Abstract: An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.

Abstract: Techniques for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network. The techniques comprising: obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information using at least one trained machine learning model, wherein the signature comprises a numeric representation of the first asset; associating the first asset with at least one asset in the asset catalog using the signature and at least one signature of the at least one asset in the asset catalog, wherein the at least one signature was previously determined using the at least one trained machine learning model; and outputting information identifying the at least one asset with which the first asset was associated.

Abstract: Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on results from multiple security systems operating on a same compute environment. The multiple security systems may each generate and store respective security alerts within a priority object. The priority object may be used to define rules that are based on results from the multiple security systems, including determining groups of security alerts or determining security alert prioritization based on local compute environment characteristics. The security service platform may use the provide an alert that indicates a detected cyberattack.

Abstract: An entity tracking system and method for a computer network employs proactive data collection and enrichment driven by configurable rules and workflows responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. The data collection is used in conjunction with graph technologies to map interactions and relationships between various entities interacting in the computer environment and deduce interactions and relationships between the entities. Machine learning techniques further identify, group or categorize entities and identify patterns which are indicative of anomalies that might be due to nefarious actions or compromised security.

Abstract: Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on results from multiple security systems. The multiple security systems may each generate and store respective security alerts within a priority object. The priority object may be used to define rules that are based on results from the multiple security systems, including determining groups of security alerts or determining whether a security alert is common or uncommon for a given compute environment. The security service platform may use the provide an alert that indicates a detected cyberattack.

Abstract: Some embodiments provide techniques for generating common vulnerability scoring system (CVSS) vectors for vulnerabilities to use in scanning a computing environment for vulnerabilities. The techniques involve obtaining a textual description of a vulnerability; generating inputs for a plurality of ML models using the textual description of the vulnerability; providing the inputs to the plurality of ML models to obtain outputs indicating values of CVSS risk metrics; and storing the values of the CVSS risk metrics indicated by the outputs of the plurality of ML models in a vector to obtain the CVSS vector for the vulnerability.

Abstract: Disclosed herein are methods, systems, and processes for performing optimized batched packet processing in deep packet inspection (DPI) computing systems. A batch of network packets is received. A stateless processing operation is performed for the batch that includes updating a current time for the batch, decoding the network packets in the batch, creating a flowhash lookup key for each decoded network packet, and generating a first output that includes the current time and corresponding flow-hash lookup keys for the decoded network packets. Next, a stateful processing operation is performed for the batch that includes accessing the first output of the stateless processing operation, dividing the batch into multiple sub-batches, performing a parallel flow-hash table lookup operation on the network packets that are part of the sub-batches, and generating a second output that includes the sub-batches with associated packet flows.

Abstract: Various embodiments include systems and methods of implementing a machine learning model for calculating confidence scores associated with potential security vulnerabilities. The machine learning model is trained using vulnerability data associated with a set of previously identified vulnerabilities, where the vulnerability data indicates whether a previously identified vulnerability is a true positive or a false positive. In some embodiments, scan traffic data may be obtained. The scan traffic data may be associated with potential security vulnerabilities detected via scan engine(s) that implement application security testing. The machine learning model may be used to determine respective confidence scores for each potential security vulnerability. According to some embodiments, responsive to a request for scan findings associated with a particular application, the respective confidence scores may be displayed via a vulnerability analysis graphical user interface.

Abstract: A security threat detection and response (STDR) system is disclosed capable of recommending actions for handling security events detected in a computer network. In embodiments, user actions taken via the graphical user interface of the system are recorded. The records are used as training data to train a machine learning model to recommend actions for different types of security events to subsequent users. The training may be performed online, so that the model continues to learn while it is used to make recommendations. In embodiments, the model may infer a priority of a recommended action based on observation data such as how quickly an action is taken, the order in which actions are taken, and the popularity of the action for the particular security event. In embodiments, the model may be configured to recommend actions that are new to the system or actions for new types of security events.

Abstract: New intrusion detection system (IDS) rules to be deployed on an IDS that generates alerts based on an applied ruleset are accessed. A trial window that includes incorporating the new IDS rules into a candidate list to enable summarization and filtering of the alerts is started and the applied ruleset that includes existing IDS rules is supplemented with the candidate list that includes the new IDS rules. The applied ruleset is transmitted to a network sensor associated with the IDS upon the supplementation and alerts generated based on network events implicated by both the existing IDS rules and the new IDS rules in the applied ruleset are received from the IDS. Upon completion of the trial window, a set of alerts generated only by the new IDS rules in the applied ruleset are designated as suppressed alerts and a set of new IDS rules is eliminated from the applied ruleset upon determining that the set of new IDS rules generate a subset of alerts that exceed an alert threshold.

Abstract: A security threat detection and response (STDR) system is disclosed capable of recommending actions for handling security events detected in a computer network. In embodiments, user actions taken via the graphical user interface of the system are recorded. The records are used as training data to train a machine learning model to recommend actions for different types of security events to subsequent users. The training may be performed online, so that the model continues to learn while it is used to make recommendations. In embodiments, the model may infer a priority of a recommended action based on observation data such as how quickly an action is taken, the order in which actions are taken, and the popularity of the action for the particular security event. In embodiments, the model may be configured to recommend actions that are new to the system or actions for new types of security events.

Abstract: As an example, a scan engine accesses a scan template identifying multiple assets associated with a network, selects a particular asset of the multiple assets included in the scan template, and selects a particular port of multiple ports associated with the particular asset. The scan engine sends an access request to the particular port. After credentials are successfully authenticated or a trusted secure channel is created, the scan engine accesses the particular asset via the particular port to retrieve data. The data is analyzed to predict one or more vulnerabilities associated with the particular asset. Based on the one or more vulnerabilities, one or more potential solutions are identified to address the one or more vulnerabilities. The scan engine may present at least a portion of the one or more vulnerabilities to a system administrator.

Abstract: Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on a security service that operates on structurally deduplicated network data. Based on efficient processing of structurally deduplicated data, the security service platform may use a larger ruleset to increase coverage of threat detection. Additional performance improvements based on the security service platform using deduplicated event data according to a structure of a data model of the event data is that the security service platform may use a single instance of structurally deduplicated event data to represent multiple network events.

Abstract: Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on results from multiple security systems. The multiple security systems may each generate and store respective security alerts within a priority object. The priority object may be used to define rules that are based on results from the multiple security systems, including determining groups of security alerts or determining security alert prioritization based on local compute environment characteristics. The security service platform may use the grouping and prioritization information to provide remediation for an alert that indicates a detected cyberattack.

Abstract: Techniques for mitigating ransomware attacks in a computer environment, including: using a computer hardware processor to perform: identifying an event in the computer environment indicative of a request from a computer process to access metadata related to one or more file system objects stored in the computer environment; capturing the event, such that an operating system of the computer environment may not respond; determining whether the event is malicious based on one or more characteristics of the event; when it is determined the event is not malicious: releasing the event so the operating system may respond; and when it is determined the event is malicious: generating simulated metadata related to the one or more file system objects, the simulated metadata different from the metadata of the one or more file system objects; and returning the simulated metadata responsive to the request.

Abstract: Techniques for mitigating ransomware attacks in a computer environment, including: using a computer hardware processor to perform: identifying an event in the computer environment indicative of a request from a computer process to access metadata related to one or more file system objects stored in the computer environment; capturing the event, such that an operating system of the computer environment may not respond; determining whether the event is malicious based on one or more characteristics of the event; when it is determined the event is not malicious: releasing the event so the operating system may respond; and when it is determined the event is malicious: generating simulated metadata related to the one or more file system objects, the simulated metadata different from the metadata of the one or more file system objects; and returning the simulated metadata responsive to the request.

Abstract: Various embodiments include systems and methods of implementing a machine learning (ML) model for calculating confidence scores associated with potential security vulnerabilities. In some embodiments, the ML model may be used to determine a confidence score for a particular potential security vulnerability. According to some embodiments, input indicative of a change of verification status for the particular potential security vulnerability may be received via a vulnerability details graphical user interface. Responsive to determining that the confidence score generated by the ML model is inconsistent with the change of verification status, the change of verification status may be sent as analyst feedback data to one or model training components of the ML model. The model training component(s) may be utilized to refine the ML model based at least in part on the analyst feedback data.

Abstract: Embodiments of a transactional database system are described to implement transaction processing over database objects stored in a strongly consistent object storage system. When a transaction is initiated, the system makes a private copy of data objects that are used by the transaction. Reads and writes of the transaction will be performed on the private copy. When the transaction is to be committed, the system verifies that the committed state of the data objects has not changed outside the transaction, and updates metadata object(s) in the data storage system to point to the private copy as the currently committed state of the data objects. If the committed state of any data objects has changed during the transaction, the private copy is abandoned and the transaction is rolled back and/or retried.

Abstract: Various embodiments include systems and methods of implementing automated assessment scheduling. A particular automated assessment may be automatically performed based at least in part on an assessment configuration and scan engine resource(s) of an organization. Based at least in part on performance of the particular automated assessment, a scan engine utilization assessment may be performed to determine a scan engine utilization value that represents utilization of the scan engine resource(s) with respect to resource requirements that are based at least in part on the set of attributes of the assessment configuration. Based at least in part on the scan engine utilization assessment, a particular resource utilization recommendation may be generated. The particular resource utilization recommendation may correspond to a first resource utilization recommendation to allocate additional scan engine resources or a second resource utilization recommendation to allocate fewer scan engine resources.

Abstract: An access policy analysis system is disclosed, configured to analyze access policies defined in a computer network to generate effective access data (EAD) for individual pairs of principals and resources in the network, and performing a differential update process to selectively refresh portions of the EAD that are affected by later changes of the access policies. In embodiments, the update process also updates the EAD for principals and resources that exceed a staleness limit (e.g. principals and resources that have not been updated for a specified period of time). The update process is managed via a management interface that allows users to view, control, and configure the update process, and examine various metrics data associated with the update process.