Abstract: Some embodiments help protect an organization against ransomware attacks by combining incrimination logics. An organizational-level incrimination logic helps detect alert spikes across many machines, which collectively indicate an attack. Graph-based incrimination logics help detect infestations of even a few machines, and local incrimination logics focus on protecting respective individual machines. Graph-based incrimination logics may compare monitored system graphs to known ransomware attack graphs. Graphs may have devices as nodes and device network connectivity, repeated files, repeated processes or actions, or other connections as edges. Statistical analyses and machine learning models may be employed as incrimination logics. Search logics may find additional incrimination candidates that would otherwise evade detection, based on files, processes, IP addresses, devices, accounts, or other computational entities previously incriminated.

Abstract: Embodiments of the present disclosure provide systems, methods, and non-transitory computer storage media for identifying malicious behavior using a trained deep learning model. At a high level, embodiments of the present disclosure utilize a trained deep learning model that takes a sequence of ordered signals as input to generate a score that indicates whether the sequence is malicious or benign. Initially, process data is collected from a client. After the data is collected, a virtual process tree is generated based on parent and child relationships associated with the process data. Subsequently, embodiments of the present disclosure aggregate signal data with the process data such that each signal is associated with a corresponding process in a chronologically ordered sequence of events. The ordered sequence of events is vectorized and fed into the trained deep learning model to generate a score indicating the level of maliciousness of the sequence of events.

Abstract: A method includes generating a tokenized representation of a given software script, the tokenized representation comprising two or more tokens representing two or more commands in the given software script. The method also includes mapping the tokens of the tokenized representation to a vector space providing contextual representation of the tokens utilizing an embedding layer of a deep learning network, detecting sequences of the mapped tokens representing sequences of commands associated with designated types of script behavior utilizing at least one hidden layer of the deep learning network, and classifying the given software script based on the detected sequences of the mapped tokens utilizing one or more classification layers of the deep learning network. The method further includes modifying access by a given client device to the given software script responsive to classifying the given software script as a given software script type.

Abstract: A method includes generating an index representation of characters of code of a given file and mapping the index representation to a vector space providing contextual representation of the characters utilizing an embedding layer of a recurrent neural network (RNN). The method also includes identifying one or more code features in the mapped index representation utilizing at least one hidden layer of the RNN, detecting sequences of the identified code features in the mapped index representation utilizing a plurality of memory units of a recurrent layer of the RNN, and generating a classification result for the given file based on the detected sequences of code features utilizing one or more classification layers of the RNN. The method further comprises utilizing the classification result to determine if the given file contains code of a designated code type, and modifying access by a given client device to the given file responsive to the determination.

Abstract: A method includes obtaining session data related to a plurality of network sessions, analyzing the session data to identify one or more features of the network sessions, and utilizing the one or more features to aggregate the plurality of network sessions into a plurality of meta-sessions. A meta-session comprises a set of network sessions having similar features. The method also includes selecting a classifier for ranking the meta-sessions based on a scoring function that characterizes performance in ranking meta-sessions having a designated characteristic, ranking the meta-sessions utilizing the selected classifier, providing a designated number of the ranked meta-sessions for additional processing to determine potential maliciousness, and modifying access by client devices to an additional network session responsive to the additional network session comprising session data with features similar to those of one of the designated number of the ranked meta-sessions determined to be potentially malicious.

Abstract: A computing device includes at least one processor and a satisfaction prediction module. The satisfaction prediction module is to generate a pruned decision tree using historical ticket data for a plurality of customer tickets, where the historical ticket data for each customer ticket includes a satisfaction metric and attribute values of the customer ticket. The satisfaction prediction module is also to generate a plurality of business rules based on the pruned decision tree, obtain at least one attribute value of an active customer ticket, and determine, based on the plurality of business rules and the at least one attribute value, a projected satisfaction metric for the active customer ticket.