Abstract: Systems and methods are provided to build a machine learned exploitability risk model that predicts, based on the characteristics of a set of machines, a normalized risk score quantifying the risk that the machines are exploitable by a set of attacks. To build the model, a training dataset is constructed by labeling characteristic data of a population of machines with exploitation test results obtained by simulating a set of attacks on the population. The model is trained using the training data to accurately predict a probability that a given set of machines is exploitable by the set of attacks. In embodiments, the model may be used to make quick assessments about how vulnerable a set of machines are to the set of attacks. In embodiments, the model may be used to compare the effectiveness of different remediation actions to protect against the set of attacks.

Abstract: Various embodiments include systems and methods of anomalous data transfer detection, including determining hotspots for an asset of an organization. The hotspots correspond to one or more periods of time in which outbound data from the asset satisfies a hotspot threshold determined to be indicative of high outbound data traffic activity. A subset of data that does not correspond to the hotspots is filtered out from the outbound data. The remaining data corresponds to a hotspot dataset associated with the hotspots. The hotspot dataset may be utilized to detect anomalous data transfer activity associated with the asset. Detecting the anomalous data transfer activity includes computing one or more statistics on the hotspot dataset. Responsive to detecting the anomalous data transfer activity, an alert associated with the asset may be generated.

Abstract: A SQL database system is disclosed for reading and writing a non-SQL document store using SQL. The database system includes a SQL query engine configured to use different types of dynamically loadable connectors adapted to communicate with the non-SQL document store via its data access interface. The connectors may include a first connector that treats data within an individual document in the document store as multiple table rows, and a second connector that treats individual documents as individual table rows. In some embodiments, both types of document access modes may be implemented by a single multi-modal connector. In some embodiments, the connector may enable a table to be stored across multiple documents and provide the document identifier of the documents as an attribute of the table. Advantageously, by allowing multiple rows to be stored in individual documents, a table can be stored using less storage space and accessed more efficiently.

Abstract: Various embodiments include systems and methods to implement a graph analysis-based assessment to determine relative node significance. Network traffic data associated with a network may be obtained. A graph analysis-based assessment of the network may be performed to determine network traffic paths between a plurality of nodes in the network based at least in part on the network traffic data and to calculate, for each node and based at least in part on the network traffic paths, a respective centrality value. The respective centrality value may be indicative of a respective node being a potential source of disruption to the network relative to other nodes. At least one significant node in the network may be identified based at least in part on the centrality values, and a particular action to be performed with respect to the at least one significant node may be determined.

Abstract: An entity tracking system and method for a computer network employs proactive data collection and enrichment driven by configurable rules and workflows responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. The data collection is used in conjunction with graph technologies to map interactions and relationships between various entities interacting in the computer environment and deduce interactions and relationships between the entities. Machine learning techniques further identify, group or categorize entities and identify patterns which are indicative of anomalies that might be due to nefarious actions or compromised security.

Abstract: Techniques for event driven harvesting and analysis of cloud computing resources in a cloud computing environment, comprising: obtaining information about at least one cloud computing event in the cloud computing environment; determining if the at least one event is related to the allocation of storage to a cloud computing resource; in response to determining the least one event is related to the allocation of storage to a cloud computing resource, requesting data from the cloud computing resource; and analyzing the data for the presence of security risks and vulnerabilities.

Abstract: An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.

Abstract: Techniques for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network. The techniques comprising: obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information using at least one trained machine learning model, wherein the signature comprises a numeric representation of the first asset; associating the first asset with at least one asset in the asset catalog using the signature and at least one signature of the at least one asset in the asset catalog, wherein the at least one signature was previously determined using the at least one trained machine learning model; and outputting information identifying the at least one asset with which the first asset was associated.

Abstract: Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on results from multiple security systems operating on a same compute environment. The multiple security systems may each generate and store respective security alerts within a priority object. The priority object may be used to define rules that are based on results from the multiple security systems, including determining groups of security alerts or determining security alert prioritization based on local compute environment characteristics. The security service platform may use the provide an alert that indicates a detected cyberattack.

Abstract: Various embodiments include systems and methods to implement a security platform providing query transformations and layered filtering. Security data associated with a client deployment of assets may be determined and analyzed for identifying security vulnerabilities. The security platform may support an application programming interface that provides a flexible query format that allows a frontend query to be specified using multiple layers of attribute specifications associated with assets of a deployment. The multiple layers may be parsed and translated into a backend query format used to retrieve security data specified by the frontend query.

Abstract: An entity tracking system and method for a computer network employs proactive data collection and enrichment driven by configurable rules and workflows responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. The data collection is used in conjunction with graph technologies to map interactions and relationships between various entities interacting in the computer environment and deduce interactions and relationships between the entities. Machine learning techniques further identify, group or categorize entities and identify patterns which are indicative of anomalies that might be due to nefarious actions or compromised security.

Abstract: Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on results from multiple security systems. The multiple security systems may each generate and store respective security alerts within a priority object. The priority object may be used to define rules that are based on results from the multiple security systems, including determining groups of security alerts or determining whether a security alert is common or uncommon for a given compute environment. The security service platform may use the provide an alert that indicates a detected cyberattack.

Abstract: Disclosed herein are methods, systems, processes, and machine learned models for performing opinionated threat assessments for cybersecurity vulnerabilities. An opinionated threat assessment system is implemented that obtains a training dataset that includes a codified opinionated threat assessment for security vulnerabilities. The codified opinionated threat assessment in the training dataset includes intrinsic attributes for the security vulnerabilities and subject attributes about the security vulnerabilities. The opinionated threat assessment system trains an opinionated threat assessment model using the training dataset and according to a machine learning technique where the training tunes the opinionated threat assessment model to generate a machined learned opinionated threat assessment for a new security vulnerability based on new intrinsic attributes associated with the new security vulnerability.

Abstract: Some embodiments provide techniques for generating common vulnerability scoring system (CVSS) vectors for vulnerabilities to use in scanning a computing environment for vulnerabilities. The techniques involve obtaining a textual description of a vulnerability; generating inputs for a plurality of ML models using the textual description of the vulnerability; providing the inputs to the plurality of ML models to obtain outputs indicating values of CVSS risk metrics; and storing the values of the CVSS risk metrics indicated by the outputs of the plurality of ML models in a vector to obtain the CVSS vector for the vulnerability.

Abstract: Various embodiments include systems and methods of implementing a machine learning model for calculating confidence scores associated with potential security vulnerabilities. The machine learning model is trained using vulnerability data associated with a set of previously identified vulnerabilities, where the vulnerability data indicates whether a previously identified vulnerability is a true positive or a false positive. In some embodiments, scan traffic data may be obtained. The scan traffic data may be associated with potential security vulnerabilities detected via scan engine(s) that implement application security testing. The machine learning model may be used to determine respective confidence scores for each potential security vulnerability. According to some embodiments, responsive to a request for scan findings associated with a particular application, the respective confidence scores may be displayed via a vulnerability analysis graphical user interface.

Abstract: Disclosed herein are methods, systems, and processes for performing optimized batched packet processing in deep packet inspection (DPI) computing systems. A batch of network packets is received. A stateless processing operation is performed for the batch that includes updating a current time for the batch, decoding the network packets in the batch, creating a flowhash lookup key for each decoded network packet, and generating a first output that includes the current time and corresponding flow-hash lookup keys for the decoded network packets. Next, a stateful processing operation is performed for the batch that includes accessing the first output of the stateless processing operation, dividing the batch into multiple sub-batches, performing a parallel flow-hash table lookup operation on the network packets that are part of the sub-batches, and generating a second output that includes the sub-batches with associated packet flows.

Abstract: A security threat detection and response (STDR) system is disclosed capable of recommending actions for handling security events detected in a computer network. In embodiments, user actions taken via the graphical user interface of the system are recorded. The records are used as training data to train a machine learning model to recommend actions for different types of security events to subsequent users. The training may be performed online, so that the model continues to learn while it is used to make recommendations. In embodiments, the model may infer a priority of a recommended action based on observation data such as how quickly an action is taken, the order in which actions are taken, and the popularity of the action for the particular security event. In embodiments, the model may be configured to recommend actions that are new to the system or actions for new types of security events.

Abstract: New intrusion detection system (IDS) rules to be deployed on an IDS that generates alerts based on an applied ruleset are accessed. A trial window that includes incorporating the new IDS rules into a candidate list to enable summarization and filtering of the alerts is started and the applied ruleset that includes existing IDS rules is supplemented with the candidate list that includes the new IDS rules. The applied ruleset is transmitted to a network sensor associated with the IDS upon the supplementation and alerts generated based on network events implicated by both the existing IDS rules and the new IDS rules in the applied ruleset are received from the IDS. Upon completion of the trial window, a set of alerts generated only by the new IDS rules in the applied ruleset are designated as suppressed alerts and a set of new IDS rules is eliminated from the applied ruleset upon determining that the set of new IDS rules generate a subset of alerts that exceed an alert threshold.

Abstract: A security threat detection and response (STDR) system is disclosed capable of recommending actions for handling security events detected in a computer network. In embodiments, user actions taken via the graphical user interface of the system are recorded. The records are used as training data to train a machine learning model to recommend actions for different types of security events to subsequent users. The training may be performed online, so that the model continues to learn while it is used to make recommendations. In embodiments, the model may infer a priority of a recommended action based on observation data such as how quickly an action is taken, the order in which actions are taken, and the popularity of the action for the particular security event. In embodiments, the model may be configured to recommend actions that are new to the system or actions for new types of security events.

Abstract: As an example, a scan engine accesses a scan template identifying multiple assets associated with a network, selects a particular asset of the multiple assets included in the scan template, and selects a particular port of multiple ports associated with the particular asset. The scan engine sends an access request to the particular port. After credentials are successfully authenticated or a trusted secure channel is created, the scan engine accesses the particular asset via the particular port to retrieve data. The data is analyzed to predict one or more vulnerabilities associated with the particular asset. Based on the one or more vulnerabilities, one or more potential solutions are identified to address the one or more vulnerabilities. The scan engine may present at least a portion of the one or more vulnerabilities to a system administrator.