Abstract: A network user behavior system that detects anomalous user behavior includes a memory system with a user behavior module. The user behavior module creates a user profile based on user activity that includes user activity logs that record parameters related to user activity; selects indicator features, wherein the indicator feature includes user activity related to the parameters; creates a user identifier (UID) for each combination of the indicator feature and user; associates each UID with a timestamp to establish a UID and timestamp relationship; establishes a UID and timestamp relationship range indicative of non-anomalous user behavior; and identifies an anomalous user behavior as a UID and timestamp relationship outside of the range indicative of non-anomalous user behavior.

Abstract: A network user behavior system that detects anomalous user behavior includes a memory system with a user behavior module. The user behavior module creates a user profile based on user activity that includes user activity logs that record parameters related to user activity; selects indicator features, wherein the indicator feature includes user activity related to the parameters; creates a user identifier (UID) for each combination of the indicator feature and user; associates each UID with a timestamp to establish a UID and timestamp relationship; establishes a UID and timestamp relationship range indicative of non-anomalous user behavior; and identifies an anomalous user behavior as a UID and timestamp relationship outside of the range indicative of non-anomalous user behavior.

Abstract: A system uses a probabilistic technique to determine the vulnerability of similar assets based on the data provided on some assets. The probabilistic technique includes stages of preparing data followed by calculating probability; a preparing data stage, including gathering the latest vulnerability reports of all assets in a system with the help of known scanners; creating open vulnerabilities; enriching the obtained data of open vulnerabilities; creating all vulnerabilities; enriching the obtained data of all vulnerabilities. Following this stage, probability calculation may be done for three cases, when asset information is known, when asset information is partially unknown, and when asset information is completely unknown based on the data taken from open vulnerabilities and all vulnerabilities categorized into blocks of 6 months based on the time at which they have been reported to NIST/MITRE.

Abstract: A system uses a probabilistic technique to determine the vulnerability of similar assets based on the data provided on some assets. The probabilistic technique includes stages of preparing data followed by calculating probability; a preparing data stage, including gathering the latest vulnerability reports of all assets in a system with the help of known scanners; creating open vulnerabilities; enriching the obtained data of open vulnerabilities; creating all vulnerabilities; enriching the obtained data of all vulnerabilities. Following this stage, probability calculation may be done for three cases, when asset information is known, when asset information is partially unknown, and when asset information is completely unknown based on the data taken from open vulnerabilities and all vulnerabilities categorized into blocks of 6 months based on the time at which they have been reported to NIST/MITRE.