Abstract: The technology includes a system to reduce clutter when displaying a security analysis graph of nodes and edges. Simple chains of nodes do not have branches and are equivalent when they have the same length, connection types and endpoints. First, second and potentially more simple chains can be aggregated for display. A third and potentially more simple chains can be excluded from aggregation based on an accumulated risk analysis score. The excluded simple chain can readily be called to an analyst's attention.

Abstract: A method for providing real-time security assistance for Unified Communications as a Service (UCaaS) implementing a Security Service Edge (SSE) as an inline forward proxy is disclosed. The method includes performing real-time communications between several end-users using an electronic agent. The SSE is implemented at a mid-link server between several end-user devices and a web server associated with the electronic agent. The method further includes implementing the SSE as the inline forward proxy at several end-user devices to detect any deep-fake video and audio streams during real-time communications. The method further includes intercepting and decrypting traffic associated with the real-time communications to access original video and audio streams from real-time communications. Further, the method includes applying, in real-time, several policies on the deep-fake video and audio streams detected using the SSE.

Abstract: A shadow generative artificial intelligence (GenAI) detection system for providing continuous visibility of shadow GenAI workloads. Download of a GenAI model on an end-user device is initiated by a user of an enterprise from host repositories of a hosting site. The host repositories include uniform resource locators (URLs) of the GenAI model and associated workload components. An enterprise repository is generated with the URLs of the GenAI model from the host repositories. The host repositories are monitored for updating the enterprise repository that has policies associated with the GenAI model. A mid-link server between the end-user device(s) and an enterprise server deploys a Secure Web Gateway (SWG) or an inline Cloud Access Security Broker (CASB) device to detect the downloading of the GenAI model on the end-user device. A policy from the enterprise repository is applied based on the downloading of the GenAI model on the end-user device.

Abstract: A method for providing real-time security assistance for Unified Communications as a Service (UCaaS) implementing a Security Service Edge (SSE) as an inline forward proxy is disclosed. The method includes performing real-time communications between several end-users using an electronic agent. The SSE is implemented at a mid-link server between several end-user devices and a web server associated with the electronic agent. The method further includes implementing the SSE as the inline forward proxy at several end-user devices to detect any deep-fake video and audio streams during real-time communications. The method further includes intercepting and decrypting traffic associated with the real-time communications to access original video and audio streams from real-time communications. Further, the method includes applying, in real-time, several policies on the deep-fake video and audio streams detected using the SSE.

Abstract: A method, system, and computer-readable medium of applying ownership-based policies to a document are disclosed. The disclosed technology includes intercepting a linked document being sent to a corporate network, using an inline proxy, responsive to an Application Program Interface access, by an account, to view a linked document stored in cloud storage, accessing file metadata for the linked document, wherein the file metadata includes a creation owner field that has a value or null value reflecting a domain that was active when the linked document was created, classifying the linked document as personal or corporate responsive to the creation owner field, and applying a security policy to the linked document responsive to the classifying.

Abstract: Disclosed are methods and systems for customizing a deep learning (“DL”) stack to detect organization sensitive data in images, referred to as image-borne organization sensitive documents, and protecting against loss of the image-borne organization sensitive documents. The methods and systems include distributing a trained master DL stack with stored parameters to a plurality of organizations. Providing at least some of the organizations with a DL stack update trainer, under the organizations' control, configured to save, during generation of updated DL stacks, non-invertible features derived from images of organization-sensitive training examples, ground truth labels for the images, and parameters of the updated DL stacks. Receiving, from at least one of the DL stack update trainers, organization-specific examples including the non-invertible features and the ground truth labels, without receiving images of the organization-specific examples.

Abstract: The disclosed technology teaches a method for evaluating user compliance with an organization's security policies, formulating a user confidence or risk score, comprising scoring for each user a sum of alert weights, categorized by severity, and generated over time. Each contribution to an alert weight is generated due to an activity by the user that the organization's security policies treat as risky. Alert weights, over time, are subject to a decay factor that attenuates the alert weights as time passes. Also disclosed is reporting the user confidence score, comprising causing display of a time series of the user confidence or risk scores over a predetermined time and/or a current user confidence or risk score and/or at least some details of the activity by the user that contributed to the alert weights over time.

Abstract: A cloud network for delivering local content to user locations. The cloud network includes a client device, a mid-link server, and a cloud provider. The mid-link server receives requests using a local application of the client device for local data from the user at a user location. The mid link server creates multiple buckets for the users and assigns IP addresses to buckets. The buckets are further narrowed to assign a unique IP address to the user based on the policies. User behavior is analyzed to identify a threat and a score is assigned to the IP address of user. A sub-data center is routed the request. Each data center has IP addresses for different locations to deliver the local content to the respective IP address. The request is routed to the sub-data center which is used to provide the local data to the user by the cloud provider.

Abstract: A dynamic security system to secure cellular devices across a cellular network in a cloud-based environment. The dynamic security system includes multiple tenants having multiple cellular devices, a tunnel, a traffic steering module, and a threat management module. The threat management module analyzes traffic, generates policies and recommendations to remediate a threat. The threat management module intercepts traffic within the tunnel, creates policy profiles for tenants, monitors a threat landscape, and relates the threat with the policy profiles. Creation of policy profiles is based on the history of policies at an enterprise, continuously updated policy templates for features such as data loss prevention, threat detection, file constraints, category or user-based policies, device or geolocation-based properties associated with the cellular device or tenant. The threat management module stores tenant profiles, threat information, and policy profiles.

Abstract: A policy-based browser system for managing browser extensions used to access functionalities on a web browser in a cloud-based multi-tenant system. The policy-based browser system includes a client device, a web server, and a mid-link server. Policies are identified for the installation of a browser extension requested using the client device. The policies specify access to browser extensions at the client device for accessing functionalities associated with the browser extensions. The browser extension is analyzed based on usage history for the installation of the browser extension. Non-compliance with one or more policies is flagged for a re-authorization. The policies are updated on performing the re-authorization. The re-authorization is determined using analytics from third-party resources. Machine learning algorithms are used to perform analytics on traffic patterns and browser extensions. A usage history and use pattern of the browser extension is identified to determine the re-authorization.

Abstract: A data loss prevention (DLP) system to prevent data exfiltration across multiple tenants in a cloud network includes a tenant and a DLP server. The tenant includes multiple end-user devices. The DLP server functions as middleware, intercepts network traffic from an end-user device at an application layer, retrieves multiple images, and extracts various features from them. From the features, the DLP server infers a steganographic content in an image using a machine learning (ML) engine, computes a risk score for the end-user device, and compares the risk score against a primary threshold. The DLP server increments a risk count when the risk score exceeds the primary threshold, analyzes a contextual information of the end-user device, and compares the risk count against a secondary threshold. The DLP server further generates an alert based on various policies when the risk count exceeds the secondary threshold.

Abstract: A cellular security system that uses multiple policies to protect a cellular network against various threats in a cloud-based environment. The cellular security system includes a tenant with multiple cellular devices, multiple tunnels that receive and route traffic, monitor traffic, capture real-time traffic attributes, and detect anomalies. The cellular security system further includes an anomaly detection model, an alert generator, and an anomaly reporter. The anomaly detection model retrieves baseline profiles from a threat database, loads policies related to a threat, and compares real-time traffic features with baseline profiles. The anomaly detection model further applies an anomaly detection algorithm to a traffic instance, assigns an anomaly score, and raises a flag for anomaly detection where the anomaly score is greater than a threshold.

Abstract: The technology disclosed relates to accessing a hosted service on a client device. In particular, the technology disclosed relates to receiving, on a client device of an entity's user, from a network security system, a forwarding rule for modifying requests for accessing a hosted service, receiving on the client device a request for accessing the hosted service, using the forwarding rule to modify the request for accessing the hosted service and generating a modified request for accessing the hosted service, and receiving on the client device a response from the network security system.

Abstract: A detecting deepfake system for detecting deepfake in live network traffic communications and stored media. Visual data and audio data are extracted from a plurality of users of an enterprise. Digital fingerprints are generated from the extracted visual data and audio data. The digital fingerprints are matched with the pre-stored fingerprints to produce an output. Further, the visual data and audio data are analyzed by Artificial Intelligence (AI)-detection model. A deepfake detection score is generated based on the analysis by the AI-detection model. The output from the matching of the digital fingerprints with the pre-stored fingerprints and the deepfake detection score are combined to determine a level of deepfake in the extracted visual data and audio data. The policies are applied based on the level of deepfake detected in the visual data and the audio data.

Abstract: A policy-controlled access system comprising a client device running a local application, A mid-link server monitors network traffic from the client device. The network traffic includes third-party content accessed by a user on the client device. A request for data from the end-user is received using the local application, a category associated with the request for the data is determined, and multiple administrator accounts of the end-user is identified based on the category. The multiple administrator accounts are associated with multiple policies to access the data. A correspondence is identified between multiple policies of the multiple administrator accounts. A set of policy conflicts are identified among the policies based on the correspondence and a notification is generated to administrator having the policy conflicts. The policy conflicts are resolved based on suggestions from machine learning (ML) models or the administrators. The request is authorized to access the data.

Abstract: The disclosed technology keeps up with the deployment of APIs, so that Secure Access Service Edge (SASE) protection is afforded. The technology includes accessing an API repository hosting the OpenAPI specification. The OpenAPI specification describes the API of the service, allowing computers to understand capabilities of the service without looking at source code or documentation of the service, and without inspecting traffic of the service. The technology includes retrieving the OpenAPI specification from the API repository. The technology includes identifying a section of the OpenAPI specification as containing a per-activity attribute that corresponds to a core activity that triggers a protective action. The technology includes extracting, from the section, an attribute that is useful for building a connector with connector rules or application signatures.

Abstract: A system uses an artificial intelligence (AI) engine to generate a response for end-user devices using services and to provide threat protection in a cloud-based network. The system consists of tenants, tunnels, the AI engine, and an AI reporter. A tenant includes the end-user devices. The tunnels transmit and segregate traffic between the end-user devices and the services. The AI engine intercepts traffic within tunnels, receives a request from a user, and applies functions to manage it. The AI engine monitors the request and generates the response. The AI engine determines patterns based on interactions of the user with services, processes the patterns, generates a baseline of user activity and change settings. The AI engine generates the response based on the settings and sends it to the user to fulfill the request. The AI reporter transmits information corresponding to the request and response across the tenants of the cloud-based network.

Abstract: Systems, devices, and computer-implemented methods are presented for monitoring distinct enterprise systems for violations of security policies. In one embodiment, a network security system collects data from a plurality of monitored systems within an enterprise and generates a unified data model using the data. The unified data model establishes connections between two or more of the monitored systems, and more particularly, between objects within the monitored systems based on matching corresponding parameters. The connections provide the network security system with insight into other data in the monitored systems allowing the network security system to identify violations of security policies by leveraging the connections. The network security system can output alerts and remediate the violations in a given monitored system.

Abstract: The disclosed technology teaches a method of operating an inspection proxy for encrypted sessions between users in an organization serviced by the inspection proxy and cloud-based services accessed by the users. The method comprises a Hardware Secure Module (HSM) providing, to the inspection proxy comprising an intermediate certificate authority, a signed certificate authority (CA) certificate that browsers, operated by the users in the organization, recognize to be authorized to sign end-entity certificates, by virtue of being chained to a root certificate recognized by the browsers.

Abstract: A method for providing data exchange using secure tunnel in a multi-tenant cloud native control plane system using machine learning algorithms. The cloud control plane receives a request for data access, provisions network connection to service endpoint using data plane and control plane. The control plane identifies routing information of network traffic from multiple end-user devices to establish the connection. Resiliency of the network is identified based on control plane or data plane failure and maintains the connection. A network policy associated with request for accessing data is determined using machine learning algorithms trained on network patterns. Network patterns includes connections between end-user devices, gateway endpoints, user locations, and/or device addresses. Network policy specifies routing for accessing data and the secure tunnel from multiple tunnels.