Abstract: A system to generate an image classifier and test it nearly instantaneously is described herein. Image embeddings generated by an image fingerprinting model are indexed and an associated approximate nearest neighbors (ANN) model is generated. The embeddings in the index are clustered and the clusters are labeled. Users can provide just a few images to add to the index as a labeled cluster. The ANN model is trained to receive an image embedding as input and return a score and label of the most similar identified embedding. The label may be applied if the score exceeds a threshold value. The image classifier can be tested efficiently using Leave One Out Cross Validation (“LOOCV”) to provide near-instantaneous quality indications of the image classifier to the user. Near-instantaneous indications of outliers in the provided images can also be provided to the user using a distance to the centroid calculation.

Abstract: Image fingerprints (embeddings) are generated by an image fingerprinting model and indexed with an approximate nearest neighbors (ANN) model trained to identify the most similar fingerprint based on a subject embedding. For image matching, a score is provided that indicates a similarity between the input embedding and the most similar identified embedding, which allows for matching even when an image has been distorted, rotated, cropped, or otherwise modified. For image classification, the embeddings in the index are clustered and the clusters are labeled. Users can provide just a few images to add to the index as a labeled cluster. The ANN model returns a score and label of the most similar identified embedding for labeling the subject image if the score exceeds a threshold. As improvements are made to the image fingerprinting model, a converter model is trained to convert the original embeddings to be compatible with the new embeddings.

Abstract: Image fingerprints (embeddings) are generated by an image fingerprinting model and indexed with an approximate nearest neighbors (ANN) model trained to identify the most similar fingerprint based on a subject embedding. For image matching, a score is provided that indicates a similarity between the input embedding and the most similar identified embedding, which allows for matching even when an image has been distorted, rotated, cropped, or otherwise modified. For image classification, the embeddings in the index are clustered and the clusters are labeled. Users can provide just a few images to add to the index as a labeled cluster. The ANN model returns a score and label of the most similar identified embedding for labeling the subject image if the score exceeds a threshold. As improvements are made to the image fingerprinting model, a converter model is trained to convert the original embeddings to be compatible with the new embeddings.

Abstract: Image fingerprints (embeddings) are generated by an image fingerprinting model and indexed with an approximate nearest neighbors (ANN) model trained to identify the most similar fingerprint based on a subject embedding. For image matching, a score is provided that indicates a similarity between the input embedding and the most similar identified embedding, which allows for matching even when an image has been distorted, rotated, cropped, or otherwise modified. For image classification, the embeddings in the index are clustered and the clusters are labeled. Users can provide just a few images to add to the index as a labeled cluster. The ANN model returns a score and label of the most similar identified embedding for labeling the subject image if the score exceeds a threshold. As improvements are made to the image fingerprinting model, a converter model is trained to convert the original embeddings to be compatible with the new embeddings.

Abstract: Disclosed is phishing classifier that classifies a URL and content page accessed via the URL as phishing or not is disclosed, with URL feature hasher that parses and hashes the URL to produce feature hashes, and headless browser to access and internally render a content page at the URL, extract HTML tokens, and capture an image of the rendering. Also disclosed are an HTML encoder, trained on HTML tokens extracted from pages at URLs, encoded, then decoded to reproduce images captured from rendering, that produces an HTML encoding of the tokens extracted, and an image embedder, pretrained on images, that produces an image embedding of the image captured. Further, phishing classifier layers, trained on the feature hashes, the HTML encoding, and the image embedding, process the URL feature hashes, HTML encoding and image embeddings to produce a likelihood score that the URL and the page accessed presents a phishing risk.

Abstract: The disclosed technology facilitates User and Entity Behavior Analytics (UEBA) by classifying a file being transferred as encrypted or not. The technology involves monitoring movement of a files by a user over a wide area network, detecting file encryption for the files using a trained classifier, wherein the detecting includes processing by the classifier some or all of the following features extracted from each of the files: a chi-square randomness test; an arithmetic mean test; a serial correlation coefficient test; a Monte Carlo-Pi test; and a Shannon entropy test, counting a number of the encrypted files moved by the user in a predetermined period, comparing a predetermined maximum number of encrypted files allowed in the predetermined period to the count of the encrypted files moved by the user and detecting that the user has moved more encrypted files than the predetermined maximum number, and generating an alert.

Abstract: Image fingerprints (embeddings) are generated by an image fingerprinting model and indexed with an approximate nearest neighbors (ANN) model trained to identify the most similar fingerprint based on a subject embedding. For image matching, a score is provided that indicates a similarity between the input embedding and the most similar identified embedding, which allows for matching even when an image has been distorted, rotated, cropped, or otherwise modified. For image classification, the embeddings in the index are clustered and the clusters are labeled. Users can provide just a few images to add to the index as a labeled cluster. The ANN model returns a score and label of the most similar identified embedding for labeling the subject image if the score exceeds a threshold. As improvements are made to the image fingerprinting model, a converter model is trained to convert the original embeddings to be compatible with the new embeddings.

Abstract: The disclosed technology teaches facilitate User and Entity Behavior Analytics (UEBA) by classifying a file being transferred as encrypted or not. The technology involves monitoring movement of a files by a user over a wide area network, detecting file encryption for the files using a trained classifier, wherein the detecting includes processing by the classifier some or all of the following features extracted from each of the files: a chi-square randomness test; an arithmetic mean test; a serial correlation coefficient test; a Monte Carlo-Pi test; and a Shannon entropy test, counting a number of the encrypted files moved by the user in a predetermined period, comparing a predetermined maximum number of encrypted files allowed in the predetermined period to the count of the encrypted files moved by the user and detecting that the user has moved more encrypted files than the predetermined maximum number, and generating an alert.

Abstract: The disclosed technology teaches facilitate User and Entity Behavior Analytics (UEBA) by classifying a file being transferred as encrypted or not. The technology involves monitoring movement of a files by a user over a wide area network, detecting file encryption for the files using a trained classifier, wherein the detecting includes processing by the classifier some or all of the following features extracted from each of the files: a chi-square randomness test; an arithmetic mean test; a serial correlation coefficient test; a Monte Carlo-Pi test; and a Shannon entropy test, counting a number of the encrypted files moved by the user in a predetermined period, comparing a predetermined maximum number of encrypted files allowed in the predetermined period to the count of the encrypted files moved by the user and detecting that the user has moved more encrypted files than the predetermined maximum number, and generating an alert.

Abstract: The disclosed technology teaches training a classifier that classifies a file being transferred as encrypted or not. The technology involves accessing a plurality of training sample files, each of which is accompanied by a label of encrypted or not encrypted, sampling a configurable number of bytes of each respective file, generating features from the sampled bytes, including generating at least three of the following features: a chi-square randomness test; an arithmetic mean test; a serial correlation coefficient test; a Monte Carlo-Pi test; a Shannon entropy test; applying the generated features to train coefficients of a classifier algorithm to classify the sample files as encrypted or not encrypted; and saving the trained coefficients and classifier, whereby the classifier is trained to classify the sample files as encrypted or not encrypted.

Abstract: Disclosed is a method of building a customized deep learning (DL) stack classifier to detect organization sensitive data in images, referred to as image-borne organization sensitive documents, and protecting against loss of the image-borne organization sensitive documents, including distributing a trained feature map extractor stack, with stored parameters, configured to allow the organization to extract from image-borne organization sensitive documents, feature maps that are used to generate updated DL stacks and to save non invertible feature maps derived from the images, and ground truth labels for the image. Also included is receiving organization-specific examples including the non-invertible feature maps extracted from the organization-sensitive documents and the ground truth labels and using the received organization-specific examples to update a customer-specific DL stack classifier. Further included is sending the customer-specific DL stack classifier to the organization.

Abstract: Disclosed is phishing classifier that classifies a URL and content page accessed via the URL as phishing or not is disclosed, with URL feature hasher that parses and hashes the URL to produce feature hashes, and headless browser to access and internally render a content page at the URL, extract HTML tokens, and capture an image of the rendering. Also disclosed are an HTML encoder, trained on HTML tokens extracted from pages at URLs, encoded, then decoded to reproduce images captured from rendering, that produces an HTML encoding of the tokens extracted, and an image embedder, pretrained on images, that produces an image embedding of the image captured. Further, phishing classifier layers, trained on the feature hashes, the HTML encoding, and the image embedding, process the URL feature hashes, HTML encoding and image embeddings to produce a likelihood score that the URL and the page accessed presents a phishing risk.

Abstract: The disclosed technology teaches a method for evaluating user compliance with an organization's security policies, formulating a user confidence or risk score, comprising scoring for each user a sum of alert weights, categorized by severity, and generated over time. Each contribution to an alert weight is generated due to an activity by the user that the organization's security policies treat as risky. Alert weights, over time, are subject to a decay factor that attenuates the alert weights as time passes. Also disclosed is reporting the user confidence score, comprising causing display of a time series of the user confidence or risk scores over a predetermined time and/or a current user confidence or risk score and/or at least some details of the activity by the user that contributed to the alert weights over time.

Abstract: The disclosed technology teaches a method of calibrating a user confidence or risk score that expresses evaluation of user behavior that was not compliant with an organization's security policies, including configuring components of the user confidence or risk score, comprising configuring categorical alert weights, categorized by severity, responsive to administrator controls, for alerts to be generated due to an activity by the user that the organization's security policies treat as risky, and configuring a decay factor that attenuates the alert weights as time passes, responsive to an administrator sensitivity control. The disclosed method includes causing display of resulting user behavior evaluation examples, based on activity examples for user examples, comprising causing display of a time series of the user confidence or risk scores for the activity examples for the user examples, and a resulting user confidence or risk score for the user examples.

Abstract: Disclosed is a method of building a customized deep learning (DL) stack classifier to detect organization sensitive data in images, referred to as image-borne organization sensitive documents, and protecting against loss of the image-borne organization sensitive documents, including distributing a trained feature map extractor stack with stored parameters to an organization, under the organization's control, configured to allow the organization to extract from image-borne organization sensitive documents, feature maps that are used to generate updated DL stacks, without the organization forwarding images of organization-sensitive training examples, and to save non invertible feature maps derived from the images, and ground truth labels for the image.

Abstract: The disclosed technology teaches a method of reducing false detection of anomalous user behavior on a computer network, including forming groups from identity and access management (IAM) properties and assigning the users into initially assigned groups based on respective IAM properties, and recording individual user behavior in a statistical profile, including application usage frequency. The method also includes dynamically assigning a user with a realigned group, different from the initial assigned group, based on comparing the recorded user behavior, with user behavior in statistical profiles of the users in the groups, evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group. The method utilizes common app usage for forming the groups, in some cases.

Abstract: Disclosed is classifying a URL and a page accessed via the URL as phishing or not. URL embedder extracts characters in a predetermined set from the URL to produce a character string trained using ground truth classification of the URL, producing a URL embedding. HTML parser accesses content at the URL and extracts HTML tokens from the page. Further, HTML encoder, trained on HTML tokens extracted from pages at example URLs, each example URL accompanied by a ground truth image captured from the page accessed via the example URL, produces an HTML encoding of the extracted tokens. Also, phishing classifier layers, trained on the URL embedding and the HTML encoding of example URLs, processes a concatenated input of the URL embedding and the HTML encoding to produce a score of a phishing risk.

Abstract: Disclosed is classifying a URL and a content page accessed via the URL as phishing or not. URL embedder extracts characters in a predetermined set from the URL to produce a character string trained using ground truth classification of the URL, producing a URL embedding. HTML parser accesses content at the URL and extracts HTML tokens from the content page. Further, HTML encoder, trained on HTML tokens extracted from content pages at example URLs, each example URL accompanied by a ground truth image captured from the content page accessed via the example URL, produces an HTML encoding of the tokens extracted from the page. Also, phishing classifier layers, trained on the URL embedding and the HTML encoding of example URLs, processes a concatenated input of the URL embedding and the HTML encoding to produce a likelihood score that the URL and content accessed via the URL presents a phishing risk.

Abstract: Disclosed is phishing classifier that classifies a URL and content page accessed via the URL as phishing or not is disclosed, with URL feature hasher that parses and hashes the URL to produce feature hashes, and headless browser to access and internally render a content page at the URL, extract HTML tokens, and capture an image of the rendering. Also disclosed are an HTML encoder, trained on HTML tokens extracted from pages at URLs, encoded, then decoded to reproduce images captured from rendering, that produces an HTML encoding of the tokens extracted, and an image embedder, pretrained on images, that produces an image embedding of the image captured. Further, phishing classifier layers, trained on the feature hashes, the HTML encoding, and the image embedding, process the URL feature hashes, HTML encoding and image embeddings to produce a likelihood score that the URL and the page accessed presents a phishing risk.

Abstract: The disclosed technology teaches a method for evaluating user compliance with an organization's security policies, formulating a user confidence or risk score, comprising scoring for each user a sum of alert weights, categorized by severity, and generated over time. Each contribution to an alert weight is generated due to an activity by the user that the organization's security policies treat as risky. Alert weights, over time, are subject to a decay factor that attenuates the alert weights as time passes. Also disclosed is reporting the user confidence score, comprising causing display of a time series of the user confidence or risk scores over a predetermined time and/or a current user confidence or risk score and/or at least some details of the activity by the user that contributed to the alert weights over time.