Abstract: Data to be used to generate a capture-the-flag competition for an anomaly detection framework is received from a customer. One or more flags are identified in the data, the one or more flags representing anomalies in the data. A user interface is provided for the capture-the-flag competition including challenges to identify the one or more flags in the data.

Abstract: An illustrative method includes monitoring activities within a compute environment and generating a logical graph model using at least a portion of the monitored activities. The logical graph model includes a set of nodes representative of one or more identities, applications, and resources in the compute environment and a set of edges representative of connections between nodes interconnected by the edges. An operation associated with security of the compute environment is performed using the generated logical graph model.

Abstract: An illustrative method includes accessing, by a data platform, workload data associated with one or more workloads deployed within a compute environment and associated with an entity; generating, by the data platform and based on an analysis of the workload data, a rule specific to the entity and associated with an operation of the one or more workloads; and performing, by the data platform, an operation with respect to implementation of the rule within the compute environment.

Abstract: An illustrative method for performing an agentless workload assessment may include using an unprivileged agentless workload scanning configuration to generate a replication dataset of a workload associated with a project within a Google Cloud Platform (GCP) environment and perform an analysis of the replication dataset without offloading the replication dataset from the GCP environment. A data platform may perform, based on the analysis, an operation with respect to the workload.

Abstract: Blocking a Direct-to-IP security evasion technique includes receiving a web request, by a network security appliance, from a requester over a network, the web request including a destination Internet Protocol (IP) address; checking, by the network security appliance, a domain name server (DNS) cache for the destination IP address; and in response to the destination IP address not being found in the DNS cache, blocking a connection for the web request by the network security appliance.

Abstract: A computer-implemented method provides a meta data ontology for monitoring multiple cloud environments. In one example, the computer-implemented method comprises collecting, with one or more processing resources of a data platform system, and representing data from a first cloud service provider environment based on a first data schema of the first cloud service provider environment, collecting and representing data from a second cloud service provider environment based on a second data schema of second cloud service provider environment, collecting and representing agent data that is ephemeral in nature from agents deployed to compute assets of the first and second cloud service provider environments based on the first and second data schemas, respectively and configuring, the data platform system, to provide a meta data ontology that maps objects of the meta ontology to corresponding objects in the first data schema and the second data schema.

Abstract: Data traffic statistics are generated for each IoT device over a training sliding window. Feature vectors and frequency can be extracted from the data traffic statistics over the training sliding window. A plurality of iTrees of an iForest. New data traffic is received for the specific IoT device. New features are continuously extracting new feature vectors from the new data traffic of the IoT device over a detection sliding window. An instance anomaly score can then be calculated for each instance of a specific IoT device by passing the new feature vectors for the IoT device through each iTree of the iForest for the specific IoT device. Each instance represents a data packet or other segment. An anomaly score is updated over the detection sliding window with the instance anomaly score. Anomaly is detected in a specific instance of the specific IoT device responsive to the anomaly score exceeding a predetermined threshold. In response, a security action can be taken.

Abstract: Systems and methods for remote monitoring of a Security Operations Center (SOC) via a mobile application are provided. According to one embodiment, a management service retrieves information regarding multiple network elements that are associated with an enterprise network and extracts parameters of the monitored network elements from the retrieved information. The management service prioritizes the monitored network elements by determining a severity level associated with security-related issues of the network elements and generates various monitoring views that summarize in real time various categories of potential security-related issues detected by the SOC. Further, the management service assigns a priority to each monitoring view and displays a video on the display device that cycles through monitoring views in accordance with their respective assigned priorities.

Abstract: A first data packet can be forwarded to a virtual SDWAN interface which has multiple IPSec tunnels as members, each of which is disposed over a different uplink, wherein the multiple IPSec tunnels each connect to the remote SDWAN controller. Load balancing of the particular session is performed relative to other sessions by selecting one of the multiple uplinks for transmission to the remote SDWAN controller. Phase 2 of IPSec is set up for the particular session by updating an IPSec phase 2 table with the selected uplink associated with the particular session, to direct subsequent packets of the same session.

Abstract: Methods, systems, and products for alert generation and augmentation using a large language model (‘LLM’), including: providing, to the LLM, information describing a monitored deployment; providing, to the LLM, information describing one or more alerts associated with the monitored deployment; and receiving, from the LLM, an enhanced alert, wherein the enhanced alert is based at least in part on at least one of the information describing the monitored deployment and the information describing one or more alerts associated with the monitored deployment.

Abstract: Various approaches for providing network maintenance and health monitoring. In some cases, some approaches include systems, methods, and/or devices embodiments that provide for receiving and cataloging network incidents and in providing proposed solutions to mitigate the network incidents.

Abstract: A URL is detected that is potentially malicious, and is compared against one or more known legitimate URLs by calculating a similarity score between the detected URL and the known legitimate domain with respect to similarity features. The similarity score comprises a combination of a visual similarity score, a text similarity score and a Document Object Model (DOM) structure similarity score, and the similarity threshold represents a tolerance of variations from minor changes between the detected URL versus the one or more legitimate domains. Responsive to detecting a malicious URL based on the similarity score of the detected URL exceeding the similarity threshold, a security action can be taken against the detected URL as a phishing attempt according to a network security policy.

Abstract: Approaches policy set feature guided node level partitioning for policy search tree optimization are disclosed. A set of policy bins is generated by creating equal-width bins on a given dimension. An original policy set is scanned to determine a number of policies falling into each policy bin in the set of policy bins. An original policy set characteristic is measured based on the number of policies falling into each policy bin. Parameters that represent relationships between the policy set and another policy set are determined based on a number of policies falling into each policy bin and the policy set characteristic. A new policy set is generated based on the parameters. A new policy search tree is generated based on a new policy set. The new policy search tree provides improved build cost or improved search cost as compared a search tree based on the original policy set.

Abstract: Various embodiments provide systems and methods for computing risk scores for entities (e.g., hosts, users) in a network. A computer-implemented method includes determining incidents during a first time period for an entity of the network, calculating rarity for all incidents for the entity in the network using a first function, and updating severity for all incidents of the entity based on a confidence score for the incident using a second function.

Abstract: Among a great deal of other disclosure and scope, systems and methods are enclosed that enable automated labelling of a subset of vectors in a given problem space. For example, in some of many cases, a first machine learning model pre-trained on a given problem space makes predictions regarding fresh, unseen data. In addition to this prediction, the model can output a confidence metric indicating its confidence regarding the prediction made. A subset of these vectors with the highest confidence may be selected. Relevant heuristics assessing each vector in the subset may be computed. These heuristics can be fed through a second machine learning model, which identifies if the given prediction made by the first model is correct. If so, the vector is automatically annotated with the correct predicted label, the vector is appended to the labeled set of data, and the first model is retrained with the new labeled set of data.

Abstract: A bandwidth control device is disclosed. The bandwidth control device includes analysis circuitry to determine a user identifier (ID) associated with each of a plurality of data packets and determine a queue number each of the data packets based on the user IDs and bandwidth control circuitry to insert each of the plurality of data packets into one of a plurality of queues based on the queue numbers, generate weight information for each of the plurality of queues based on a weight value associated with each of the plurality of queues and schedule the plurality of packets to be transmitted based on the weight value each of the plurality of queues.

Abstract: Various embodiments provide systems and methods for enhancing the security of a ZTNA connection.

Abstract: Predicting attack paths using code analysis, including: detecting a vulnerability in code by performing a static code analysis of the code; identifying an attack surface for the vulnerability in a cloud deployment; and generating an alert for the vulnerability by assigning a priority to the alert based on the attack surface.

Abstract: Methods, apparatuses, and products for automating remediation actions in a cloud environment, including: detecting an alert associated with a cloud deployment; selecting, based on the alert, a remediation type; and providing, to a user, one or more resources to perform a remediation corresponding to the remediation type.

Abstract: A data platform monitors a compute environment by performing multi-stage heuristic analysis of event data representing a plurality of events occurring within the environment. The platform utilizes multiple event analyzers, each configured according to a distinct analysis heuristic, to evaluate different subsets of the event data and generate corresponding output signals. A higher-level event analyzer applies a further heuristic to the multiple output signals to generate a composite alert signal, indicating whether the combination of analyzed events collectively represents a security intrusion or other anomalous condition of sufficient severity to warrant alerting. Based on the composite alert signal, the platform performs an alert-based operation, such as generating a user-facing alert, initiating an automated mitigation, or updating a contextual model of system behavior.