350 results about "Enterprise networking" patented technology

Disclosed are systems and methods for identifying threat events in an enterprise network and managing detection rules and responses to the events. A threat intelligence computer system can receive information about a detected threat event including a phase of attack and a detected domain of the threat event, apply at least one tag to the detected event that associates the event with at least one of the rules triggered in response to detecting the event, evaluate the tagged rules against the information, flag the event as having an improvement opportunity, determine whether the rule tagged to the event is a candidate for improvement, generate, based on the determination, instructions for improving the rule, generate a prioritization scheme indicating an order to address the instructions to improve the rule amongst instructions to improve various threat detection rules, and generate and return output indicating the prioritization scheme for presentation at user devices.

A method performed by a user equipment to establish a secured connection with an application entity in an enterprise network. The method comprises sending an establishment request to a secure access secure edge (SASE) entity: receiving an establishment response from the application entity if the SASE entity determines to allow the establishment request and authorizes Generic Bootstrapping Architecture / Authenticated Key Management for Application (GBA / AKMA) platform to share a session key with the application entity; and establishing a connection with the application entity based on the session key.

Methods are provided for generating distilled multimedia data sets tailored to user's persona and / or task(s) to be performed associated with an enterprise network and enable interactive contextual learning using a multi-modal knowledge graph. Methods involve obtaining multimedia data from one or more data sources related to operation or configuration of an enterprise network and determining context for generating a distilled multimedia data set based on at least one of user input and user persona. The methods further involve generating, based on the context, the distilled multimedia data set that includes a set of multimedia slices generated from the multimedia data using a multi-modal knowledge graph. The multi-modal knowledge graph is generated using a graph neural network and indicates relationships among a plurality of slices of the multimedia data. The methods further involve providing the distilled multimedia data set for performing one or more actions associated with the enterprise network.

The invention belongs to the technical field of network security, and discloses an encrypted enterprise network data security access method and system, and the method comprises the steps: constructing a biological recognition unit and an equipment binding unit, recognizing multi-dimensional biological data through the biological recognition unit, and carrying out the identity authentication of a user through the combination of a dynamic token generation time binding mechanism; the equipment binding unit associates the identity authentication result with the hardware fingerprint of the security access terminal to generate a digital identity certificate; a basic key is generated and updated in a rolling mode through a quantum random number generator; dual protection is carried out on the multi-dimensional biological data through a hierarchical encryption unit, the hierarchical encryption unit comprises an application layer and a transmission layer, the application layer adopts an SM4 algorithm to encrypt service content data in the multi-dimensional biological data, and the transmission layer adopts an SM2 algorithm to generate a session key to carry out forward secrecy; the security access of enterprise network data is ensured, and the security protection capability of the enterprise network is comprehensively enhanced.

Implementations include receiving graph data representative of a process-aware analytical attack graph (AAG) representing paths within an enterprise network with respect to observed facts of the enterprise network, the process-aware AAG at least partially defining a digital twin of the enterprise network, receiving data indicating at least one non-observed fact of the enterprise network, generating, from the graph data and the received data, an augmented process-aware AAG representing paths within the enterprise network with respect to the observed facts and the at least one non-observed fact, determining, by a process-aware risk assessment module, a risk assessment based on the augmented process-aware AAG, and providing, by a mitigation simulator module, a mitigation list based on the process-aware AAG and the risk assessment, the mitigation list comprising a prioritized list of observed facts of the process-aware AAG.

Provided herein are techniques to facilitate vulnerability management for one or more endpoint devices of a network based on network infrastructure security context. In one example, a computer-implemented method may include determining a base vulnerability score for a particular vulnerability that is detected for an endpoint device of an enterprise network; determining topology information for the endpoint device within the enterprise network; translating the particular vulnerability to triggering information; performing a comparison between the security policies for the one or more network security mechanisms of network security infrastructure and the triggering information to determine whether the endpoint device is protected from the particular vulnerability being triggered for the endpoint device; and generating an updated vulnerability score for the particular vulnerability by adjusting the base vulnerability score based on whether the endpoint device is protected from the particular vulnerability being triggered for the endpoint device.

Various aspects of the disclosure relate to enforcing dynamically updated network security policies in real-time (or upon an identified update) from multiple organizations and anonymously analyze computing system configuration information uploaded from third-party computing systems. An analysis engine monitors compliance information and compare the compliance information against the security rules and / or requirements for one or more enterprise networks. A visualization providing a network map with a visual representation of each product system service system may include communication links between internal applications and / or computing systems and drill-down capability to identify issues as they are occurring or are predicted to occur. The security escrow system may include a mechanism to automatically enable / disable access between third party networks and one or more enterprise computing systems in real-time based on identified compliance information.

The invention discloses a communication method for an enterprise network and remote router equipment of a DCS (Distributed Control System). A communication adaptation module is arranged at an enterprise network end and comprises a protocol conversion unit, a data encryption unit, a flow regulation and control unit and a timestamp embedding unit; the far-end router equipment end is provided with a corresponding reverse communication adaptation module. Two-way interaction of data and control instructions is realized through a two-way communication link, and a dynamic link detection and repair sub-module is configured to guarantee stability of the link. According to the method, the problems of protocol compatibility, data security, flow regulation and control, time management, link maintenance and the like are solved, the communication efficiency and quality are improved, efficient, safe and stable operation of remote communication and control functions of the DCS in industrial production is ensured, and the method has a good application prospect.

The invention discloses an enterprise network weak password evaluation method based on a logic attack graph and password evaluation, which comprises the following steps: firstly, collecting a network topology structure, a security policy and system configuration of an enterprise intranet, and combining ATTamp; according to the inference rule mapped by the CK knowledge base, logical inference is carried out by using a MulVAL tool to obtain a logical attack graph; then acquiring system account password information of each host, calculating password entropy and simulating password blasting time evaluation to obtain a password risk value; then, the password risk value is associated and combined with the logic attack graph, and a new weighted attack graph containing the password risk value is generated; identifying an attack starting point and an attack target point in the attack graph with the weight at the same time; traversing all attack paths in the weighted attack graph by using a depth-first search algorithm, and calculating a weak password risk value on each attack path; and finally, taking the attack path with the highest weak password risk value as an optimal attack path, generating and visualizing, and improving the network security defense level of an enterprise.

An intelligent attack vector analysis and mitigation system incorporates an intelligent process to analyze potential attack vectors from a suspicious attacker. The intelligent attack vector analysis and mitigation system leverages a generative artificial intelligence (AI)-enabled simulation environment to isolate and / or simulate attackers using federated identity and a hypermedia application programming interface (API). The system analyzes actual and / or potential attack vectors by leveraging the generative AI simulation and provides behavioral analysis with a specific focus on federated identity and / or hypermedia API components. As such, the system provides insights into novel attack vectors, vulnerabilities, and effective mitigation strategies that may then be automatically incorporated and / or implemented on the enterprise network by the intelligent attack vector analysis and mitigation system. The process utilizes continuous improvement, adaptation to evolving threats, and a holistic understanding of the system's security posture to improve and enable the enterprise organization's network security system.

The invention discloses a network information security dynamic early warning method and system based on a knowledge graph, and relates to the technical field of network information security. According to the method, network equipment logs, threat intelligence texts and flow metadata are acquired in real time through a multi-source heterogeneous data acquisition module, and a dynamic knowledge graph is constructed by adopting a streaming knowledge extraction technology. And predicting a threat propagation path by using a graph attention network and gating loop unit hybrid model, and generating a hierarchical defense strategy in combination with a three-dimensional risk assessment value. The system comprises a multi-modal data acquisition module, a dynamic knowledge graph construction module, a threat propagation dynamics modeling module, a self-adaptive strategy generation module, a digital twinborn verification module and the like, and the effectiveness of a defense strategy is verified by simulating an attack path. According to the method, dynamic early warning and automatic response of network security are realized, the network protection capability is effectively improved, and the method is suitable for scenes such as enterprise network security protection and cloud service provider security protection.

The invention discloses a method based on ATTamp; the invention discloses a threat detection system of a CK framework. The method comprises the following steps: establishing ATTamp; through the CK attack and defense knowledge base and the threat detection rule, accurate identification and rapid tracing of abnormal behaviors in the enterprise network environment are realized. According to the system, a multi-dimensional data acquisition strategy is adopted to acquire key data in an enterprise network environment, and the system is based on ATTamp; a CK framework constructs a detection rule to perform real-time matching, meanwhile, a statistical analysis technology and a machine learning algorithm are combined to comprehensively identify abnormal behaviors therein, and correlation is realized through source analysis and time sequence analysis, so that an attack link is restored and constructed. The system also supports a visual display and grading alarm mechanism of attack links, and realizes real-time early warning of abnormal behaviors. The method has the technical advantages of being high in detection accuracy, high in traceability efficiency, high in expandability and the like, and provides timely and effective decision support for enterprise safety protection.

Systems, methods, and apparatus are provided for a secure multicloud test automation framework. The automation framework may receive a natural language request for a cloud-based test scenario at a user interface on an enterprise network. The test scenario may include a cloud resource and a cloud platform. Machine learning may map keywords extracted from the test scenario to a set of test cases associated with the cloud resource. Keyword mapping may also identify a configuration file associated with the cloud platform. The automation framework may retrieve shell scripts specified by the set of test cases from a shell script repository. The automation framework may use data from the configuration file to access the cloud platform via a secure gateway and execute the shell scripts using data from the cloud platform. The automation framework may generate a comprehensive summary report and maintain technical logs for the test.

An artificial intelligence assistant analyzes network observations to generate regular expressions using an artificial intelligence model for network automation management pipelines that identify and resolve network issues. A method includes obtaining at least one instruction and information about a plurality of enterprise network assets and configuration of an enterprise network that includes the plurality of enterprise network assets and generating at least one regular expression using an artificial intelligence model based on context description of the at least one instruction and the information about the plurality of enterprise network assets and the configuration of the enterprise network. The method further includes generating at least one solution for configuring at least one network asset of the plurality of enterprise network assets based on the at least one regular expression and providing the at least one solution to cause a configuration change in the at least one network asset.

Methods are provided for a proxy infrastructure that serves as a bridge between an enterprise network and a computing machine of a user ensuring a chain of trust. The methods involve obtaining, from a client device, a request to navigate to one or more target devices of a remote enterprise network and locally authenticating the client device based on at least one of an identity of the client device and user credentials. The methods further involve generating a connection request for the client device to navigate to the one or more target devices based on the client device being locally authenticated and providing the connection request to a proxy service executing in the remote enterprise network. The proxy service authenticates an access to the one or more target devices based on device credentials while hiding the device credentials from the client device.

Implementations include a computer-implemented method for mitigating cyber security risk of an enterprise network, the method comprising: receiving an analytical attack graph (AAG) representing paths within the enterprise network with respect to at least one target asset, the AAG defining a digital twin of the enterprise network and comprising a set of rule nodes, each rule node representing an attack tactic that can be used to move along a path of the AAG; integrating the AAG with a knowledge graph comprising a set of asset nodes, each asset node representing a digital asset that can be affected by one or more of the attack tactics; determining, based on integrating the AAG with the knowledge graph, a plurality of security controls, each security control having an assigned priority value; and selectively implementing the security controls in the enterprise network based on the assigned priority values of the security controls.

A system and method that uses midservers located between an enterprise network and an external network to provide mass scanning network traffic detection and analysis capabilities for the enterprise network. The midserver may be loaded with configurations that allow it to operate as a mass scan event detector capable of detecting network sniffers, botnets, and malicious peer-to-peer connections which can lead to security vulnerabilities. In such configurations, midserver may receive and analyze network traffic to determine if the network traffic is suspicious based on heuristic and signature-based techniques, and then generate an appropriate response action which can be implemented to mitigate the risk.

This disclosure describes systems, devices, and techniques for managing resources in an enterprise network using lifecycle prediction. In an example method, a resource may be identified as operational within an enterprise network. An initial lifecycle of the resource may be estimated based at least partly on one or more characteristics of the resource. At least one trigger condition associated with the resource may be identified as having occurred. In response to identifying that the at least one trigger condition has occurred, an updated lifecycle of the resource may be estimated by applying at least one rule associated with the at least one trigger condition to the initial lifecycle. An expiration time of the resource may be determined based on the updated lifecycle. The resource may be replaced in advance of the expiration date of the resource.

An anomaly detection system uses configuration-related activity profiles, generated in course of threat samples analysis in a secure testing environment, consisting of features of system events and system configurations of endpoints and shared network assets. Backup archives and activity monitors are used to collect system events and system configurations from corporate networks to analyze them with threat pattern databases including configuration-related activity profiles.

Techniques for an email-security detection system to analyze incoming emails for Business Email Comprise (BEC) attacks of targeted new email users in an enterprise based on peer models of email recipients in an enterprise and the conversation history of recipients. A method is disclosed that includes analyzing an incoming email and identifying one or more recipients of the incoming email in an enterprise network; analyzing contextual information in the incoming email for the email intent, and associating the email with a target recipient; applying a relational model associated with peers of the target recipient for detecting whether the incoming email is a business email compromise (BEC) attack directed to the target recipient; applying a relationship model of other recipients of the incoming email for detecting whether the BEC attack is associated with the target recipient; and determining, whether the incoming email is a BEC attack.

An endpoint coupled in a communicating relationship with an enterprise network may include a data recorder configured to store an event stream of data indicating events on the endpoint including types of changes to computing objects, a filter configured to locally process the event stream into a filtered event stream including a subset of types of changes to the computing objects, and a local security agent. The local security agent may be configured to transmit the filtered event stream to a threat management facility, respond to a filter adjustment from the threat management facility by adjusting the filter to modify the subset of types of changes included in the filtered event stream, and respond to a query from the threat management facility by retrieving data stored in the data recorder over a time window before the query and excluded from the filtered event stream.

The invention belongs to the technical field of enterprise information management, and particularly relates to an enterprise information security management system based on big data analysis, which comprises a data acquisition and processing module, a big data analysis module, an enterprise information security evaluation module, a risk defense module and a visual supervision module. The data acquisition and processing module acquires security data from an enterprise network and performs data preprocessing, the big data analysis module analyzes the preprocessed data by using a big data analysis technology to identify potential safety hazards, and the enterprise information security assessment module generates a security assessment report based on a big data analysis result. And the risk defense module takes corresponding defense measures according to the security assessment report to ensure the security of the enterprise information, and ensures the storage security and export security of the enterprise information by carrying out risk monitoring analysis on all storage devices and carrying out export monitoring on the enterprise information, thereby realizing effective supervision on the security of the enterprise information.

A system and method for comprehensive data utilization and tracking comprising an ontological engine which in some embodiments is configured to create and curate various industry-specific ontologies which can be used to provide deeper context to an enterprise's network traffic and data transmission. The system and method further comprise a tagging and tracking engine configured to inspect network packets, apply a first tag associated with an authentication object, apply a second tag associated with an identified ontology, and track the tagged packets as they traverse the enterprise network, generating data utilization tracking information as the packets move through the network. A scoring engine may leverage the data utilization tracking information in combination with user entity and behavior data to compute a risk score associated with data utilization on the enterprise network.

In a threat management platform, a number of endpoints log events in an event data recorder. A local agent filters this data and feeds a filtered data stream to a central threat management facility. The central threat management facility can locally or globally tune filtering by local agents based on the current data stream, and can query local event data recorders for additional information where necessary or helpful in threat detection or forensic analysis. The central threat management facility also stores and deploys a number of security tools such as a web-based user interface supported by machine learning models to identify potential threats requiring human intervention and other models to provide human-readable context for evaluating potential threats.

A method is described that involves a method for application performance in a cross-domain network using multi-controller coordination. The method includes receiving a request at a first controller from an application within an enterprise network, wherein the request seeks to monitor a network path. The first controller identifies one or more additional controllers within the enterprise network capable of monitoring the network path. These additional controllers include a first one within the same domain as the first controller (first domain) and a second one within a different domain (second domain). A token, encompassing authentication details and monitoring requirements linked to the request, is sent to the second additional controller from the first domain. Subsequently, direct communication is established with a resource of the second controller, allowing monitoring of the request and its associated operation.

Techniques are described for monitoring network performance and managing network faults in a computer network. A cloud-based network management system stores path data received from a plurality of network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices for one or more logical paths of a physical interface from the network device over a wide area network (WAN). The network management system determines, based on the path data, one or more WAN link health assessments, wherein the one or more WAN link health assessments include a success or failure state associated with one or more of service provider reachability, physical interface operation, or logical path performance; and in response to determining the at least one failure state, outputs a notification including identification of a root cause of the at least one failure state.

Techniques for leveraging the MASQUE protocol to provide remote clients with full application access to private enterprise resources are described herein. One or more network nodes may be configured to execute a MASQUE proxy service to provide a remote client device with full access to an enterprise / private application resource executing on an application node and hosted in an enterprise / application network, behind the MASQUE proxy service. In some examples, the MASQUE proxy service may execute on a single proxy node hosted at an edge of a cloud network or at an edge of an enterprise network. Additionally, or alternatively, a first instance of the MASQUE proxy service may execute on a first proxy node hosted at an edge of a cloud network (e.g., an ingress proxy node) and a second instance of the MASQUE proxy service may execute on a second proxy node hosted at an edge of the enterprise network.

A user behavior training model is generated, using machine learning, from tracking a plurality of trusted users for interactions with respect to a plurality of monitored phishing e-mails. When a unique phishing attack is detected from an incoming email, a new campaign is initiated. A unique phishing attack email that is modified by the user behavior model is generated for each user. In particular, a first test phishing e-mail for a first user is modified based on interactions tracked for the first user and a second test phishing e-mail for a second user is modified based on interactions tracked for the second user. Based on responses to the plurality of test phishing emails, a plurality of custom training videos is generated. A first training video is modified based on a response from the first user and a second training video is modified based on a response from the second user.

A computer-implemented method for management of an application on an enterprise network which accesses external networks via a web proxy. The method comprises obtaining enriched metadata concerning an application executed on the enterprise network, the enriched metadata including at least source code information and ownership information, identifying application traffic on the enterprise network based on proxy log data, source IP and destination URL, generating an access control list (ACL) based on the enriched metadata and identified application traffic, the ACL including a source address of the application and a list of allowed destination addresses, converting the ACL into a proxy policy that can be processed by a web proxy to permit access by the application to the destination addresses in the ACL, and establishing data communication between the application and an external network based on the proxy policy.

Various aspects of the disclosure relate to enforcing dynamically updated network security policies in real-time (or upon an identified update) from multiple organizations and anonymously analyze computing system configuration information uploaded from third-party computing systems. An analysis engine monitors compliance information and compare the compliance information against the security rules and / or requirements for one or more enterprise networks. A visualization providing a network map with a visual representation of each product system service system may include communication links between internal applications and / or computing systems and drill-down capability to identify issues as they are occurring or are predicted to occur. The security escrow system may include a mechanism to automatically enable / disable access between third party networks and one or more enterprise computing systems in real-time based on identified compliance information.