Abstract: Embodiments of a cyberattack monitoring system are disclosed to identify successful attacks on a service based on benign activities of the attacker performed after the initial attack attempt. In embodiments, the system identifies the initial attack by matching client actions to known attack patterns. Clients observed with attempted attacks are remembered as suspected attackers. The system will then monitor subsequent actions of suspected attackers for signs that the initial attack attempt was successful. In embodiments, a successful attack is recognized when the system observes one or more subsequent benign actions by the suspected attacker. In embodiments, the presence of follow-on benign actions is used as a filter to filter out unsuccessful attacks and false positives detected by the system. The filtering enables the system to better focus system resources and human attention on a small set of client activities that are likely successful attacks.

Abstract: Methods and systems for generating a search expression. The system begins with an empty search expression, and iteratively expands the search expression until some terminating condition is reached.

Abstract: Systems and methods are disclosed to implement an outlier detection system for text records. In embodiments, the detection system generates a fingerprint for each incoming record so that similar records map to similar fingerprints. Each record is assigned to a closest cluster in a set of clusters based computed distances between on the record's fingerprint and respective cluster fingerprints of the clusters. The cluster fingerprint is dynamically updated to maintain respective a representative fingerprint of its member records. When a new record is received that is not sufficiently close to any cluster, a new cluster is added to the set for the new record. In embodiments, the creation of the new cluster triggers an alert that the new record is a potential outlier. Advantageously, the disclosed detection system can be used to detect outliers in records in near real time, without the need to pre-specify outlier characteristics.

Abstract: Systems and methods are disclosed to implement a thread sensor generation system to generate thread sensors for extracting side channel information about other executing threads on a multithreading CPU. In embodiments, the system generates a set of sensors for evaluation. Each sensor may include a sequence of arithmetic or logic operations between variables or constants, which will cause a particular resource usage pattern by the CPU. The sensors are executed on the CPU in parallel with instances of a victim thread to measure an execution slowdown profile of the sensor thread caused by CPU resource conflicts with the victim thread. Based on the execution slowdown profiles, a sensitivity metric is calculated for each sensor, which is used to select the best sensor(s) for the victim thread. Sensors generated using the disclosed techniques can be used to extract secret information via side-channel attacks on currently available multithreaded processors.

Abstract: Systems and methods are disclosed to implement a thread sensor generation system to generate thread sensors for extracting side channel information about other executing threads on a multithreading CPU. In embodiments, the system generates a set of sensors for evaluation. Each sensor may include a sequence of arithmetic or logic operations between variables or constants, which will cause a particular resource usage pattern by the CPU. The sensors are executed on the CPU in parallel with instances of a victim thread to measure an execution slowdown profile of the sensor thread caused by CPU resource conflicts with the victim thread. Based on the execution slowdown profiles, a sensitivity metric is calculated for each sensor, which is used to select the best sensor(s) for the victim thread. Sensors generated using the disclosed techniques can be used to extract secret information via side-channel attacks on currently available multithreaded processors.

Abstract: Methods and systems for generating a search expression. The system begins with an empty search expression, and iteratively expands the search expression until some terminating condition is reached.

Abstract: Systems and methods are disclosed for an approximate string searching technique to search for match results that have character differences with the search string. A cost is computed to measure the amount of character differences, and a match is recognized if the cost is below a threshold. The match is determined based on an inferred state machine, whose states are iteratively generated in computer memory for successive characters in the input text. States are added to represent modifications to the string needed to account for character differences and track the costs of the modifications. States are removed when their costs become excessive. Advantageously, the search process never generates the full state machine in memory, retaining only a selected set of best states to continue with the approximate match process. The technique thus enables a practicable implementation of approximate searching that can tolerate an arbitrary number of character deviations.

Abstract: Methods and systems for generating a search expression. The system begins with an empty search expression, and iteratively expands the search expression until some terminating condition is reached.

Abstract: Systems and methods are disclosed for an approximate string searching technique to search for match results that have character differences with the search string. A cost is computed to measure the amount of character differences, and a match is recognized if the cost is below a threshold. The match is determined based on an inferred state machine, whose states are iteratively generated in computer memory for successive characters in the input text. States are added to represent modifications to the string needed to account for character differences and track the costs of the modifications. States are removed when their costs become excessive. Advantageously, the search process never generates the full state machine in memory, retaining only a selected set of best states to continue with the approximate match process. The technique thus enables a practicable implementation of approximate searching that can tolerate an arbitrary number of character deviations.

Abstract: Systems and methods are disclosed to implement an outlier detection system for text records. In embodiments, the detection system generates a fingerprint for each incoming record so that similar records map to similar fingerprints. Each record is assigned to a closest cluster in a set of clusters based computed distances between on the record's fingerprint and respective cluster fingerprints of the clusters. The cluster fingerprint is dynamically updated to maintain respective a representative fingerprint of its member records. When a new record is received that is not sufficiently close to any cluster, a new cluster is added to the set for the new record. In embodiments, the creation of the new cluster triggers an alert that the new record is a potential outlier. Advantageously, the disclosed detection system can be used to detect outliers in records in near real time, without the need to pre-specify outlier characteristics.

Abstract: Systems and methods are disclosed to implement an outlier detection system for text records. In embodiments, the detection system generates a fingerprint for each incoming record so that similar records map to similar fingerprints. Each record is assigned to a closest cluster in a set of clusters based computed distances between on the record's fingerprint and respective cluster fingerprints of the clusters. The cluster fingerprint is dynamically updated to maintain respective a representative fingerprint of its member records. When a new record is received that is not sufficiently close to any cluster, a new cluster is added to the set for the new record. In embodiments, the creation of the new cluster triggers an alert that the new record is a potential outlier. Advantageously, the disclosed detection system can be used to detect outliers in records in near real time, without the need to pre-specify outlier characteristics.

Abstract: Methods and systems for generating a search expression. The system begins with an empty search expression, and iteratively expands the search expression until some terminating condition is reached.