Abstract: Techniques for calculating risk scores of entity assignments are discussed herein. The system generates a probability matrix using a collaborative filtering technique such as singular value decomposition. The probability matrix is populated with probability values for each entity representing a probability that, based on the various relationships or associations of that entity with other entities, the entity has been granted an assignment. Risk values are used to provide a weighting value to assignments, separating relatively higher risk assignments from relatively lower risk assignments. The system thereafter calculates a risk score for one or more of the entities using the information in the assignment matrix, the probability matrix, and the risk values. The system can flag or identity one or more entities whose risk scores do not meet various criteria.

Abstract: Techniques, systems, and computer-readable media for dynamic behavior-based asset classification are described herein. An asset classification system can detect and receive data associated with a host computer, determine, based on the data, a behavior associated with the host computer, assign the host computer a server classification based on the determination that the behavior represents a behavior of focus, and record the assigned server classification associated with the host computer. In various examples, the asset classification system can determine the behavior is a behavior of focus based on one or more of: a number of connections to other computers associated with a shared customer identifier, a number of unique other host computers connecting to the host computer, and/or a number of unique non-local accounts that have logged in to the host computer, and that the host computer has had an inbound connection on a common port.

Abstract: Timestamped events involving entities occurring over a time period are maintained in a graph where each node represents a respective entity and edges connected to a node represent corresponding timestamped events involving the entity represented by the node. A respective array of values corresponding to the edges is created for each node. A number of embedding vectors is created for each node, each comprising numerical values corresponding to a portion of the respective array of values for the node for a portion of the time period of timestamped events involving the entity represented by the node. Similarity is measured in the numerical values of one of the embedding vectors relative to the numerical values of another one or more of the embedding vectors obtained for the node. An action is taken with regard to the entity represented by the node responsive to the measured similarity.

Abstract: Timestamped events involving entities occurring over a time period are maintained in a graph where each node represents a respective entity and edges connected to a node represent corresponding timestamped events involving the entity represented by the node. A respective array of values corresponding to the edges is created for each node. A number of embedding vectors is created for each node, each comprising numerical values corresponding to a portion of the respective array of values for the node for a portion of the time period of timestamped events involving the entity represented by the node. Similarity is measured in the numerical values of one of the embedding vectors relative to the numerical values of another one or more of the embedding vectors obtained for the node. An action is taken with regard to the entity represented by the node responsive to the measured similarity.

Abstract: The present disclosure provides an approach of collecting vulnerability data corresponding to a vulnerability of a target product. The approach provides the vulnerability data to an artificial intelligence model that is trained to determine a complexity indicator from the vulnerability data. The complexity indicator corresponds to applying a vulnerability patch to remediate the vulnerability. The approach determines a patch complexity classification by providing the complexity indicator to the artificial intelligence model and, in turn, provides the patch complexity classification to a target system corresponding to the target product.

Abstract: The present disclosure provides an approach of collecting historical cybersecurity detection data comprising a plurality of cybersecurity detections and a plurality of detection times. The approach transforms the historical cybersecurity detection data into a plurality of rank ordered detection datasets that rank order each one of the plurality of cybersecurity detections based on the plurality of detection times. In turn, the approach trains an artificial intelligence (AI) model using the plurality of rank ordered detection datasets to generate a prioritized output dataset from an input dataset.

Abstract: Techniques, systems, and computer-readable media for dynamic behavior-based asset classification are described herein. An asset classification system can detect and receive data associated with a host computer, determine, based on the data, a behavior associated with the host computer, assign the host computer a server classification based on the determination that the behavior represents a behavior of focus, and record the assigned server classification associated with the host computer. In various examples, the asset classification system can determine the behavior is a behavior of focus based on one or more of: a number of connections to other computers associated with a shared customer identifier, a number of unique other host computers connecting to the host computer, and/or a number of unique non-local accounts that have logged in to the host computer, and that the host computer has had an inbound connection on a common port.

Abstract: The present disclosure provides an approach of generating a target feature vector based on information corresponding to a target entity. The target entity utilizes a target system that includes a target asset. The approach matches the target feature vector to a compatible entity cluster from a plurality of entity clusters. The compatible entity cluster corresponds to a current entity system. The approach generates a target asset prioritization rule based on prioritization information of the current entity system. In turn, the approach prompts the target system to assign a prioritization label to the target asset based on the target asset prioritization rule.

Abstract: Techniques for calculating risk scores of entity assignments are discussed herein. The system generates a probability matrix using a collaborative filtering technique such as singular value decomposition. The probability matrix is populated with probability values for each entity representing a probability that, based on the various relationships or associations of that entity with other entities, the entity has been granted an assignment. Risk values are used to provide a weighting value to assignments, separating relatively higher risk assignments from relatively lower risk assignments. The system thereafter calculates a risk score for one or more of the entities using the information in the assignment matrix, the probability matrix, and the risk values. The system can flag or identity one or more entities whose risk scores do not meet various criteria.

Abstract: Techniques for calculating risk scores of entity assignments are discussed herein. The system generates a probability matrix using a collaborative filtering technique such as singular value decomposition. The probability matrix is populated with probability values for each entity representing a probability that, based on the various relationships or associations of that entity with other entities, the entity has been granted an assignment. Risk values are used to provide a weighting value to assignments, separating relatively higher risk assignments from relatively lower risk assignments. The system thereafter calculates a risk score for one or more of the entities using the information in the assignment matrix, the probability matrix, and the risk values. The system can flag or identity one or more entities whose risk scores do not meet various criteria.

Abstract: Techniques for calculating risk scores of entity assignments are discussed herein. The system generates a probability matrix using a collaborative filtering technique such as singular value decomposition. The probability matrix is populated with probability values for each entity representing a probability that, based on the various relationships or associations of that entity with other entities, the entity has been granted an assignment. Risk values are used to provide a weighting value to assignments, separating relatively higher risk assignments from relatively lower risk assignments. The system thereafter calculates a risk score for one or more of the entities using the information in the assignment matrix, the probability matrix, and the risk values. The system can flag or identity one or more entities whose risk scores do not meet various criteria.