Abstract: Artificial Intelligence (AI)-based detection of malware, and, specifically, ransomware, based on observing behaviors that occur in the computing system in the presence of the malware and training the AI to monitor for such behaviors. Once the behaviors are detected, they are compared to acceptable baseline level of occurrence of the behaviors (i.e., normal computing system behaviors) and if determined to exceed the baseline level, one or more actions are triggered to mitigate or prevent the malware/ransomware attack. By basing the detection of malware on behaviors, such as computing system events and/or configurations, as opposed to solely based on indicators (e.g., digital signatures), the ability of wrongdoers circumventing the detection mechanisms is lessened and the likelihood that malware is detected prior to detonation greatly increases.

Abstract: Arrangements for dynamic system control evaluation and issue identification and mitigation are provided. In some examples, data may be received from a plurality of sources. The data may be received in batches at predetermined intervals or time periods, and/or as streaming data. In some examples, a first system control may be identified and a first system control value may be determined for the first system control. A plurality of threshold ranges associated with the first system control may be identified and the first system control value may be compared to the plurality of threshold ranges. Based on the comparing, the first system control value may be mapped to an objective score on a cyber health scale. The objective score may then be evaluated to determine whether an issue is occurring or is likely to occur. If so, one or more mitigation actions may be identified and implemented.

Abstract: Arrangements for dynamic system control evaluation and issue identification and mitigation are provided. In some examples, data may be received from a plurality of sources. The data may be received in batches at predetermined intervals or time periods, and/or as streaming data. In some examples, a first system control may be identified and a first system control value may be determined for the first system control. A plurality of threshold ranges associated with the first system control may be identified and the first system control value may be compared to the plurality of threshold ranges. Based on the comparing, the first system control value may be mapped to an objective score on a cyber health scale. The objective score may then be evaluated to determine whether an issue is occurring or is likely to occur. If so, one or more mitigation actions may be identified and implemented.