知搜-全球专利检索

  1. 登录
  2. 注册

搜索结果

37 条记录 (耗时 0.015 秒)

    Method and mechanism for detection of pass-the-hash attacks
    1.
    发明授权
    Method and mechanism for detection of pass-the-hash attacks 有权

    公开(公告)号：US11916953B2

    公开(公告)日：2024-02-27

    申请号：US16579215

    申请日：2019-09-23

    申请人： Cybereason, Inc.

    发明人： Phillip Tsukerman

    IPC分类号： H04L9/40

    CPC分类号： H04L63/1441

    摘要： A method of generating a baseline of expected behavior on a single machine or endpoint to accurately fingerprint the native behavior of the NTLM protocol on that particular endpoint in a network. By limiting the scope of a baseline to a single endpoint, the scope of the baseline can consist of expected behavior (including supported hash functions, version strings and various feature flags). Deviations from these behaviors are considered evidence of a redundant implementation of NTLM utilized by an attacker and thus as evidence of an attempted PTH attack. Using this method it is possible to accurately detect PTH attacks originating from all publicly known non-standard implementations of NTLM existing in tools such as Impacket, Metasploit, and Invoke-TheHash.

    Generation of Predictive Cybersecurity Data Queries
    2.
    发明公开
    Generation of Predictive Cybersecurity Data Queries 审中-公开

    公开(公告)号：US20230328095A1

    公开(公告)日：2023-10-12

    申请号：US18194087

    申请日：2023-03-31

    申请人： Cybereason Inc.

    发明人： Avi Chesla ,  Elan Pavlov

    IPC分类号： H04L9/40 ,  G06F16/28 ,  G06F16/2453

    CPC分类号： H04L63/1433 ,  H04L63/1416 ,  G06F16/24539 ,  G06F16/285 ,  H04L63/1425

    摘要： A computing system identifies an evidence set associated with a detected cybersecurity attack. The evidence set includes logs representing security alerts associated with the detected cybersecurity attack. The computing system analyzes the evidence set to predict actions taken by a malicious actor, the actions comprising historical actions and future actions. The computing system analyzes the predicted actions to classify the historical actions and future actions taken by the malicious actor. The computing system generates a query for analyzing the evidence set based on the classified historical actions and future actions.

    SYSTEMS AND METHODS FOR DETERMINING MEASUREMENTS OF SIMILARITY BETWEEN VARIOUS TYPES OF DATA
    4.
    发明申请
    SYSTEMS AND METHODS FOR DETERMINING MEASUREMENTS OF SIMILARITY BETWEEN VARIOUS TYPES OF DATA 有权

    公开(公告)号：US20220019664A1

    公开(公告)日：2022-01-20

    申请号：US17405608

    申请日：2021-08-18

    申请人： Cybereason Inc.

    发明人： Yonatan Perry ,  Assaf Ben-David ,  Uri Sternfeld

    IPC分类号： G06F21/56 ,  G06F21/53 ,  G06K9/62

    摘要： Systems and methods are provided to measure the similarity between a first and second data sample. The method can include creating a plurality of k-mers from the first data sample, each k-mer having a first length; generating a first vector from the plurality of k-mers by processing the plurality of k-mers with a plurality of hash functions; calculating a similarity level between the first and second data sample by comparing the first vector to a second vector, the second vector representing the second data sample; and based on the similarity level, determining a maliciousness level of the first data sample.

    Baseline Calculation for Firewalling
    6.
    发明申请
    Baseline Calculation for Firewalling 审中-公开

    公开(公告)号：US20170193222A1

    公开(公告)日：2017-07-06

    申请号：US15386244

    申请日：2016-12-21

    申请人： Cybereason Inc.

    发明人： Yonatan Striem-Amit

    IPC分类号： G06F21/53 ,  H04L29/06 ,  H04L29/08

    CPC分类号： G06F21/53 ,  G06F21/566 ,  H04L63/0263 ,  H04L63/145

    摘要： A method, computer program product, and apparatus for performing baseline calculations for firewalling in a computer network is disclosed. The method involves defining a reference group for an executed software program, measuring signals in the reference group, measuring signals of the program, computing a distance between the signals of the program and the signals of the reference group, and taking an action if the computed distance deviates from a norm mode. The distance can be computed using a similarity matrix or other method. Measuring the program comprises observing behaviors of the program, collecting and analyzing data, comparing the data to baselines of the reference group, and comparing the behaviors of the program across a previous execution of the program. In cases where a program is known to be malicious, a reference group is not needed and a sandbox can be tailored just by copying the environment of the actual system.

    SYSTEMS AND METHODS FOR IDENTITY MANAGEMENT
    7.
    发明公开
    SYSTEMS AND METHODS FOR IDENTITY MANAGEMENT 审中-公开

    公开(公告)号：US20230319088A1

    公开(公告)日：2023-10-05

    申请号：US18194181

    申请日：2023-03-31

    申请人： Cybereason Inc.

    发明人： Avi Chesla ,  Sivan Omer

    IPC分类号： H04L9/40

    CPC分类号： H04L63/1425 ,  H04L63/1416 ,  H04L63/1433

    摘要： Disclosed is a computer-implemented method for correlating user information can include receiving, from a user device, a login log associated with a user; receiving an intrusion detection system (IDS) log; receiving a domain name system (DNS) log; receiving, from a computing device, a log; enriching at least one of the login log, the IDS log, or the DNS log; and correlating an identity with one or more of the login log, the IDS log, and the DNS log. In some embodiments, correlating the identity with one or more of the login log, the IDS log, and the DNS log can include generating a graph representation and saving the graph representation as a sparse graph representation.

    SYSTEMS AND METHODS FOR DETERMINING MEASUREMENTS OF SIMILARITY BETWEEN VARIOUS TYPES OF DATA
    9.
    发明申请
    SYSTEMS AND METHODS FOR DETERMINING MEASUREMENTS OF SIMILARITY BETWEEN VARIOUS TYPES OF DATA 有权

    公开(公告)号：US20220019665A1

    公开(公告)日：2022-01-20

    申请号：US17443077

    申请日：2021-07-20

    申请人： Cybereason Inc.

    发明人： Yonatan Perry ,  Assaf Ben-David ,  Uri Sternfeld

    IPC分类号： G06F21/56 ,  G06F21/53 ,  G06K9/62

    摘要： Systems and methods are provided to measure the similarity between a first and second data sample. The method can include creating a plurality of k-mers from the first data sample, each k-mer having a first length; generating a first vector from the plurality of k-mers by processing the plurality of k-mers with a plurality of hash functions; calculating a similarity level between the first and second data sample by comparing the first vector to a second vector, the second vector representing the second data sample; and based on the similarity level, determining a maliciousness level of the first data sample.

    Method and Mechanism for Detection of Pass-the-Hash Attacks
    10.
    发明申请
    Method and Mechanism for Detection of Pass-the-Hash Attacks 审中-公开

    公开(公告)号：US20200099715A1

    公开(公告)日：2020-03-26

    申请号：US16579215

    申请日：2019-09-23

    申请人： Cybereason, Inc.

    发明人： Phillip Tsukerman

    IPC分类号： H04L29/06

    摘要： A method of generating a baseline of expected behavior on a single machine or endpoint to accurately fingerprint the native behavior of the NTLM protocol on that particular endpoint in a network. By limiting the scope of a baseline to a single endpoint, the scope of the baseline can consist of expected behavior (including supported hash functions, version strings and various feature flags). Deviations from these behaviors are considered evidence of a redundant implementation of NTLM utilized by an attacker and thus as evidence of an attempted PTH attack. Using this method it is possible to accurately detect PTH attacks originating from all publicly known non-standard implementations of NTLM existing in tools such as Impacket, Metasploit, and Invoke-TheHash.