Abstract: Disclosed herein are methods, systems, and processes to detect valid clusters and eliminate spurious clusters in cybersecurity-based computing environments. A cluster detection and elimination model is trained by accessing a dataset with raw data that includes data points associated with computing devices in a network and applying two or more different clustering methodologies independently to the dataset. The resulting cluster detection and elimination model is used to compare two or more clusters to determine whether a cluster from one clustering methodology matches another cluster from another clustering methodology based on centroid locations and shared data points.

Abstract: Disclosed herein are methods, systems, and processes for detecting data exfiltration. A data exfiltration event in a network is detected. Traffic data regarding outgoing traffic of a source in the network associated with the data exfiltration event is received. A logarithmic transformation is applied to the traffic data to generate transformed data. An outlier identification technique is selected based on the transformed data and is executed on the transformed data to determine that the outgoing traffic is indicative of the data exfiltration event. An alert is generated in response to the determination that the outgoing traffic is indicative of the data exfiltration event.

Abstract: Methods and apparatus for predicting unknown values given a data set of known values. A prediction engine ingests a variety of data sets. Once the dataset has been ingested, requests for predictions may be presented to the prediction engine. The engine responds with a prediction as well as a confidence score based on the ingested information using a variety of techniques. Some of these techniques identify witness values in the ingested data that are similar to the requested prediction, other techniques compute witness values from ingested data, etc. These witness values are aggregated to yield an answer and a confidence level in a way that permits the user to review the underlying witness values.

Abstract: Methods and systems for detecting a data exfiltration event on a network. The method includes receiving traffic data and applying a transformation to transform the traffic data at least closer to a normal distribution. The method further includes selecting at least one outlier identification technique based on a property of the transformed data, and then executing the at least one selected identification technique to determine whether the traffic data is indicative of a data exfiltration event.

Abstract: Methods and systems for detecting malicious network activity. The method may include analyzing payload data relating to activity on one or more virtual security appliances, grouping related payloads, and analyzing a time series dataset describing the groupings to identify anomalous payloads.

Abstract: Disclosed herein are methods, systems, and processes to automate cluster interpretation in computing environments to develop targeted remediation security actions. To interpret clusters that are generated by a clustering methodology without subjecting clustered data to classifier-based processing, separation quantifiers that indicate a spread in feature values across clusters are determined and used to discover relative feature importances of features that drive the formation of clusters, permitting a security server to identify features that discriminate between clusters.

Abstract: Disclosed herein are methods, systems, and processes to detect valid clusters and eliminate spurious clusters in cybersecurity-based computing environments. A cluster detection and elimination model is trained by accessing a dataset with raw data that includes data points associated with computing devices in a network and applying two or more different clustering methodologies independently to the dataset. The resulting cluster detection and elimination model is used to compare two or more clusters to determine whether a cluster from one clustering methodology matches another cluster from another clustering methodology based on centroid locations and shared data points.

Abstract: Disclosed herein are methods, systems, and processes to optimize role level identification for computing resource allocation to perform security operations in networked computing environments. A role level classifier to process a training dataset that corresponds to a clean title is generated from a subset of entities associated with the clean title. An initial effective title determined by the role level classifier based on processing the training dataset is assigned to an entity. A new effective title based on feature differences between the initial effective title and the clean title is re-assigned to the entity. Performance of the generating, the assigning, and the re-assigning is repeated using the new effective title instead of the clean title.

Abstract: Approaches provide for securing an electronic environment. A threat analysis service can obtain data for devices, users, and threats from disparate sources and can correlate users to devices and threats to build an understanding of an electronic environment's operational, organizational, and security concerns in order to provide customized security strategies and remediations. Additionally, the threat analysis service can develop a model of an electronic environment's behavior by monitoring and analyzing various the data from the data sources. The model can be updated such that the threat analysis service can tailor its orchestration to complement existing operational processes.

Abstract: Methods and systems for detecting malicious network activity. The method may include analyzing payload data relating to activity on one or more virtual security appliances, grouping related payloads, and analyzing a time series dataset describing the groupings to identify anomalous payloads.

Abstract: Analyzing and reporting anomalous internet traffic data by accepting a request for a connection to a virtual security appliance, collecting attribute data about the connection, applying an alert module to the data, and automatically generating an alert concerning an identified incident. An alert system for analyzing and reporting the anomalous internet traffic data. A processor to analyze and report anomalous internet traffic data.

Abstract: Methods and systems for detecting malicious network activity. The method may include analyzing payload data relating to activity on one or more virtual security appliances, grouping related payloads, and analyzing a time series dataset describing the groupings to identify anomalous payloads.

Abstract: Methods and systems for event prediction. The system includes at least one connector configured to gather at least partially incomplete data from at least one data source. The gathered data may be communicated to a model definition module that converts at least a subset of the gathered data into a prediction model in accordance with a received definition. A prediction module may receive a prediction query and, in response, supply an event prediction based on the prediction model.

Abstract: Methods and apparatus for predicting unknown values given a data set of known values. A prediction engine ingests a variety of data sets. Once the dataset has been ingested, requests for predictions may be presented to the prediction engine. The engine responds with a prediction as well as a confidence score based on the ingested information using a variety of techniques. Some of these techniques identify witness values in the ingested data that are similar to the requested prediction, other techniques compute witness values from ingested data, etc. These witness values are aggregated to yield an answer and a confidence level in a way that permits the user to review the underlying witness values.