Abstract: The main enabler of the technology is the probabilistic programming based computation strategies that have an outstanding ability to handle uncertainties in discovering anomalous patterns. This new capability to handle uncertainties is particularly relevant for detecting insider threats, as there are usually no clearly defined rules and policies. An insider's behaviors would deviate from normally distributed events and actions in various aspects. The probabilistic model detects this deviation and explains the computational path of the deviation. The result interpretation unit enables organizations to investigate the causes with high accuracy, avoiding costly and embarrassing false alarms. The technology detects and ranks abnormal events. This ranking capability helps prioritize follow-up manual investigation.

Abstract: A computer system for distinguishing user-initiated network traffic from malware-initiated network traffic comprising at least one central processing unit (CPU) and a memory communicatively coupled to the CPU. The memory includes a program code executable by the CPU to monitor individual network events to determine for an individual network event whether the event has a legitimate root-trigger. Malware-initiated traffic is identified as an individual network event that does not have a legitimate root-trigger.

Abstract: A computer system for distinguishing user-initiated network traffic from malware-initiated network traffic comprising at least one central processing unit (CPU) and a memory communicatively coupled to the CPU. The memory includes a program code executable by the CPU to monitor individual network events to determine for an individual network event whether the event has a legitimate root-trigger. Malware-initiated traffic is identified as an individual network event that does not have a legitimate root-trigger.

Abstract: A system and method for distinguishing human input events from malware-generated events includes one or more central processing units (CPUs), one or more input devices and memory. The memory includes program code that when executed by the CPU causes the CPU to obtain a first set of input events from a user utilizing the input device. The first input events are used to obtain or derive a feature indicative of the user, such as a multi-dimensional feature vector as provided by a support vector machine. Second input events are then obtained, and the second input events are classified against the feature to determine if either the user or malware initiated the second input events.

Abstract: One or more methods of generating a pseudonymizable document are described. A method comprises receiving a set of subdocuments and generating a first set of random values wherein each subdocument in the document corresponds to a first set random value. A second set of values is generated based on a subdocument and a corresponding value of the first set random value. A set of pseudonyms is generated wherein each subdocument in the document corresponds to at least one pseudonym of the pseudonym set. A third set of values is generated based on the second set of values and the pseudonym set and a summary value is generated based on the third set of values.

Abstract: A system and method for distinguishing human input events from malware-generated events includes one or more central processing units (CPUs), one or more input devices and memory. The memory includes program code that when executed by the CPU causes the CPU to obtain a first set of input events from a user utilizing the input device. The first input events are used to obtain or derive a feature indicative of the user, such as a multi-dimensional feature vector as provided by a support vector machine. Second input events are then obtained, and the second input events are classified against the feature to determine if either the user or malware initiated the second input events.

Abstract: One or more methods of generating a pseudonymizable document are described. A method comprises receiving a set of subdocuments and generating a first set of random values wherein each subdocument in the document corresponds to a first set random value. A second set of values is generated based on a subdocument and a corresponding value of the first set random value. A set of pseudonyms is generated wherein each subdocument in the document corresponds to at least one pseudonym of the pseudonym set. A third set of values is generated based on the second set of values and the pseudonym set and a summary value is generated based on the third set of values.