517 results about "Enterprise networking" patented technology

Provided herein are techniques to facilitate dynamic policy enforcement for cloud-based applications in an enterprise environment. In one example, a method may include obtaining, from a cloud network of a cloud-based application, an authentication request associated with an enterprise user that is seeking to utilize the cloud-based application, wherein the authentication request comprises an application identifier and a vulnerability index associated with the cloud-based application; identifying one or more vulnerabilities of the cloud-based application based on the application identifier and the vulnerability index; determining an access level for which the cloud-based application is allowed to access the enterprise network based, at least in part, on one or more vulnerabilities of the cloud-based application and one or more access rules associated with the cloud-based application; and sending a response to the cloud network indicating the access level for which the cloud-based application is allowed to access the enterprise network.

A system and method for comprehensive data utilization and tracking comprising an ontological engine which in some embodiments is configured to create and curate various industry-specific ontologies which can be used to provide deeper context to an enterprise's network traffic and data transmission. The system and method further comprise a tagging and tracking engine configured to inspect network packets, apply a first tag associated with an authentication object, apply a second tag associated with an identified ontology, and track the tagged packets as they traverse the enterprise network, generating data utilization tracking information as the packets move through the network. A scoring engine may leverage the data utilization tracking information in combination with user entity and behavior data to compute a risk score associated with data utilization on the enterprise network.

Disclosed are systems and methods for identifying threat events in an enterprise network and managing detection rules and responses to the events. A threat intelligence computer system can receive information about a detected threat event including a phase of attack and a detected domain of the threat event, apply at least one tag to the detected event that associates the event with at least one of the rules triggered in response to detecting the event, evaluate the tagged rules against the information, flag the event as having an improvement opportunity, determine whether the rule tagged to the event is a candidate for improvement, generate, based on the determination, instructions for improving the rule, generate a prioritization scheme indicating an order to address the instructions to improve the rule amongst instructions to improve various threat detection rules, and generate and return output indicating the prioritization scheme for presentation at user devices.

Techniques described herein pertain to prioritizing threats based on their potential effect on the specific enterprise network sought to be protected. In one example, this disclosure describes a method that includes collecting, by a computing system and from a plurality of external data sources, threat information; storing, by the computing system and in a threat registry, the threat information that includes information about a plurality of threats; collecting, by the computing system, information about an attack surface for an enterprise network; mapping, by the computing system, the threat information to the attack surface; analyzing, by the computing system and based on the mapping of the threat information to the attack surface, a threat included in the plurality of threats to identify a risk score associated with the threat, wherein the risk score represents an assessment of the vulnerability of the enterprise network to the threat.

The invention discloses a bad traffic monitoring method and system based on an LSTM and a clustering algorithm, belongs to the technical field of network security, and efficiently converges network traffic by using a BPF technology. The method comprises the following steps: accurately identifying fragmented traffic through an LSTM network, and capturing a complex dependency relationship by using a special memory unit structure of the LSTM network; performing session recombination by adopting an FCM clustering algorithm, restoring a complete network session, and quickly identifying malicious traffic through feature matching; and finally, timely treatment measures are taken for the confirmed malicious traffic. According to the method, rapid and accurate detection and identification of bad website traffic fragmentation behaviors are realized, and the technical problem that a traditional method is difficult to deal with is solved; through efficient caching and recombination mechanisms, the efficiency and accuracy of malicious traffic processing are improved; intelligent disposal measures are adopted, and it is ensured that malicious traffic is effectively restrained in time; the overall protection capability of network security is improved, and enterprise network resources and user data security are protected.

Systems and methods for Virtual Private Network (VPN) brokering to enterprise resources include receiving a connection from a Virtual Private Network (VPN) device associated with a third party network; receiving a request from the third party network to access a resource, wherein the resource is in one of a public cloud, a private cloud, and an enterprise network; determining if an entity associated with the request is permitted to access the resource; and responsive to the determining, creating secure tunnels between the third party network and the resource.

Techniques for leveraging the MASQUE protocol to provide remote clients with full application access to private enterprise resources are described herein. One or more network nodes may be configured to execute a MASQUE proxy service to provide a remote client device with full access to an enterprise / private application resource executing on an application node and hosted in an enterprise / application network, behind the MASQUE proxy service. In some examples, the MASQUE proxy service may execute on a single proxy node hosted at an edge of a cloud network or at an edge of an enterprise network. Additionally, or alternatively, a first instance of the MASQUE proxy service may execute on a first proxy node hosted at an edge of a cloud network (e.g., an ingress proxy node) and a second instance of the MASQUE proxy service may execute on a second proxy node hosted at an edge of the enterprise network.

A threat management facility receives data from a variety of sources such as compute instances within an enterprise network, cloud service providers supporting the enterprise network, and third-party data providers such as geolocation services. In order to facilitate prompt notification of potential risks, the threat management facility may incrementally update data for use in threat assessments as the data becomes available from these different sources, and create suitable alerts or notifications whenever the currently accumulated data provides an indication of threat meeting a predetermined threshold.

A method performed by a user equipment to establish a secured connection with an application entity in an enterprise network. The method comprises sending an establishment request to a secure access secure edge (SASE) entity: receiving an establishment response from the application entity if the SASE entity determines to allow the establishment request and authorizes Generic Bootstrapping Architecture / Authenticated Key Management for Application (GBA / AKMA) platform to share a session key with the application entity; and establishing a connection with the application entity based on the session key.

Methods are provided for generating distilled multimedia data sets tailored to user's persona and / or task(s) to be performed associated with an enterprise network and enable interactive contextual learning using a multi-modal knowledge graph. Methods involve obtaining multimedia data from one or more data sources related to operation or configuration of an enterprise network and determining context for generating a distilled multimedia data set based on at least one of user input and user persona. The methods further involve generating, based on the context, the distilled multimedia data set that includes a set of multimedia slices generated from the multimedia data using a multi-modal knowledge graph. The multi-modal knowledge graph is generated using a graph neural network and indicates relationships among a plurality of slices of the multimedia data. The methods further involve providing the distilled multimedia data set for performing one or more actions associated with the enterprise network.

A threat management facility for an enterprise network integrates native threat management capabilities with threat data from a cloud service provider used by the enterprise. By properly authenticating to the cloud service and mapping data feeds from the cloud service to a native threat management environment, the threat management facility can extend threat detection and management capabilities beyond endpoint-centric techniques.

The invention belongs to the technical field of network security, and discloses an encrypted enterprise network data security access method and system, and the method comprises the steps: constructing a biological recognition unit and an equipment binding unit, recognizing multi-dimensional biological data through the biological recognition unit, and carrying out the identity authentication of a user through the combination of a dynamic token generation time binding mechanism; the equipment binding unit associates the identity authentication result with the hardware fingerprint of the security access terminal to generate a digital identity certificate; a basic key is generated and updated in a rolling mode through a quantum random number generator; dual protection is carried out on the multi-dimensional biological data through a hierarchical encryption unit, the hierarchical encryption unit comprises an application layer and a transmission layer, the application layer adopts an SM4 algorithm to encrypt service content data in the multi-dimensional biological data, and the transmission layer adopts an SM2 algorithm to generate a session key to carry out forward secrecy; the security access of enterprise network data is ensured, and the security protection capability of the enterprise network is comprehensively enhanced.

Implementations include receiving graph data representative of a process-aware analytical attack graph (AAG) representing paths within an enterprise network with respect to observed facts of the enterprise network, the process-aware AAG at least partially defining a digital twin of the enterprise network, receiving data indicating at least one non-observed fact of the enterprise network, generating, from the graph data and the received data, an augmented process-aware AAG representing paths within the enterprise network with respect to the observed facts and the at least one non-observed fact, determining, by a process-aware risk assessment module, a risk assessment based on the augmented process-aware AAG, and providing, by a mitigation simulator module, a mitigation list based on the process-aware AAG and the risk assessment, the mitigation list comprising a prioritized list of observed facts of the process-aware AAG.

Provided herein are techniques to facilitate vulnerability management for one or more endpoint devices of a network based on network infrastructure security context. In one example, a computer-implemented method may include determining a base vulnerability score for a particular vulnerability that is detected for an endpoint device of an enterprise network; determining topology information for the endpoint device within the enterprise network; translating the particular vulnerability to triggering information; performing a comparison between the security policies for the one or more network security mechanisms of network security infrastructure and the triggering information to determine whether the endpoint device is protected from the particular vulnerability being triggered for the endpoint device; and generating an updated vulnerability score for the particular vulnerability by adjusting the base vulnerability score based on whether the endpoint device is protected from the particular vulnerability being triggered for the endpoint device.

Various aspects of the disclosure relate to enforcing dynamically updated network security policies in real-time (or upon an identified update) from multiple organizations and anonymously analyze computing system configuration information uploaded from third-party computing systems. An analysis engine monitors compliance information and compare the compliance information against the security rules and / or requirements for one or more enterprise networks. A visualization providing a network map with a visual representation of each product system service system may include communication links between internal applications and / or computing systems and drill-down capability to identify issues as they are occurring or are predicted to occur. The security escrow system may include a mechanism to automatically enable / disable access between third party networks and one or more enterprise computing systems in real-time based on identified compliance information.

The invention discloses a communication method for an enterprise network and remote router equipment of a DCS (Distributed Control System). A communication adaptation module is arranged at an enterprise network end and comprises a protocol conversion unit, a data encryption unit, a flow regulation and control unit and a timestamp embedding unit; the far-end router equipment end is provided with a corresponding reverse communication adaptation module. Two-way interaction of data and control instructions is realized through a two-way communication link, and a dynamic link detection and repair sub-module is configured to guarantee stability of the link. According to the method, the problems of protocol compatibility, data security, flow regulation and control, time management, link maintenance and the like are solved, the communication efficiency and quality are improved, efficient, safe and stable operation of remote communication and control functions of the DCS in industrial production is ensured, and the method has a good application prospect.

The invention discloses an enterprise network weak password evaluation method based on a logic attack graph and password evaluation, which comprises the following steps: firstly, collecting a network topology structure, a security policy and system configuration of an enterprise intranet, and combining ATTamp; according to the inference rule mapped by the CK knowledge base, logical inference is carried out by using a MulVAL tool to obtain a logical attack graph; then acquiring system account password information of each host, calculating password entropy and simulating password blasting time evaluation to obtain a password risk value; then, the password risk value is associated and combined with the logic attack graph, and a new weighted attack graph containing the password risk value is generated; identifying an attack starting point and an attack target point in the attack graph with the weight at the same time; traversing all attack paths in the weighted attack graph by using a depth-first search algorithm, and calculating a weak password risk value on each attack path; and finally, taking the attack path with the highest weak password risk value as an optimal attack path, generating and visualizing, and improving the network security defense level of an enterprise.

An intelligent attack vector analysis and mitigation system incorporates an intelligent process to analyze potential attack vectors from a suspicious attacker. The intelligent attack vector analysis and mitigation system leverages a generative artificial intelligence (AI)-enabled simulation environment to isolate and / or simulate attackers using federated identity and a hypermedia application programming interface (API). The system analyzes actual and / or potential attack vectors by leveraging the generative AI simulation and provides behavioral analysis with a specific focus on federated identity and / or hypermedia API components. As such, the system provides insights into novel attack vectors, vulnerabilities, and effective mitigation strategies that may then be automatically incorporated and / or implemented on the enterprise network by the intelligent attack vector analysis and mitigation system. The process utilizes continuous improvement, adaptation to evolving threats, and a holistic understanding of the system's security posture to improve and enable the enterprise organization's network security system.

The invention discloses a network information security dynamic early warning method and system based on a knowledge graph, and relates to the technical field of network information security. According to the method, network equipment logs, threat intelligence texts and flow metadata are acquired in real time through a multi-source heterogeneous data acquisition module, and a dynamic knowledge graph is constructed by adopting a streaming knowledge extraction technology. And predicting a threat propagation path by using a graph attention network and gating loop unit hybrid model, and generating a hierarchical defense strategy in combination with a three-dimensional risk assessment value. The system comprises a multi-modal data acquisition module, a dynamic knowledge graph construction module, a threat propagation dynamics modeling module, a self-adaptive strategy generation module, a digital twinborn verification module and the like, and the effectiveness of a defense strategy is verified by simulating an attack path. According to the method, dynamic early warning and automatic response of network security are realized, the network protection capability is effectively improved, and the method is suitable for scenes such as enterprise network security protection and cloud service provider security protection.

Implementations are directed to methods, systems, and apparatus for automated prioritization of cyber risk to digital identities. Actions include obtaining graph data defining a knowledge graph including nodes and edges, the nodes representing respective objects of the enterprise network including digital identities and resources, each node being associated with an explicit risk score and properties of the represented object, each edge representing a relation between objects; determining priority scores for the objects, including, for a first object represented by a first node: determining an implicit risk score for the first node; determining a total risk score for the first node; and determining a priority score for the first node based on the total risk score and properties associated with the first node; generating a ranking of the objects according to the priority scores; and providing, for presentation on a display, cyber security risk data indicating the ranking of the objects.

Techniques for policy-based dynamic VPN profile selection using DNS protocol are provided. In some embodiments, a system / process / computer program product for policy-based dynamic VPN profile selection using DNS protocol includes receiving, at a DNS server for an enterprise network, a Domain Name System (DNS) request for a resource from an endpoint client; determining an IP address and an authentication token for the endpoint client to access the resource using a secure tunnel; and sending a DNS response, from the DNS server, including the IP address and the authentication token to the endpoint client.

Provided is a process including: obtaining, with a domain controller of a private computer network, a set of user-authentication credentials comprising a first username and a first password; querying a distributed credential-monitoring application; receiving query results including one or more passwords associated with the first username; determining that at least some of the one or more passwords in the query results match the obtained first password; and in response to the determination, blocking, with the domain controller, access to a first user account on the private computer network associated with the obtained first username and first password.

The invention discloses a method based on ATTamp; the invention discloses a threat detection system of a CK framework. The method comprises the following steps: establishing ATTamp; through the CK attack and defense knowledge base and the threat detection rule, accurate identification and rapid tracing of abnormal behaviors in the enterprise network environment are realized. According to the system, a multi-dimensional data acquisition strategy is adopted to acquire key data in an enterprise network environment, and the system is based on ATTamp; a CK framework constructs a detection rule to perform real-time matching, meanwhile, a statistical analysis technology and a machine learning algorithm are combined to comprehensively identify abnormal behaviors therein, and correlation is realized through source analysis and time sequence analysis, so that an attack link is restored and constructed. The system also supports a visual display and grading alarm mechanism of attack links, and realizes real-time early warning of abnormal behaviors. The method has the technical advantages of being high in detection accuracy, high in traceability efficiency, high in expandability and the like, and provides timely and effective decision support for enterprise safety protection.

Systems, methods, and apparatus are provided for a secure multicloud test automation framework. The automation framework may receive a natural language request for a cloud-based test scenario at a user interface on an enterprise network. The test scenario may include a cloud resource and a cloud platform. Machine learning may map keywords extracted from the test scenario to a set of test cases associated with the cloud resource. Keyword mapping may also identify a configuration file associated with the cloud platform. The automation framework may retrieve shell scripts specified by the set of test cases from a shell script repository. The automation framework may use data from the configuration file to access the cloud platform via a secure gateway and execute the shell scripts using data from the cloud platform. The automation framework may generate a comprehensive summary report and maintain technical logs for the test.

An artificial intelligence assistant analyzes network observations to generate regular expressions using an artificial intelligence model for network automation management pipelines that identify and resolve network issues. A method includes obtaining at least one instruction and information about a plurality of enterprise network assets and configuration of an enterprise network that includes the plurality of enterprise network assets and generating at least one regular expression using an artificial intelligence model based on context description of the at least one instruction and the information about the plurality of enterprise network assets and the configuration of the enterprise network. The method further includes generating at least one solution for configuring at least one network asset of the plurality of enterprise network assets based on the at least one regular expression and providing the at least one solution to cause a configuration change in the at least one network asset.

An enterprise security system is improved by taking remedial actions responsive to detecting attempts at tampering with computing resources. When a tamper detection instrument detects an attempt at tampering, information about the attempt at tampering may be used to identify one or more candidate types of threats and / or candidate threats. One or more remedial actions associated with the threat or type of threat can be identified and applied in ten enterprise network environment.

Methods are provided for a proxy infrastructure that serves as a bridge between an enterprise network and a computing machine of a user ensuring a chain of trust. The methods involve obtaining, from a client device, a request to navigate to one or more target devices of a remote enterprise network and locally authenticating the client device based on at least one of an identity of the client device and user credentials. The methods further involve generating a connection request for the client device to navigate to the one or more target devices based on the client device being locally authenticated and providing the connection request to a proxy service executing in the remote enterprise network. The proxy service authenticates an access to the one or more target devices based on device credentials while hiding the device credentials from the client device.

Implementations include a computer-implemented method for mitigating cyber security risk of an enterprise network, the method comprising: receiving an analytical attack graph (AAG) representing paths within the enterprise network with respect to at least one target asset, the AAG defining a digital twin of the enterprise network and comprising a set of rule nodes, each rule node representing an attack tactic that can be used to move along a path of the AAG; integrating the AAG with a knowledge graph comprising a set of asset nodes, each asset node representing a digital asset that can be affected by one or more of the attack tactics; determining, based on integrating the AAG with the knowledge graph, a plurality of security controls, each security control having an assigned priority value; and selectively implementing the security controls in the enterprise network based on the assigned priority values of the security controls.

The invention relates to the technical field of network security monitoring, in particular to an effective network security event monitoring method and system based on a big data model, and the method comprises the steps: automatically collecting data activity records from a plurality of data sources in an enterprise network; cleaning and formatting the data activity records; leakage characteristics related to the data leakage behaviors are extracted from the data activity records, a data leakage event monitoring model is constructed based on the leakage characteristics, and a data leakage event is monitored in real time; a monitoring threshold value is set according to the historical data leakage condition, and when the monitoring result exceeds the threshold value, an early warning mechanism is triggered; the data leakage event is tracked and traced, and the source of data leakage is searched. Therefore, enterprises can effectively monitor and prevent data leakage events, and sensitive data of the enterprises are protected from being threatened by unauthorized access and leakage.

A computer-implemented method for proactively detecting and remediating anomalous devices includes accessing, via a network, device attributes corresponding to enterprise devices within an enterprise network, providing the device attributes to a supervised machine learning model, and predicting, via the supervised machine learning model, whether each enterprise device is healthy or anomalous, where the enterprise device is predicted to be healthy unless the supervised machine learning model determines that the probability of the enterprise device being anomalous exceeds a specified confidence threshold. The method includes, for each enterprise device that is predicted to be anomalous, perturbing a portion of the corresponding device attributes via an automated counterfactual generator to generate synthetic data representative of counterfactual healthy devices. The method includes generating recommended remedial action(s) that will cause each enterprise device to approximate each counterfactual healthy device and causing surfacing, via a user interface, of the recommended remedial action(s).