Abstract: Systems, methods, and computer-readable media for performing threat remediation through a switch fabric of a virtualized network environment. Data traffic passing into a virtualized network environment including a plurality of virtual machines running on a switch fabric is monitored. A network threat introduced through at a least a portion of the data traffic is identified at the switch fabric. One or more remedial measures are performed in the network environment based on the identification of the network threat in the virtualized network environment.

Abstract: A system and method for generating a digital cybersecurity artifact includes selectively executing an automated cybersecurity investigation workflow based on a probable cybersecurity threat type of a cybersecurity event, wherein an output of the automated cybersecurity investigation workflow includes one or more corpora of investigation findings data in response to executing the automated cybersecurity investigation workflow; selectively instantiating a digital cybersecurity artifact of a plurality of digital cybersecurity artifacts based on the probable cybersecurity threat type of the cybersecurity event, wherein the digital cybersecurity artifact includes a plurality of distinct regions electronically mapped to one or more threat type-specific content automations that, when executed, install investigation findings data into the plurality of distinct regions of the plurality of distinct regions of the digital cybersecurity artifact with selective subsets of investigation findings data of the one or more cor

Abstract: Systems and methods can enable select virtual session capabilities on a user device configured to access a virtual session, which is an instance of a virtual machine. The user device can receive and forward to a gateway sever, a request to launch a virtual session. Based on the virtual session launch request, the gateway server can obtain a compliance profile determined from operational data. The gateway can permit user device access a virtual session hosted on a virtual machine (“VM”) server. The VM server can use the compliance profile and security data from the user device to determine a risk profile of the user device. The virtual session can be configured at the VM server based on the risk profile so as to allow access to a subset of available applications and functions within the applications for the virtual session.

Abstract: System and methods are described for efficient monitoring of network traffic in a public cloud computing environment. In one implementation, a method comprises: generating flow log records of network traffic in the public cloud computing environment; identifying a data packet that presents a potential security risk; identifying a captured data packet (PCAP) record corresponding to the identified data packet; and transmitting the PCAP record to a computing device for network traffic analysis.

Abstract: Domain Name System (DNS) security using process information is provided. An application accessing an internet service using a domain name is determined. Process information associated with the application along with an associated DNS query to identify an IP address associated with the domain name are identified. The process information and the associated DNS query to a DNS security service are sent. An action based on a response from the DNS security service is performed.

Abstract: Churn-aware training of a classifier which reduces the difference between predictions of two different models, such as a prior generation of a classification model and a subsequent generation. A second dataset of labelled data is scored on a prior generation of a classification model, wherein the prior generation was trained on a first dataset of labelled data. A subsequent generation of a classification model is trained with the second dataset of labelled data, wherein in training of the subsequent generation, weighting of at least some of the labelled data in the second dataset, such as labelled data threat yielded an incorrect classification, is adjusted based on the score of such labelled data in the prior generation.

Abstract: A cyber security protection system includes a plurality of threat information updating devices; and a proactive suspicious domain alert system, which including: a domain information monitoring device; a domain information storage device; and a security threat analysis device, arranged to operably communicate data with the plurality of threat information updating devices through a network. If the domain information monitoring device detects that a domain mapping of a suspect domain is changed and the new domain mapping of the suspect domain points to a predetermined local address, the domain information monitoring device would further monitor a domain mapping variation frequency of the suspect domain. If the domain mapping variation frequency of the suspect domain exceeds a predetermined value, the security threat analysis device adds the suspect domain into an alert list to render the plurality of threat information updating devices to block their member devices from accessing the suspect domain.

Abstract: Techniques for providing network traffic security in a virtualized environment are described. A threat aware controller uses a threat feed provided by a threat intelligence service to establish a threat detection engine on virtual switches. The threat aware controller and threat detection engine work together to detect any anomalous or malicious behavior of network traffic on the virtual switch and established virtual network functions to quickly detect, verify, and isolate network threats.

Abstract: Embodiments are disclosed for a method for a security model. The method includes generating a Bloch sphere based on a system information and event management (SIEM) of a security domain and a structured threat information expression trusted automated exchange of indicator information. The method also includes generating a quantum state probabilities matrix based on the Bloch sphere. Further, the method includes training a security threat model to perform security threat classifications based on the quantum state probabilities matrix. Additionally, the method includes performing a machine learning classification of the security domain based on the quantum state probabilities matrix.

Abstract: Customized DL anomaly detection models and generated and deployed on disparate edge devices. Configuration-related information is fetched from the edge devices and, based on the configuration/capabilities of the edge device, at least one primary deep learning-based anomaly detection model is selected, which are customized based on the configuration/capabilities of the edge device. Customization involves limiting the volume of the predictors/variables and optimizing the iterations used to determine anomalies and/or make predictions. The customized models are subsequently packaged in edge device-specific formats, such as a customized set of binaries in C language or the like. The resulting customized DL anomaly detection application is subsequently deployed to the edge device where it is executable without the need for specialized hardware or communication with network entities, such as cloud nodes or servers.

Abstract: A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

Abstract: Disclosed embodiments relate to systems and methods for correlating software pipeline events. Techniques include receiving first data representing at least one aspect of a first software pipeline event; identifying a value as a potential identifier of the first software pipeline event; storing the value in a data structure in an associative manner with the first software pipeline event; receiving second data representing at least one aspect of a second software pipeline event; identifying an additional value as a potential identifier of the second software pipeline event; comparing additional value to the value stored in the data structure; based on the comparison, determining whether a correlation exists between the first software pipeline event and the second software pipeline event; and based on a determination that a correlation exists, providing an indication of the correlation.

Abstract: Systems, methods, and non-transitory computer-readable storage media are disclosed for detecting, identifying, and/or assessing hidden vulnerabilities in an enterprise network. In one example, a device may have one or more memories storing computer-readable instructions and one or more processors configured to execute the computer-readable instructions to receive vulnerability data of network components within an enterprise network. The vulnerability data can include identification of one or more vulnerabilities detected within the enterprise network. The device can then determine a vulnerability frequency and a machine frequency associated with each of the one or more vulnerabilities. The device can then determine a vulnerability score for each of the one or more vulnerabilities based on the vulnerability frequency and an inverse of the machine frequency, to yield a plurality of vulnerability scores. The device can then rank the one or more vulnerabilities based on the plurality of vulnerability scores.

Abstract: The present disclosure is directed to a method of detecting anomalous behaviors based on a temporal profile. The method can include collecting, by a control system comprising a processor and memory, a set of network data communicated by a plurality of network nodes over a network during a time duration. The method can include identifying, by the control system, one or more seasonalities from the set of network data. The method can include generating, by the control system, a temporal profile based on the one or more identified seasonalities. The method can include detecting, by the control system and based on the temporal profile, an anomalous behavior performed by one of the plurality of network nodes. The method can include identifying, by the control system and based on the temporal profile, a root cause for the anomalous behavior.

Abstract: Attacks on a network device, e.g. an IoT device, are detected by analyzing network traffic and subsequently quarantining or blocking the network device on the network to prevent lateral movement of malware. The techniques described herein relate to developing a baseline of network device activity corresponding with a network device during a learning period and comparing the baseline of network device activity with new network activity by the network device in order to identify potentially unusual network device activity by the network device. If unusual network activity is found, remedial actions such as quarantining the network device or restricting some access to a network may be initiated.

Abstract: A method to secure a production environment in a network begins by associating a set of resources into a simulated environment layer configured to simulate at least a portion of the production environment. A preferred approach to building the simulated environment layer utilizes generative adversarial network (GAN) machine learning modeling. Upon detecting a suspect user attempting to interact with the production environment, one or more requests received from the suspect user are routed to the simulated environment layer as opposed to the production environment. At least one behavior of the simulated environment layer is then modified as the suspect user interacts within the simulated environment layer. The modified behavior facilitates that an attack initiated by the suspect user can proceed. Information (such as the user's tactics, techniques and procedures (TPPs), or other Indicators of Compromise (IoCs) associated with the attack is captured for analysis and subsequent action.

Abstract: Concepts for scaling a processing resource of a security information and event management system for processing a set of security events are presented. One example comprises identifying an event property of a set of security events, then assessing the identified event property against a predetermined rule. The method then comprises, in response to the assessed event property satisfying the predetermined rule, scaling a processing resource for processing the set of security events based on the predetermined rule.

Abstract: A method may include obtaining internal vulnerability data and external vulnerability data regarding various security vulnerabilities among various network elements for a predetermined organization. The method may include determining various exploitability levels for the security vulnerabilities using a model, the external vulnerability data, and the internal vulnerability data. The model may be generated using a machine-learning algorithm. The method may include determining a vulnerability priority for the plurality of security vulnerabilities using the plurality of exploitability levels and organization-specific criteria. The vulnerability priority may describe a sequence that the security vulnerabilities are remediated. The method may further include transmitting a remediation command to one of the network elements. The remediation command may initiate a remediation procedure at the network element to address the security vulnerability.

Abstract: A cyber security protection system includes a plurality of threat information updating devices; and a proactive suspicious domain alert system, which including: a domain information monitoring device, arranged to operably inspect domain ages of suspect domains; a domain information storage device; and a security threat analysis device, arranged to operably communicate data with the plurality of threat information updating devices through a network. Before the domain age of a suspect domain reaches a first threshold value, if the plurality of threat information updating devices discovers that an member device within a plurality of client network systems is trying to access the suspect domain, the security threat analysis device adds the suspect domain into an alert list to render the plurality of threat information updating devices to block member devices within the plurality of client network systems from accessing the suspect domain.

Abstract: Data surveillance techniques are presented for the detection of security and/or performance issues on a zero-trust computer network. There is a network device policy manager that works in conjunction with a network data policy manager and which is in charge of performing the above data surveillance. Of special interest are those security issues where privileged data may be stolen by steganographic, data manipulation or any form of exfiltration attempts. Such attempts may be made by rogue users or admins from the inside of a network, or from outside hackers who are able to intrude into the network but can impersonate themselves as legitimate users. The above data surveillance techniques are also applied for detecting intentional or unintentional exfiltration/leak of privileged data/assets between unauthorized users/groups of the organization.