicated in the alerts to identify at least one group of matching alerts. Each group of matching alerts includes alerts generated by multiple cybersecurity detection tools. A software component associations database is queried based on software components indicated in each of the groups of alerts. The software component associations database stores associations between configuration files of software containers and build files used to build the software containers. At least one group of duplicate alerts is identified among the groups of matching alerts based on associations returned by the software component associations database. The software component indicated by a first alert of each group of duplicate alerts is associated with the software component indicated by a second alert of the group of duplicate alerts. The alerts are managed based on the groups of duplicate alerts.

Abstract: A system and method for mitigating alerts using network path resolution. A method includes generating a graph mapping between computing resources and workloads, wherein the graph includes nodes and edges, wherein the nodes include computing resource nodes representing respective computing resources and workload nodes representing respective workloads, wherein each workload is at least one process; identifying a path including at least one first workload of the workloads by querying the graph based on a first computing resource of the computing resources indicated in an alert; identifying at least one root cause of an alert based on the identified path; and performing at least one mitigation action based on the identified at least one root cause.

Abstract: A system and method for remediating alerts using graph exploration. A method includes creating a graph including a plurality of nodes and a plurality of edges, wherein the plurality of nodes includes a plurality of computing resource nodes representing respective computing resources among a computing infrastructure and a plurality of user nodes representing respective entities which make changes to the computing infrastructure; querying the graph based on a computing resource indicated in an alert; identifying a root cause of the alert based on results of the querying of the graph; and performing at least one mitigation action based on the identified root cause.

Abstract: A system and method for securing deployment of computing infrastructure resources. A method includes determining, based on a unique identifier of a computing infrastructure resource indicated in an alert, a source identifier of a resource component including the computing infrastructure resource, wherein the resource component includes at least one source file, wherein the source identifier of the resource component is a combination of characteristics of the resource component which collectively uniquely identify the resource component with respect to the directory in which the at least one source file of the resource component reside; contextually enriching the alert by adding the source identifier of the resource component including the computing infrastructure resource to the alert; and performing at least one remediation action with respect to the contextually enriching alert.