This disclosure provides an automatic causality tracking system that meets real-time
analysis needs. It solves cau sality tracking for cybersecurity, preferably as three sub tasks …

An automated method for cyberattack detection and preven tion in an endpoint. The
technique monitors and protects the endpoint by recording inter-process events, creating an …

Examples may include intercepting packets outputted from a primary virtual machine (PVM)
hosted by a first server and converting one or more fields of protocol headers for each …

A technique for storage-efficient cyber incident reasoning by graph matching. The method
begins with a graph pattern that comprises a set of elements with constraints and …

(57) ABSTRACT A user behavior activity detection method is provided in which network
traffic relating to user behavior activities in a network is monitored. Data is stored …

Security threats come in many forms, including computer viruses, worms, trojan horses,
spyware, keystroke loggers, adware, and rootkits. Such security threats may be delivered in …

G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY
ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR …

(57) ABSTRACT A distributed security system can include instances of a compute engine
that can execute either locally in security agents on client devices or as cloud instances in a …

Security threats come in many forms, including computer viruses, worms, trojan horses,
spyware, keystroke loggers, adware, and rootkits. Such security threats may be delivered in …

An apparatus and method for detecting abnormal connection behavior are disclosed. The
apparatus for detecting abnor mal connection behavior includes a data extraction unit, a …