Abstract: The technology disclosed herein relates to data discovery in computing environments, that provide access to data. In one example, a computer-implemented method includes identifying a first sampling criterion used for classification of a data store with respect to a target data type during a previous scan of the data store. The data store stores a set of data objects. The method includes selecting a second sampling criterion, from a plurality of sampling criteria, based on the first sampling criterion, and deploying one or more scanners configured to select a subset of data objects, from the set of data objects stored in the data store, based on the second sampling criterion. The subset comprises some, but not all, of the set of data objects. The method includes generating a classification result based on a number of instances of the target data type in the subset of data objects.

Abstract: Aspects of the disclosure relate to detecting and preventing transmission of spam messages using modified source numbers. A computing platform may detect that a first message, sent to a recipient device from a sender device, includes suspicious content. Subsequently, the computing platform may receive, from the recipient device, user interaction information indicating that a user of the recipient device has sent a reply message in response to the first message. Then, the computing platform may generate a modified message by modifying a first source number corresponding to the reply message. Next, the computing platform may cause transmission of the modified message with the modified first source number to the sender device. Thereafter, the computing platform may intercept one or more additional messages between the sender device and the modified first source number and redirect the one or more additional messages.

Abstract: Aspects of the disclosure relate to dynamically controlling access to linked content in electronic communications. A computing platform may receive, from a user computing device, a request for a uniform resource locator associated with an email message. Subsequently, the computing platform may identify that the uniform resource locator associated with the email message corresponds to a potentially-malicious site. In response to identifying that the uniform resource locator associated with the email message corresponds to the potentially-malicious site, the computing platform may determine a risk profile associated with the request received from the user computing device. Based on the risk profile associated with the request, the computing platform may execute an isolation method to provide limited access to the uniform resource locator associated with the email message.

Abstract: Aspects of the disclosure relate to dynamically controlling access to linked content in electronic communications. A computing platform may receive, from a user computing device, a request for a uniform resource locator associated with an email message and may evaluate the request using one or more isolation criteria. Based on evaluating the request, the computing platform may identify that the request meets at least one isolation condition associated with the one or more isolation criteria. In response to identifying that the request meets the at least one isolation condition associated with the one or more isolation criteria, the computing platform may initiate a browser mirroring session with the user computing device to provide the user computing device with limited access to a resource corresponding to the uniform resource locator associated with the email message.

Abstract: The technology disclosed relates to analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system and method of risk event detection and remediation. For example, an event is detected in a cloud environment and a pre-defined risk signature that represents an instance of a risk event is obtained. The pre-defined risk signature includes a reference to a remediation workflow having one or more commands for one or more remediation actions in the cloud environment. A determination is made that the pre-defined risk signature has a threshold correspondence to the event, and the reference to the remediation workflow is retrieved using the pre-defined risk signature. The one or more commands from the remediation workflow are executed.

Abstract: An intelligent clustering system has a dual-mode clustering engine for mass-processing and stream-processing. A tree data model is utilized to describe heterogenous data elements in an accurate and uniform way and to calculate a tree distance between each data element and a cluster representative. The clustering engine performs element clustering, through sequential or parallel stages, to cluster the data elements based at least in part on calculated tree distances and parameter values reflecting user-provided domain knowledge on a given objective. The initial clusters thus generated are fine-tuned by undergoing an iterative self-tuning process, which continues when new data is streamed from data source(s). The clustering engine incorporates stage-specific domain knowledge through stage-specific configurations. This hybrid approach combines strengths of user domain knowledge and machine learning power.

Abstract: Aspects of the disclosure relate to dynamic message analysis using machine learning. A computing platform may monitor a messaging server associated with an enterprise organization. Based on monitoring the messaging server, the computing platform may identify bi-directional messaging traffic between enterprise domains associated with the enterprise organization and external domains not associated with the enterprise organization. Based on identifying the bi-directional messaging traffic, the computing platform may select external domains for a conversation detection process. The computing platform may compute an initial set of rank-ordered external domains by: determining, based on a number of messages sent to and received from each enterprise domain/external domain pair, weighted difference values and ranking the plurality of external domains selected for the conversation detection process based the weighted difference values.

Abstract: Systems, methods and products for increasing efficiency of resource usage by determining the reliability of reporters of unwanted messages and prioritizing evaluation of messages based on the reliability scores. Reports of unwanted messages are evaluated to determine whether they are bad. If an unwanted message is bad, a score for the reporter is updated to reflect a positive credit. A set of safe rules are applied to the message to determine whether it is safe and if the message is determined to be safe, the reporter score corresponding to the reporter is updated to reflect a non-positive (zero or negative) credit. If the message is determined to be neither bad nor safe, the message is entered in a reevaluation queue and, after a waiting period, the message evaluation is repeated using updated threat information, and the reporter score is updated according to the reevaluation.

Abstract: Aspects of the disclosure relate to detecting random and/or algorithmically-generated character sequences in domain names. A computing platform may train a machine learning model based on a set of semantically-meaningful words. Subsequently, the computing platform may receive a seed string and a set of domains to be analyzed in connection with the seed string. Based on the machine learning model, the computing platform may apply a classification algorithm to the seed string and the set of domains, where applying the classification algorithm to the seed string and the set of domains produces a classification result. Thereafter, the computing platform may store the classification result.

Abstract: Aspects of the disclosure relate to detecting and protecting against cybersecurity attacks using unprintable tracking characters. A computing platform may receive a character-limited message sent to a user device. Subsequently, the computing platform may detect that the character-limited message sent to the user device includes suspicious content. Then, the computing platform may generate a modified character-limited message by inserting one or more special characters into the character-limited message and cause transmission of the modified character-limited message to the user device. Next, the computing platform may receive, from the user device, a spam report that includes the modified character-limited message. Then, the computing platform may identify a presence of the one or more special characters included in the modified character-limited message and adjust one or more filters based on the identification.

Abstract: The technology disclosed relates to analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system and method of risk event detection and remediation. An event is detected in a cloud environment and a pre-defined risk signature is obtained that identifies one or more entities in the cloud environment and represents an instance of a risk event relative to the one or more entities. The pre-defined risk signature includes a reference to a remediation workflow having one or more commands for one or more remediation actions in the cloud environment. Th pre-defined risk signature is determined to have a threshold match to the event and, based on the determination that the pre-defined risk signature has a threshold match to the event, the remediation workflow is obtained based on the reference. The one or more commands are executed in the cloud environment.

Abstract: Aspects of the disclosure relate to providing training and information based on simulated cybersecurity attack difficulty. A computing platform may retrieve data associated with a plurality of attack templates for simulating cybersecurity attacks. Subsequently, the computing platform may use one or more models to compute a predicted failure rate for each template of the plurality of attack templates in order to yield a plurality of predicted failure rates for an organization. Based on the plurality of predicted failure rates, the computing platform may use one or more of the plurality of attack templates to configure a simulated cybersecurity attack on the organization. Then, the computing platform may send, via the communication interface, to an administrator user device associated with the organization, information about the simulated cybersecurity attack and may execute the simulated cybersecurity attack.

Abstract: The technology disclosed relates to detection of data traffic in computing environments, such as cloud environments. Example systems and methods detect a plurality of workloads in a virtual network in a computing environment and deploy a plurality of probe agents to the plurality of workloads. Each respective probe agent detects network traffic on a respective workload of the plurality of workloads, scans a data packet that is at least one of sent or received by the respective workload, generates a data classification relative to the data packet, and generates a scan result that includes packet payload information and an indication of the data classification. The scan results are received from the plurality of probe agents and a computing action is performed based on scan results.

Abstract: Aspects of the disclosure relate to dynamically providing cybersecurity training based on user-specific threat information. A computing platform may receive, from a targeted attack protection (TAP) server, user-specific threat information indicating at least one threat that has been encountered by at least one user. The computing platform may identify one or more users to receive cybersecurity training in a first cybersecurity training topic based on the user-specific threat information indicating the at least one threat that has been encountered by the at least one user. Subsequently, the computing platform may load one or more cybersecurity training modules based on identifying the one or more users to receive the cybersecurity training in the first cybersecurity training topic. Then, the computing platform may provide the one or more cybersecurity training modules to one or more user computing devices.

Abstract: Aspects of the disclosure relate to dynamic cybersecurity event detection and training functions. A computing platform may monitor a plurality of user devices to detect a cybersecurity training triggering event. In response to the detection, one or more cybersecurity training session prompts may be generated and transmitted to one or more user devices. User input providing a response to the cybersecurity training session prompt may be evaluated for accuracy and scored for the cybersecurity training session. In some examples, an overall cybersecurity score for a user may be maintained and modified based on the score for the cybersecurity training session. One or more modifications may be identified and executed based on the scores generated.

Abstract: Systems and methods for privacy-preserving transformer model training are provided. The system includes one or more data repositories in a computer network or cloud infrastructure having data stored therein. The system anonymizes the data in the one or more documents, and trains a transformer model on the data outside of the network. The data includes sensitive information. Anonymizing the data is includes extracting the data from the one or more documents and irreversibly transforming the data in the one or more documents into context-preserving tensors. Training the transformer model on the data comprises using the context-preserving tensors instead of the data to train the transformer model on the data.

Abstract: A method for determining risks associated with an identity in an organization network, including scanning an active directory for a network including a plurality of identities, to extract a plurality of attributes of the identities and their corresponding values. analyzing the extracted attribute values for an identity in the network to identify one or more risks associated with that identity, which an attacker can exploit, assigning a score to each risk identified by said analyzing, and further assigning a score to the identity based on the scores of the one or more risks associated with the identity.

Abstract: Systems, methods, and products for identifying IP mass hosts and determining whether they are good or bad. One embodiment is a method including selecting a first candidate IP address, identifying a set of domains hosted at the IP address, and identifying registrants of the domains. A number of unique ones of the registrants is determined and if the number of unique registrants exceeds a threshold number, the candidate IP address is deemed an IP mass host. Otherwise, the candidate IP address is deemed not to be an IP mass host. For an IP mass host, domains that have bad reputations are identified, and it is determined whether the bad domains comprise at least a threshold percentage of the total hosted domains. If the IP mass host has at least the threshold percentage of bad domains, the IP mass host is deemed a bad mass host.

Abstract: Aspects of the disclosure relate to using a machine learning system to process a corpus of documents associated with a user to determine a user-specific consequence index. A computing platform may load a corpus of documents associated with a user. Subsequently, the computing platform may create a first plurality of smart groups based on the corpus of documents, and then may generate a first user interface comprising a representation of the first plurality of smart groups. Next, the computing platform may receive user input applying one or more labels to a plurality of documents associated with at least one smart group. Subsequently, the computing platform may create a second plurality of smart groups based on the corpus of documents and the received user input. Then, the computing platform may generate a second user interface comprising a representation of the second plurality of smart groups.

Abstract: Systems, methods and products for identifying “similar” threats by clustering the threats based on corresponding forensics. A corpus of forensic data for a plurality of threat URLs is obtained by a threat protection system, the data including forensic elements corresponding to each threat URLs. For each pair of threat URLs, the corresponding forensic elements are examined to identify shared forensic elements. A similarity score is then generated for the pair of threat URLs based on the comparison of the corresponding forensic elements, including both malicious and non-malicious elements. Based on the similarity score generated for each pair of threat URLs, clusters of the threat URLs are identified, with each cluster including a subset of the plurality of threat URLs. Clusters of URLs similar to a selected URL may be identified by accessing the threat cluster information using a similar-threat search interface or through internal APIs of the threat protection system.