Radware Ltd.

A system and method for enriching a generative model for managing a cybersecurity is presented. The method includes generating textual data from reasoning data of a reasoning model, wherein the reasoning model represents a probabilistic causal relationship amongst a plurality of nodes, and wherein the textual data describes an incident case of the reasoning model in relation to at least one cause; embedding the generated textual data at the generative model in order to create a semantic embedding space; and training the generative model with the embeddings of the textual data.

A system and method for enriching a reputation database is provided. The system and method comprise: receiving attack attributes associated with an attack campaign; extracting an attack behavior profile for an identity linked to the attack campaign, wherein the attack behavior profile is based on the received attack attributes; retrieving, from a reputation database, behavior profiles of known bad actor groups, wherein bad actor groups are collections of network identities identified for engaging in malicious cyber activity; determining similarity scores between the extracted attack behavior profile and the behavior profiles of each known bad actor group; and enriching the reputation database by updating, based on the determined similarity scores, the extracted attack behavior profile and the behavior profiles of known bad actor groups stored in the reputation database.

A method and system for detecting domain name system (DNS) recursive cyber-attacks are presented. The system includes learning a plurality of baselines of at least rates and rate invariants of DNS features; monitoring DNS traffic directed to and from a DNS resolver, wherein the DNS resolver is communicatively connected between at least one client and at least one name server; analyzing the monitored DNS traffic using at least one detection function to detect an anomaly based in part on at least one baseline of the plurality of learnt baselines; and upon detection of at least one anomaly, performing at least one mitigation action to filter out incoming DNS queries to a domain name under attack.

A method and system for mitigating of randomized denial-of-service (DDoS) attacks directed against a protected entity during an attack time period are provided. The method includes receiving a packet during the attack time period; selecting a cluster defining legitimacy characteristics from at least one cluster of packets that best fits the received packet, wherein legitimacy characteristics of a cluster are learned during a peacetime period; determining a legitimacy score for the received packet based on the legitimacy characteristics of the selected cluster; determining based on the legitimacy score if the received packet is not legitimate; and applying a mitigation action on the received packet upon determination that the packet is not legitimate.

A system and method for out-of-path detection of cyber-attacks are provided. The method includes receiving, by a detector, a plurality of data feeds from a plurality of data sources, wherein the detector is communicatively connected to the plurality of data sources; processing, by the detector, the plurality of received data feeds to generate enriched Flow data sets; analyzing the enriched Flow data sets to detect a potential cyber-attack; and upon detection of a potential cyber-attack, providing indication to each network entity of the network entities that is under attack.

A system and method for generating insights on distributed denial of service (DDoS) attacks are provided. The method includes receiving a plurality of data feeds from a plurality of data sources; processing the plurality of received data feeds to generate enriched data sets; and analyzing the enriched data sets to generate insights information about a DDoS attack that have been participated in at least one DDoS attack.

A method and system for detecting and mitigation recursive domain name system (DNS) cyber-attacks are disclosed. The method includes receiving DNS queries directed to a DNS resolver, wherein the DNS resolver is communicatively connected between at least one client and at least one name server; parsing each received DNS query to extract a hostname identified therein; updating at least one array of Bloom filters using the extracted hostname; computing a ratio of an unrecognized hostnames per sample (UPS) based on the contents of the at least one array; and determining if the UPS ratio is abnormal, wherein an abnormal UPS ratio is an indication of an attack.