Patents by Inventor Ori MENDELSON

Ori MENDELSON has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Identifying insider-threat security incidents via recursive anomaly detection of user behavior
    Patent number: 10437831
    Abstract: A computerized system for recursively detecting anomalies in monitored behavior of entities. The system comprises a storage unit to store monitored events, event deviations and parameters related to each event and to each event deviation. The system comprises a processing unit configured to receive a plurality of input events, construct a plurality of baseline models, receive an input event that occurred during an analyzed timeframe, compare parameters of the received input event to a corresponding baseline model in order to detect an event deviation, and associate an event deviation score to the detected event deviation. Using the detected event deviation as an input event, said operations are repeated until a predetermined condition is satisfied, and an alert is generated, indicating suspicious activity has been detected. A viewer application configured to receive and display alerts relating to the detected event deviation is provided.
    Type: Grant
    Filed: March 13, 2016
    Date of Patent: October 8, 2019
    Assignee: EMC IP Holding Company LLC
    Inventors: Yaron De-Levie, Ori Mendelson, Idan Peretz, Sagi Hilleli, Guy Eisenkot
  • IDENTIFYING INSIDER-THREAT SECURITY INCIDENTS VIA RECURSIVE ANOMALY DETECTION OF USER BEHAVIOR
    Publication number: 20170126710
    Abstract: A computerized system for recursively detecting anomalies in monitored behavior of entities. The system comprises a storage unit to store monitored events, event deviations and parameters related to each event and to each event deviation. The system comprises a processing unit configured to receive a plurality of input events, construct a plurality of baseline models, receive an input event that occurred during an analyzed timeframe, compare parameters of the received input event to a corresponding baseline model in order to detect an event deviation, and associate an event deviation score to the detected event deviation. Using the detected event deviation as an input event, said operations are repeated until a predetermined condition is satisfied, and an alert is generated, indicating suspicious activity has been detected. A viewer application configured to receive and display alerts relating to the detected event deviation is provided.
    Type: Application
    Filed: March 13, 2016
    Publication date: May 4, 2017
    Inventors: Yaron DE-LEVIE, Ori MENDELSON, Idan PERETZ, Sagi HILLELI, Guy EISENKOT