Abstract: A model trainer obtains initial training data and refined training data to be used for training a classification model to detect grayware in Hypertext Markup Language (HTML) documents using transfer learning. The model trainer obtains the refined training data by collecting grayware HTML documents from a trusted data source(s), embedding and clustering the grayware HTML documents, and identifying and removing clusters having low confidence of corresponding to known grayware campaigns. The model trainer then trains a baseline model to classify HTML documents as grayware or benign with the initial training data, replaces the classification head of the baseline model with a new classification head to obtain a refined model, and further trains via the refined model via transfer learning with the refined training data.

Abstract: A pipeline for classifying malicious communications as AI generated or human generated has been created. The pipeline uses a first prompt template that directs a first LLM to parse a phishing e-mail and extract information from the phishing e-mail. The pipeline searches publicly available information to obtain current information based on keywords in the information extracted from the phishing e-mail. The pipeline then uses a second LLM to compose an e-mail. With a different prompt template, the pipeline directs the second LLM to compose an e-mail based on the obtained, current information and a recipient and sender extracted from the phishing e-mail. With another prompt, the pipeline directs the second LLM to determine whether the phishing e-mail is similar to the LLM composed e-mail. If the second LLM responds that the phishing e-mail is similar to the composed e-mail, then the phishing e-mail is classified as AI generated.

Abstract: A method of filtering out new alerts generated by a security agent installed in an endpoint is based on cluster profile data of clusters that were generated by applying a clustering algorithm to locality-sensitive hash (LSH) values of prior alerts. The method includes the steps of: storing cluster profile data of each cluster that is part of a subset of the clusters; generating an LSH value of a new alert generated by the security agent; and determining that the new alert belongs to one of the clusters in the subset based on the LSH value of the new alert and, in response to said determining, filtering out the new alert from a group of alerts that require further investigation.

Abstract: A method of evaluating alerts generated by security agents installed in endpoints includes: receiving a locality-sensitive hash (LSH) value associated with an alert generated by a security agent installed in one of the endpoints; performing a search for centroids that are within a threshold distance from the received LSH value, wherein the centroids are each an LSH value that is representative of one of a plurality of groups of alerts; and assigning a security risk indicator to the alert associated with the received LSH value based on results of the search and transmitting the security risk indicator to a security analytics platform of the endpoints.

Abstract: A method of scoring alerts generated by a plurality of endpoints includes the steps of: in response to a new alert generated by a first endpoint of the plurality of endpoints, generating an anomaly score of the new alert; identifying a rule that triggered the new alert and determining a threat score associated with the rule; and generating a security risk score for the new alert based on the anomaly score and the threat score and transmitting the security risk score to a security analytics platform of the endpoints.