Abstract: A method and system for providing an enriched root cause of an incident using machine-generated textual data. The method includes extracting, from a dataset including machine-generated textual data for a monitored environment, a plurality of features related to a root cause of an incident in the monitored environment; generating a suitability score for each of a plurality of insights with respect to the incident based on the extracted features and a suitability model, wherein the suitability model is created based on a training set including a plurality of training inputs and a plurality of training outputs, wherein each training output corresponds to at least one of the plurality of training inputs; and selecting at least one suitable insight based on the generated suitability scores.

Abstract: Devices, systems, and methods of detecting whether an electronic device or computerized device or computer, is communicating with a computerized service or a trusted server directly and without an intermediary web-proxy, or indirectly by utilizing a proxy server or web-proxy. The system searches for particular characteristics or attributes, that characterize a proxy-based communication session or channel and that do not characterize a direct non-proxy-based communication session or channel; or conversely, the system searches for particular characteristics or attributes, that characterize a direct non-proxy-based communication session or channel and that do not characterize a proxy-based communication session or channel; and based on these characteristics, determines whether or not a proxy server exists and operates.

Abstract: Devices, systems, and methods of detecting whether an electronic device or computerized device or computer, is communicating with a computerized service or a trusted server directly and without an intermediary web-proxy, or indirectly by utilizing a proxy server or web-proxy. The system searches for particular characteristics or attributes, that characterize a proxy-based communication session or channel and that do not characterize a direct non-proxy-based communication session or channel; or conversely, the system searches for particular characteristics or attributes, that characterize a direct non-proxy-based communication session or channel and that do not characterize a proxy-based communication session or channel; and based on these characteristics, determines whether or not a proxy server exists and operates.

Abstract: A system and method for predictive ticketing in information technology (IT) systems. The method includes extracting a plurality of features from monitoring data related to an IT system, wherein the plurality of features includes at least one incident parameter, wherein the monitoring data includes machine-generated textual data; applying a machine learning model to the extracted plurality of features, wherein the machine learning model is configured to output a suitable insight for an incident represented by the at least one incident parameter, wherein the suitable insight is selected from among a plurality of historical insights; and generating a predictive ticket based on the suitable insight, wherein the predictive ticket includes a textual description of an expected future symptom in the IT system.

Abstract: Devices, systems, and methods of detecting whether an electronic device or computerized device or computer, is communicating with a computerized service or a trusted server directly and without an intermediary web-proxy, or indirectly by utilizing a proxy server or web-proxy. The system searches for particular characteristics or attributes, that characterize a proxy-based communication session or channel and that do not characterize a direct non-proxy-based communication session or channel; or conversely, the system searches for particular characteristics or attributes, that characterize a direct non-proxy-based communication session or channel and that do not characterize a proxy-based communication session or channel; and based on these characteristics, determines whether or not a proxy server exists and operates.

Abstract: Devices, systems, and methods of detecting whether an electronic device or computerized device or computer, is communicating with a computerized service or a trusted server directly and without an intermediary web-proxy, or indirectly by utilizing a proxy server or web-proxy. The system searches for particular characteristics or attributes, that characterize a proxy-based communication session or channel and that do not characterize a direct non-proxy-based communication session or channel; or conversely, the system searches for particular characteristics or attributes, that characterize a direct non-proxy-based communication session or channel and that do not characterize a proxy-based communication session or channel; and based on these characteristics, determines whether or not a proxy server exists and operates.

Abstract: Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. An end-user device (a desktop computer, a laptop computer, a smartphone, a tablet, or the like) interacts and communicates with a server of a computerized server (a banking website, an electronic commerce website, or the like). The interactions are monitored, tracked and logged. Communication interferences are intentionally introduced to the communication session; and the server tracks the response or the reaction of the end-user device to such communication interferences. The system determines whether the user is a legitimate human user; or a cyber-attacker posing as a legitimate human user but actually utilizing a Virtual Machine.

Abstract: A system and method for classifying machine-generated textual data into statistical metrics are determined. The system comprises receiving machine-generated textual data from at least one data source; grouping the machine-generated textual data into a plurality of events; processing each event to determine a plurality of elements embedded therein; determining a type of each of the plurality of elements; and determining a statistical metric for each element based on at least on the type of the element.

Abstract: A method and system for determining root-causes of incidences using machine-generated textual data. The method comprises receiving machine-generated textual data from at least one data source; classifying the received machine-generated textual data into at least one statistical metric; processing the statistical metric to recognize a plurality of incidence patterns; correlating the plurality of incidence patterns to identify at least a root-cause of an incidence that occurred in a monitored environment; and generating an alert indicating at least the identified root-cause.

Abstract: A method and system for providing an enriched root cause of an incident using machine-generated textual data. The method includes extracting, from a dataset including machine-generated textual data for a monitored environment, a plurality of features related to a root cause of an incident in the monitored environment; generating a suitability score for each of a plurality of insights with respect to the incident based on the extracted features and a suitability model, wherein the suitability model is created based on a training set including a plurality of training inputs and a plurality of training outputs, wherein each training output corresponds to at least one of the plurality of training inputs; and selecting at least one suitable insight based on the generated suitability scores.

Abstract: Systems, devices, and methods for detecting identity of a user of an electronic device, and for determining whether or not an electronic device is being used by a fraudulent user; as well as for detecting identity of a user based on inter-page and intra-page navigation patterns. A method includes: during a first session of a user, who utilizes a pointing device and a keyboard for interacting with a computerized service, monitoring pointing device dynamics and gestures and keystrokes of the user; analyzing the monitored pointing device dynamics and gestures and keystrokes, in relation to (a) state and context of the computerized service, and (b) user interface elements displayed by the computerized service; generating a user-specific biometric trait indicating a user-specific service usage pattern, which includes at least one of: a user-specific inter-application usage pattern, and a user-specific intra-application usage pattern.

Abstract: Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a possible attacker. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.

Abstract: Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a possible attacker. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.

Abstract: Devices, systems, and methods of detecting whether an electronic device or computerized device or computer, is communicating with a computerized service or a trusted server directly and without an intermediary web-proxy, or indirectly by utilizing a proxy server or web-proxy. The system searches for particular characteristics or attributes, that characterize a proxy-based communication session or channel and that do not characterize a direct non-proxy-based communication session or channel; or conversely, the system searches for particular characteristics or attributes, that characterize a direct non-proxy-based communication session or channel and that do not characterize a proxy-based communication session or channel; and based on these characteristics, determines whether or not a proxy server exists and operates.

Abstract: Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. An end-user device (a desktop computer, a laptop computer, a smartphone, a tablet, or the like) interacts and communicates with a server of a computerized server (a banking website, an electronic commerce website, or the like). The interactions are monitored, tracked and logged. Communication interferences are intentionally introduced to the communication session; and the server tracks the response or the reaction of the end-user device to such communication interferences. The system determines whether the user is a legitimate human user; or a cyber-attacker posing as a legitimate human user but actually utilizing a Virtual Machine.

Abstract: Device, system, and method of detecting identity of a user based on motor-control loop model. A method includes: during a first session of a user who utilizes a pointing device for interacting with a computerized service, monitoring the pointing device dynamics and gestures of the user; based on the monitored dynamics and gestures, estimating parameters that characterize a sensorimotor control loop model of the user; storing in a database a record indicating that the user is associated with the parameters that characterize the sensorimotor control loop model of the user.

Abstract: Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a possible attacker. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.

Abstract: Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. An end-user device (a desktop computer, a laptop computer, a smartphone, a tablet, or the like) interacts and communicates with a server of a computerized server (a banking website, an electronic commerce website, or the like). The interactions are monitored, tracked and logged. Communication interferences are intentionally introduced to the communication session; and the server tracks the response or the reaction of the end-user device to such communication interferences. The system determines whether the user is a legitimate human user; or a cyber-attacker posing as a legitimate human user but actually utilizing a Virtual Machine.

Abstract: Device, system, and method of detecting identity of a user based on motor-control loop model. A method includes: during a first session of a user who utilizes a pointing device for interacting with a computerized service, monitoring the pointing device dynamics and gestures of the user; based on the monitored dynamics and gestures, estimating parameters that characterize a sensorimotor control loop model of the user; storing in a database a record indicating that the user is associated with the parameters that characterize the sensorimotor control loop model of the user.

Abstract: Device, system, and method of detecting identity of a user based on motor-control loop model. A method includes: during a first session of a user who utilizes a pointing device for interacting with a computerized service, monitoring the pointing device dynamics and gestures of the user; based on the monitored dynamics and gestures, estimating parameters that characterize a sensorimotor control loop model of the user; storing in a database a record indicating that the user is associated with the parameters that characterize the sensorimotor control loop model of the user.