CrowdStrike, Inc.

An LLM log parsing service parses log data using at least one large language model. The LLM log parsing service, however, may evaluate multiple log parser candidates. Each log parser candidate parses a sample of the log data using the at least one large language model. The LLM log parsing service generates a log parser decision that selects which one of the log parser candidates best performs as a log parser. The LLM log parsing service then parses the log data using the best log parser.

Techniques for calculating risk scores of entity assignments are discussed herein. The system generates a probability matrix using a collaborative filtering technique such as singular value decomposition. The probability matrix is populated with probability values for each entity representing a probability that, based on the various relationships or associations of that entity with other entities, the entity has been granted an assignment. Risk values are used to provide a weighting value to assignments, separating relatively higher risk assignments from relatively lower risk assignments. The system thereafter calculates a risk score for one or more of the entities using the information in the assignment matrix, the probability matrix, and the risk values. The system can flag or identity one or more entities whose risk scores do not meet various criteria.

An endpoint cybersecurity reinforcement learning agent uses reinforcement learning to implement cybersecurity actions. The endpoint cybersecurity RL agent interfaces with a host operating system as an antimalware driver. The endpoint cybersecurity RL agent receives an event notification generated by the OS and determines a responsive cybersecurity action using the reinforcement learning. The endpoint cybersecurity RL agent implements the cybersecurity action via the OS. The endpoint cybersecurity RL agent thus greatly improves computer functioning by quickly learning to identify new/novel suspicious events and operations.

The present disclosure provides techniques for computing an efficacy of a cyberthreat detection technique using proximity of detections. A processing device generates an incident report comprising a plurality of events detected at an endpoint. The processing device performs a scoring process on the plurality of events based on a first cyberthreat detection technique. Responsive to determining, during the scoring process, that a summed score corresponding to at least one event in the plurality of events exceeds a threshold score, the processing device computes a difference between a first timestamp at which the summed score exceeded the threshold score and a second timestamp at which a second cyberthreat detection technique detected a cyberthreat with respect to the endpoint. The processing device outputs an indication of the difference.

A cybersecurity model assessment service assesses machine learning and/or artificial intelligence models for cybersecurity threats. The cybersecurity model assessment service may particularly assess a pickle file associated with an AI/ML model. A dynamic emulation reveals whether the pickle file represents normal or abnormal computer behavior. The dynamic emulation of the pickle file may thus reveal whether the AI/ML model is safe or unsafe to use.

A system and method of using generative AI to recommend and validate asset and/or cloud configurations. The method includes acquiring a set of parameters associated with one or more network entities of a computing network. The method includes providing the set of parameters to a configuration model trained to generate, based on semantic matching, recommended configurations for network entities and validated configurations for the network entities. The method includes generating, by a processing device using the configuration model, one or more recommended configurations for the one or more network entities based on the set of parameters.

A deterministic finite automata (DFA) is used by an extended Berkley packet filter (or “eBPF”) to monitor file system operations and non-file system operations. The DFA is stored as an eBPF map. Before a kernel of an operating system executes any file system operation, the kernel runs an eBPF program that queries the DFA for a filename associated with the system operation. The DFA represents safe/suspicious filenames associated with computer files. If the filename matches the DFA, then the kernel notifies a cybersecurity agent. The cybersecurity agent may then block or allow the file system operation, depending on whether the filename is safe or suspicious. The DFA stored in the extended BPF thus greatly improves computer functioning by very quickly and simply identifying safe/suspicious operations.

A security agent executing on a computing system may determine when an encryption process, configured to generate an encrypted archive file containing one or more files, is initiated on the computing system. The security agent may identify files accessed by the encryption process during generation of the encrypted archive file, and may generate corresponding archive content data indicating content of the files accessed by the encryption process and that are likely included within the encrypted archive file. The security agent may apply policies to operations associated with the encrypted archive file by using the archive content data to determine contents of the encrypted archive file, without decrypting the encrypted archive file.

The present disclosure provides techniques for adaptive and context-aware scanning. A processing device obtains a set of metrics associated with at least one of: a target device in a network or the network. The processing device determines, based on the set of metrics, a time instance at which to perform a scan of the target device. The processing device performs the scan of the target device at the time instance.

The present disclosure provides an approach of analyzing multiple modalities of a file to produce multiple analysis tokens. Each one of the analysis tokens corresponds to a respective modality of the file. The approach provides the multiple analysis tokens to an artificial intelligence model, which is trained to produce an intermediate representation vector based on the plurality of analysis tokens. In turn the approach uses the artificial intelligence model to produce, based on the intermediate representation vector, a classification that indicates whether the file corresponds to a cybersecurity threat.