Abstract: Systems and methods of discovering computer network assets, including: identifying, by a processor, in sampled traffic over at least one computer network, an internet protocol (IP) address of a node communicating over at least one port, wherein the at least one port is associated with an asset type, determining, by the processor, a volume of traffic associated with the IP address of the node communicating over the at least one port, discovering, by the processor, the IP address of the node as belonging to an asset of the asset type, based on the volume of traffic exceeding a dynamic threshold, and adding the asset, by the processor, to a list of discovered assets.

Abstract: Systems and methods of detecting communication anomalies in a computer network, including: analyzing sampled traffic within the computer network, to identify at least one entity in the computer network, generating a network graph that corresponds to the computer network, wherein the network graph includes a plurality of nodes based on the identified at least one entity, training a deep learning (DL) algorithm to generate at least one vector characterizing the behavior of each entity in the computer network based on the generated network graph, applying the trained DL algorithm on the sampled traffic, to predict the probability of a communication in the sampled traffic, wherein the prediction is based on the generated at least one vector, and detecting an anomaly when the predicted probability is below an anomaly threshold.

Abstract: Systems and methods of discovering computer network assets, including: identifying, by a processor, in sampled traffic over at least one computer network, an internet protocol (IP) address of a node communicating over at least one port, wherein the at least one port is associated with an asset type, determining, by the processor, a volume of traffic associated with the IP address of the node communicating over the at least one port, discovering, by the processor, the IP address of the node as belonging to an asset of the asset type, based on the volume of traffic exceeding a dynamic threshold, and adding the asset, by the processor, to a list of discovered assets.

Abstract: Systems and methods of determining file-access patterns in at least one computer network, the network comprising a file-access server, including training a first machine learning (ML) algorithm with a first training dataset comprising vectors representing network traffic such that the first ML algorithm learns to determine network characteristics associated with file-access traffic, determining, using the first ML algorithm, network characteristics based on highest interaction of traffic with the file-access server compared to other interactions in the at least one computer network, and determining file-access patterns in the at least one computer network based on the network characteristics associated with file-access traffic.

Abstract: Systems and methods of determining file-access patterns in at least one computer network, the network comprising a file-access server, including training a first machine learning (ML) algorithm with a first training dataset comprising vectors representing network traffic such that the first ML algorithm learns to determine network characteristics associated with file-access traffic, determining, using the first ML algorithm, network characteristics based on highest interaction of traffic with the file-access server compared to other interactions in the at least one computer network, and determining file-access patterns in the at least one computer network based on the network characteristics associated with file-access traffic.

Abstract: Systems and methods of determining a network performance property in at least one computer network, including: sampling traffic in active communication with the at least one computer network, analyzing the sampled traffic to group communication packets to flows, and predicting at least one network property of the at least one network based on the grouped communication packets and based on at least one traffic parameter in the at least one network, where the at least one traffic parameter is selected from the group consisting of: union of packet streams, intersection of packet streams, and differences of packet streams, and where the predicted at least one network property is selected from the group consisting of: total number of flows, number of flows with a predefined characteristic, number of packets, and volume of packets.

Abstract: Systems and methods of detecting communication anomalies in a computer network, including: analyzing sampled traffic within the computer network, to identify at least one entity in the computer network, generating a network graph that corresponds to the computer network, wherein the network graph includes a plurality of nodes based on the identified at least one entity, training a deep learning (DL) algorithm to generate at least one vector characterizing the behavior of each entity in the computer network based on the generated network graph, applying the trained DL algorithm on the sampled traffic, to predict the probability of a communication in the sampled traffic, wherein the prediction is based on the generated at least one vector, and detecting an anomaly when the predicted probability is below an anomaly threshold.

Abstract: Systems and methods of detecting communication anomalies in a computer network, including: applying a machine learning (ML) algorithm on sampled network traffic, wherein the ML algorithm is trained with a training dataset comprising vectors to identify an anomaly when the ML algorithm receives a new input vector representing sampled network traffic, normalizing a loss determined by the ML algorithm based on the output of the ML algorithm for the new input vector being different from the output of the ML algorithm for the training dataset, and applying the ML algorithm to analyze the normalized loss to identify an anomaly based on at least one communication pattern in the sampled network traffic, allowing a model trained in one installation to serve as a base model in another installation by normalizing the loss vectors of each installation.

Abstract: Systems and methods of determining file-access patterns in at least one computer network, the network comprising a file-access server, including training a first machine learning (ML) algorithm with a first training dataset comprising vectors representing network traffic such that the first ML algorithm learns to determine network characteristics associated with file-access traffic, determining, using the first ML algorithm, network characteristics based on highest interaction of traffic with the file-access server compared to other interactions in the at least one computer network, and determining file-access patterns in the at least one computer network based on the network characteristics associated with file-access traffic.

Abstract: Systems and methods of determining a network performance property in at least one computer network, including: sampling traffic in active communication with the at least one computer network, analyzing the sampled traffic to group communication packets to flows, and predicting at least one network property of the at least one network based on the grouped communication packets and based on at least one traffic parameter in the at least one network, where the at least one traffic parameter is selected from the group consisting of: union of packet streams, intersection of packet streams, and differences of packet streams, and where the predicted at least one network property is selected from the group consisting of: total number of flows, number of flows with a predefined characteristic, number of packets, and volume of packets.