Abstract: Systems and methods include obtaining Uniform Resource Locator (URL) transactions that were either undetected by a machine learning model or mischaracterized by the machine learning model; filtering the URL transactions based on any of size and transaction count; utilizing one or more techniques to determine words that provide an explanation for a category of a plurality of categories of the filtered URL transactions; and utilizing a label for the filtered URL transactions and the determined words for each as training data to update the machine learning model.

Abstract: Systems and methods include obtaining a profile for an application, wherein the profile includes one or more tenants, rules for use of the application by the one or more tenants, and users for the rules; monitoring a user of a tenant of the one or more tenants inline via a node in a cloud-based system; identifying an application of the one or more applications based on the monitoring and associated rules for the user; and enforcing the associated rules for the user for the application.

Abstract: Systems and methods include determining a plurality of features associated with executable files, wherein the plurality of features are each based on static properties in predefined structure of the executable files; obtaining training data that includes samples of benign executable files and malicious executable files; extracting the plurality of features from the training data; and utilizing the extracted plurality of features to train a machine learning model to detect malicious executable files.

Abstract: Systems and methods include, based on monitoring of content including Office documents, determining distribution of malicious Office documents between documents having malicious macros and documents having malicious embedded objects; determining features for the documents having malicious macros and for the documents having malicious embedded objects; selecting training data for a machine learning model based on the distribution and the features; and training the machine learning model with the selected training data.

Abstract: Systems and methods include obtaining data from Uniform Resource Locator (URL) transactions monitored by a cloud-based system; labeling the data for the URL transactions with a category of a plurality of categories that describe the content of a page associated with the URL; performing preprocessing of raw Hypertext Markup Language (HTML) files for the URL transactions; extracting features from the preprocessed raw HTML files; and creating a machine learning model based on the features, wherein the machine learning model is configured to score content associated with an unknown URL to determine a category of the plurality of categories.

Abstract: Systems and methods include causing a scan by Cloud Access Security Broker (CASB) system of a plurality of users associated with a tenant in a Software-as-a-Service (SaaS) application where the scan includes any of identifying malware in content in the SaaS application and identifying confidential data in the content in the SaaS application; during the scan which is covering historical data in the SaaS application, receiving notifications of the content being actively modified by any of the plurality of users; and including the content being actively modified in the scan with the historical data. The systems and methods can further include maintaining geolocation of the any of the plurality of users; and causing the content being actively modified in the scan to be processed by the CASB system based on the geolocation.

Abstract: Mobile device security, device management, and policy enforcement are described in a cloud-based system where the “cloud” is used to pervasively enforce security and policy and perform device management regardless of device type, platform, location, etc. A method includes receiving one of a mobile profile and an application for an enterprise and a cloud-based system; installing the one of the mobile profile and the application on the mobile device; connecting to a network using the one of the mobile profile and the application; and having traffic content inspected and policy enforced thereon to/from the mobile device and the network via the cloud-based system.

Abstract: Systems and methods include identifying a cloud application; performing one or more automated scripts to determine a first set of attributes of the cloud application; obtaining a second set of attributes of the cloud application based on a manual analysis; obtaining weighting factors for the first set of attributes and the second set of attributes; determining a risk score of the cloud application based on the first set of attributes and the second set of attributes and the associated weighting factors; and displaying the risk score of the cloud application. The steps can further include enforcing security policies for the cloud application based on the risk score, such as via one of a cloud-based system and a Cloud Access Security Broker (CASB) system.

Abstract: Systems and methods include obtaining a file to be checked for Data Loss Prevention (DLP); determining a cryptographic hash of the file and comparing the cryptographic hash to corresponding cryptographic hashes of indexed files; responsive to a match between the cryptographic hash and one of the corresponding cryptographic hashes, determining a DLP match and performing an action based thereon; responsive to no match, extracting text from the file and creating an ordered sequence of hashes of variable length chunks of the extracted text; and determining the DLP match with one of the indexed files based on comparing the ordered sequence of hashes with corresponding ordered sequence of hashes of the indexed files.

Abstract: Systems and methods include receiving a domain for a determination of a likelihood the domain is malicious or benign; obtaining data associated with the domain including log data from a cloud-based system that performs monitoring of a plurality of users; analyzing the domain with a plurality of components to assess the likelihood, wherein at least one of the plurality of components is a trained machine learning model; and combining results of the plurality of components to predict the likelihood the domain is malicious or benign.

Abstract: Systems and methods include receiving a domain for a determination of a likelihood the domain is a command and control site; analyzing the domain with an ensemble of a plurality of trained machine learning models including a Uniform Resource Locator (URL) model that analyzes lexical features of a hostname of the domain and an artifact model that analyzes content features of a webpage associated with the domain; and combining results of the ensemble to predict the likelihood the domain is a command and control site.

Abstract: Systems and methods include, responsive to starting a plurality of listener modules, receiving a Uniform Resource Locator (URL) for a site on the Internet into a database; loading the URL; receiving artifacts based on the loading; using the plurality of listener modules to run rules based on the received artifacts; scoring the URL based on the rules and the received artifacts; and determining whether the URL is one of benign, suspicious, or malicious based on the scoring. The steps can include any of blocking the URL, allowing the URL, further analyzing the URL, adding the URL to a whitelist or blacklist, and providing a notification, based on whether the URL is benign, suspicious, or malicious.

Abstract: Systems and methods for Data Loss Prevention (DLP) on images include detecting an image in monitored user traffic; scanning the image to identify any text and extracting any identified text therein; responsive to the extracting, scanning the extracted text with a plurality of DLP techniques including one or more DLP engines where the extracted text is checked to trigger the one or more DLP engines, Exact Data Matching (EDM) where the extracted text is matched to see if it matches specific content, and Indexed Data Matching (IDM) where the extracted text is matched to some part of a document from a repository of documents; and performing one or more actions based on results of the plurality of DLP techniques.

Abstract: A cloud-based security system includes a plurality of enforcement nodes connected to one another; a central authority connected to the plurality of enforcement nodes; and a Data Loss Prevention (DLP) service executed between the plurality of enforcement nodes, wherein the DLP service includes one or more DLP rules based on one or more DLP engines for a tenant, and wherein, for the DLP service, a first enforcement node is configured to monitor traffic of a user of the tenant, detect a DLP rule violation based on the one or more DLP rules, and forward DLP incident information to a second enforcement node, and the second enforcement node is configured to transmit the DLP incident information to a server for the tenant, including both DLP triggering content that cause the DLP rule violation and DLP scan metadata.

Abstract: Mobile device security, device management, and policy enforcement are described in a cloud-based system where the “cloud” is used to pervasively enforce security and policy and perform device management regardless of device type, platform, location, etc. A cloud-based method includes monitoring traffic between a mobile device and a network in a cloud-based system that is implemented as an overlay network relative to the mobile device and the network; analyzing the traffic from the mobile device to the network, for enforcing policy thereon, wherein the policy includes a set of use guidelines associated with the user of the mobile device; and blocking or allowing the traffic from the mobile device to the network based on the analyzing.

Abstract: A Cloud Access Security Broker (CASB) system includes a controller; a message broker connected to the controller; and a plurality of workers connected to the message broker and connected to one or more cloud providers having a plurality of files contained therein for one or more tenants, wherein the plurality of workers are configured to crawl through the plurality of files for the one or more tenants, based on policy and configuration for the one or more tenants provided via the controller, and based on assignments from the message broker. The plurality of workers can be further configured to cause an action in the one or more cloud providers based on the crawl and based on the policy and the configuration. The action can include any of allowing a file, deleting a file, quarantining a file, and providing a notification.

Abstract: Systems and methods include training a machine learning model with data for identifying features in monitored traffic in a network; analyzing the trained machine learning model to identify information overhead therein, wherein the information overhead is utilized in part for the training; removing the information overhead in the machine learning model; and providing the machine learning model for runtime use for identifying the features in the monitored traffic, with the removed information overhead from the machine learning model.

Abstract: Mobile device security, device management, and policy enforcement are described in a cloud-based system where the “cloud” is used to pervasively enforce security and policy and perform device management regardless of device type, platform, location, etc. A cloud-based method includes monitoring traffic between a mobile device and a network in a cloud-based system that is implemented as an overlay network relative to the mobile device and the network; analyzing the traffic from the mobile device to the network, for enforcing policy thereon, wherein the policy includes a set of use guidelines associated with the user of the mobile device; and blocking or allowing the traffic from the mobile device to the network based on the analyzing.

Abstract: Systems and methods include obtaining a file associated with a user for processing; utilizing a combination of policy for the user and machine learning to determine whether to i) quarantine the file and scan the file in a sandbox, ii) allow the file to the user and scan the file in the sandbox, and iii) allow the file to the user without the scan; responsive to the quarantine of the file and the sandbox determining the file is malicious, blocking the file; and, responsive to the quarantine of the file and the sandbox determining the file is benign, allowing the file.

Abstract: Mobile device security, device management, and policy enforcement are described in a cloud based system where the “cloud” is used to pervasively enforce security and policy and perform device management regardless of device type, platform, location, etc. A cloud based method includes monitoring traffic between a mobile device and an external network in a cloud based system separate from the mobile device and the external network; enforcing policy with respect to the traffic from the mobile device to the external network to determine whether to block or allow the traffic from the mobile device to the external network; and inspecting content associated with the traffic from the external network to the mobile device to determine whether to block or allow the traffic from the external network to the mobile device.