77 results about "Threat mitigation" patented technology

A computer-implemented method, computer program product and computing system for receiving a message concerning an event within a computer platform, wherein the message concerns a technology type and includes raw data; defining a cipher for the technology type, thus defining an associated cipher; processing the raw data included within the message using the associated cipher to define supplemental data for the technology type; and forming enriched data for the technology type based, at least in part, upon the raw data and the supplemental data.

A computer-implemented method, computer program product and computing system for defining a formatting script for use with a Generative AI Model; receiving a plurality of notifications of a security event, wherein each of the plurality of notifications includes a computer-readable language portion that defines one or more specifics of the security event, thus defining a plurality of computer-readable language portions; processing at least a portion of each of the plurality of computer-readable language portions using the Generative AI Model and the formatting script to summarize each of the computer-readable language portions and generate a plurality of event summaries; and′ processing at least a portion of each of the plurality of event summaries using the Generative AI Model and the formatting script to summarize the plurality of event summaries and generate a summarized human-readable report.

Devices and techniques are generally described for security threat mitigation for generative machine learning models. In some examples, first request data including a first request may be received. First prompt data may be generated based at least in part on the first request data. First plan data may be generated, the first plan data including a first API call to a first API of a first computer-implemented service. The first API call may be executed and first result data may be received in response to the first API call. A determination may be made that the first result data includes a first impermissible instruction to inject data into a subsequent prompt. First output data may be generated indicating that the first request cannot be completed.

Computer-implemented system for real-time validation and threat mitigation for structured health transactions, including: a client policy repository that contains client-specific validation rules, consent restrictions, and risk thresholds; a trusted policy execution enclave that only allows policies and models after remote attestation of code and configuration, and decrypts and processes protected fields exclusively within the enclave; a grammatically aware streaming validator that enforces format and semantic constraints and synthesizes an auto-repair suggestion in case of parser errors, transforming inputs into a policy-compliant form with minimal changes; a hybrid risk engine that calculates rule-based and learned risk scores and furthermore evaluates a subset of features using data protection-preserving calculations to determine risk contributions without decoding selected fields; a causal graph generator that correlates related transactions over time into an entity-resolved, time-aligned graph and identifies impossibility patterns with edge-wise responsibility values; a coordinator for federated learning who updates models from client-local aggregates under differential privacy budgets and suspends aggregation when a distribution drift above a policy threshold is detected; an audit subsystem that generates zero-knowledge evidence demonstrating that selected compliance predicates for a transaction have been met without disclosing protected health information; a risk-adaptive flow control system that directs high-risk substreams into micro-quarantine sections with enhanced testing while maintaining the basic service quality for low-risk substreams; and a register that stores a validity context mark which links each decision to the identity of the policies, models, scope of consent and runtime environment used.

In one implementation, a device identifies a first subject indicated by a prompt to a large language model. The device identifies a second subject indicated by the prompt to the large language model. The device determines whether the first subject and the second subject are mutually opposed subjects. The device prevents the large language model from processing the prompt when the first subject and the second subject are mutually opposed subjects.

A system, method, and computer-program product includes detecting an electronic communication transmitted to a message storage repository monitored by a threat detection and response service, retrieving unstructured message data of the electronic communication in response to detecting the transmission of the electronic communication to the message storage repository, transforming the unstructured message data of the electronic communication into a structured message data object interpretable by the threat detection and response service, assessing the structured message data object that corresponds to the electronic communication against a set of subscriber-agnostic threat detection instructions provided by the threat detection and response service and a set of subscriber-composable enrichments that include subscriber-composed threat detection instructions, automatically detecting the electronic communication as malicious based on the assessment, and executing a threat mitigation action that mitigates a security threat associated with the electronic communication.

A method of mitigating the theft of a portable electronic device communicatively connected to a second portable electronic device via a communications subsystem comprising a short range wireless network. Upon detecting that predetermined theft mitigation criteria have been met activating threat mitigation measures including at least locking the screen of the potentially stolen device and prompting the potentially stolen device to emit an alarm tone to alert bystanders.

A computer-implemented method, computer program product and computing system for accessing interface rules for a remote resource; generating a connector interface based, at least in part, upon the interface rules; and accessing the remote resource via the connector interface

A computer-implemented method, computer program product and computing system for receiving a result set; providing the result set to a first prompt / generative AI model pair to generate a first output; providing the result set to at least a second prompt / generative AI model pair to generate at least a second output; and providing the first output and the at least a second output to a large language model to define a superior output chosen from the first output and the at least a second output.

A computer-implemented method, computer program product and computing system for defining a target result set size; executing an initial search on a data set to generate an initial result set; comparing the size of the initial result set to the target result set size; if the size of the initial result set is compatible with the target result set size, providing the initial result set to a requesting entity; and if the size of the initial result set is not compatible with the target result set size, revising the initial search to generate a revised search that is executed on the data set to generate a revised result set.

The present disclosure provides methods, systems and computer readable media for training and implementing a generative machine learning model for identifying security threats. Examples relate to training, in which a training image is provided to a generative model in a training prompt, with an Indicator of Compromise (loC) instruction pertaining to the image. The model generates a predicted loC and a model parameter is updated based on a loss function. Other examples relate to the use of trained generative models for cybersecurity. A mitigation prompt comprising a security image and an associated instruction is provided to a trained generative model. The model outputs an indication of a cybersecurity mitigation action based on the mitigation prompt, and the cybersecurity mitigation action is performed on the system. Certain example embodiments identify and automatically mitigate security issues using a multimodal generative model (MGM) though appropriate prompt engineering.

The present disclosure relates to methods, systems, and computer program products for generating an asset remediation trend map used in remediating against an attack campaign. The method comprises receiving attack kill chain data. The attack kill chain data comprises steps for executing an attack campaign on one or more assets associated with a computing device. The method further comprises parsing the attack kill chain data to determine one or more attack execution operations for executing the attack campaign on the one or more assets associated with the computing device. The method determines based on the parsing, one or more remediation operations corresponding to the one or more attack execution operations. In addition, the method sequences the one or more remediation operations to form an asset remediation trend map. In one implementation, the asset remediation trend map indicates steps for remediating the attack campaign.

A computer-implemented method, computer program product and computing system for receiving a plurality of detection events concerning a plurality of security events occurring on a security-relevant subsystem within a computing platform; identifying two or more associated detection events included within the plurality of detection events; and grouping the two or more associated detection events to define a security incident.

The present disclosure provides methods, systems and computer readable media for training and implementing a generative machine learning model for identifying security threats. Examples relate to training, in which a training image is provided to a generative model in a training prompt, with an Indicator of Compromise (loC) instruction pertaining to the image. The model generates a predicted loC and a model parameter is updated based on a loss function. Other examples relate to the use of trained generative models for cybersecurity. A mitigation prompt comprising a security image and an associated instruction is provided to a trained generative model. The model outputs an indication of a cybersecurity mitigation action based on the mitigation prompt, and the cybersecurity mitigation action is performed on the system. Certain example embodiments identify and automatically mitigate security issues using a multimodal generative model (MGM) though appropriate prompt engineering.

Examples of the present disclosure are directed to systems and methods for using router identifier information to mitigate denial of service attacks in an autonomous system (AS). Each router of the AS may be assigned a router identifier (ID) that is unique to the AS and may be periodically changed. The ingress router first receiving the packet within a particular AS may insert its router ID into the packet. A threat intelligence system may sample packets of traffic received by the AS and examine the inserted ingress router IDs in making a threat determination. If a distribution of detected ingress router IDs from sampled packets does not match an expected distribution of ingress router IDs, one or more threat mitigation actions may be invoked.

Systems and methods for mitigating DNS amplification attacks are provided. In one example, a threat intelligence system collects data about the requests received by a DNS server, and / or responses generated by the DNS server. The threat intelligence system triggers a threat mitigation action upon detecting evidence (in one or more forms) of a DNS amplification attack. The threat mitigation action may include filtering DNS responses generated by the DNS server. The filtering rule may indicate that a DNS response in which the payload size is above a threshold payload size is to be dropped. In examples, the payload threshold size is dynamically set by the threat intelligence system using a machine learning model to minimize the filtering of DNS responses for valid DNS queries, while maximizing filtering of DNS responses for malicious DNS queries.

Various techniques for providing a DNS Early Threat Executive Response System (DETERS) are disclosed. In some embodiments, DETERS is a comprehensive DNS threat detection, response, and reporting system with a modular analytics architecture that allows for early detection of suspicious activity in near real-time. DETERS can identify threats before they are able to spread or compromise systems. DETERS uses a combination of streaming and batch processing, as well as historical DNS information. The DNS-centric design allows a DNS resolver to quickly mitigate threats and for the reporting system to alert users allowing them to take further actions that are reflected in the DNS resolver response policy.

A computer-implemented method, computer program product and computing system for receiving a result set; providing the result set to a first prompt / generative AI model pair to generate a first output; providing the result set to at least a second prompt / generative AI model pair to generate at least a second output; and providing the first output and the at least a second output to a large language model to define a superior output chosen from the first output and the at least a second output.

Disclosed herein are methods and systems for improving endpoint device security. An agent deployed to the endpoint device may inject monitoring code into a program during runtime of the program. The monitoring code instructs the program to generate runtime telemetry data. The agent may detect behavior indicative of a security risk based on the runtime telemetry data. The agent may automatically perform at least one remedial action of a plurality of remedial actions, wherein the plurality of remedial actions comprises: notifying a user of the endpoint device of the behavior indicative of the security risk, terminating the program, blocking one or more functions of the program, and reporting the behavior indicative of the security risk to a server system.

Various technologies for providing a DNS Early Threat Executive Response System (DETERS) are disclosed. In some embodiments, DETERS is a comprehensive DNS threat detection, response, and reporting system with a modular analytical architecture that enables near real-time early detection of suspicious activity. DETERS can identify threats before they can spread to the system or gain unauthorized access to it. DETERS utilizes a combination of streaming and batch processing along with historical DNS information. The DNS-centric design allows DNS resolvers to quickly mitigate threats and reporting systems to alert users, enabling users to take further action reflected in DNS resolver policies.

A computer-implemented method, computer program product and computing system for defining a target result set size; executing an initial search on a data set to generate an initial result set; comparing the size of the initial result set to the target result set size; if the size of the initial result set is compatible with the target result set size, providing the initial result set to a requesting entity; and if the size of the initial result set is not compatible with the target result set size, revising the initial search to generate a revised search that is executed on the data set to generate a revised result set

A method for controlling a vehicle is disclosed. The method comprises determining whether one or more surrounding vehicles exhibit a threatening behavior, and controlling the vehicle to perform one or more threat-avoidance actions when it is determined that one or more surrounding vehicles exhibit a threatening behavior. Example threatening behaviors include a first surrounding vehicle directly in front of the vehicle decelerating without a traffic-related reason for deceleration, and, in combination with the former, a second surrounding vehicle in a lane adjacent to the vehicle decelerating in association with the first surrounding vehicle. Corresponding computer programs, computer program products, control units, devices, systems, and vehicles are also disclosed.

A system, method, and computer-program product includes detecting an electronic communication transmitted to a message storage repository monitored by a threat detection and response service, retrieving unstructured message data of the electronic communication in response to detecting the transmission of the electronic communication to the message storage repository, transforming the unstructured message data of the electronic communication into a structured message data object interpretable by the threat detection and response service, assessing the structured message data object that corresponds to the electronic communication against a set of subscriber-agnostic threat detection instructions provided by the threat detection and response service and a set of subscriber-composable enrichments that include subscriber-composed threat detection instructions, automatically detecting the electronic communication as malicious based on the assessment, and executing a threat mitigation action that mitigates a security threat associated with the electronic communication.

The present disclosure provides methods, systems and computer readable media for training and implementing a generative machine learning model for identifying security threats. Examples relate to training, in which a training image is provided to a generative model in a training prompt, with an Indicator of Compromise (loC) instruction pertaining to the image. The model generates a predicted loC and a model parameter is updated based on a loss function. Other examples relate to the use of trained generative models for cybersecurity. A mitigation prompt comprising a security image and an associated instruction is provided to a trained generative model. The model outputs an indication of a cybersecurity mitigation action based on the mitigation prompt, and the cybersecurity mitigation action is performed on the system. Certain example embodiments identify and automatically mitigate security issues using a multimodal generative model (MGM) though appropriate prompt engineering.

Systems and methods that create, use, enhance, maintain, and otherwise optimize a threat model—generally used for risk evaluation and threat mitigation—comprising artificial intelligence inherent in an entity is described. Certain embodiments describe, in countering a threat event, a need for an artificial intelligence entity to cooperate with non-expert users to give the users abilities to act on the domain in the users' self-interest. In countering a threat event, certain other embodiments describe that no single actor, in a heterogeneous collection of actors with varying abilities, may act in isolation to efficiently and effectively counter the threat to the collection; a minimum inevitable loss for the threat event may be achieved by an active cooperation of the heterogeneous actors of type comprising at least one of: expert users, non-expert users, and artificial intelligence entities that are sufficiently trained and knowledgeable on the threat event.

A computer-implemented method, computer program product and computing system for: establishing connectivity with a plurality of security-relevant subsystems within a computing platform; defining a plurality of subsystem-specific queries on a unified platform concerning the plurality of security-relevant subsystems, wherein one or more of the plurality of subsystem-specific queries has a defined execution schedule; and providing the plurality of subsystem-specific queries to the plurality of security-relevant subsystems.

Systematically verifying the identities of entities in control of Internet Protocol (IP) addresses and determining a security threat status for each of the entities based at least on the verified identity. As incoming data packets are received from an originating IP address, the entity in control of the originating IP address and their corresponding security threat status are identified and data packets are dispositioned i.e., blocked / dropped, sequestered or authorized for further transmission, based on the security threat status of the entity in control of the IP address.

Processes and systems for identifying and mitigating threats to critical assets leverage interactive 3D modeling systems, such as gaming engines, to generate customized interactive 3D critical asset site models that provide interactive visual displays of multiple potential threats, multiple potential mitigation measures, and the effectiveness of the each of the potential threat mitigation features with respect to protecting existing and future critical assets and / or critical asset sites.

A computer-implemented method, computer program product and computing system for identifying an event that concerns a network entity on a computer platform; obtaining entity data for the network entity from a plurality of data sources, thus defining a plurality of network entity data portions; and combining the plurality of network entity data portions to form consolidated network entity data for the network entity.

A comprehensive non-lethal defense system using a 5-pound CO2 fire extinguisher and detailed training protocols is provided. The defense system includes a standard fire extinguisher that is repurposed for threat mitigation. The defense system also includes a frost-free horn that Prevents frostbite on the hands of the user during operation the standard fire extinguisher. The defense system also includes a trigger mechanism with a safety lock that allows for controlled bursts and prevents accidental discharge from the standard fire extinguisher. The defense system also includes an ergonomic handle that ensures secure grip and stability under stress corresponding the standard fire extinguisher.