Varonis Systems, Inc.

Broadly speaking, the present techniques provide a method for training a machine learning, ML, model to perform named entity recognition in data items within an environment, and a method for using a trained ML model to autonomously perform named entity recognition. Advantageously, the present techniques enable sensitive information located in data items to be protected, which thereby reduces risk of data items that contain sensitive information from being accessed or manipulated by anyone without the requisite authority. In other words, by knowing what data items contain, appropriate security policies can be applied to the data items, and actions with respect to the data items can be controlled. The present techniques may also enable efficient and effective extraction of sensitive information from large sets of data items.

Broadly speaking, the present techniques provide an automatic way of classifying data items within an environment (e.g. a business, workplace, organisation, etc.), and applying data management policies based on the classifications. This is advantageous over existing techniques which require manual classification of data items, which is time consuming in environments where hundreds of new data items may be generated in a day or week. The present techniques use an embedding machine learning, ML, model to automatically determine the relevant classification label(s) for an unlabelled data item, which is then used to select and apply the relevant data management policy(ies).

Enhanced ranking and retrieval of documents and information, utilizing improved Retrieval-Augmented Generation (RAG). A method includes: (a) collecting historical query-document data from past interactions of users with a RAG system; (b) defining relevance criteria that determine whether a document that was retrieved by via RAG is relevant to a query posed to the RAG system; (c) labeling query-document pairs with a binary relevance indicator of Relevant or Irrelevant; (d) encoding queries and documents into numerical embedding vectors using a pre-trained embedding model; (e) generating feature vectors by performing element-wise multiplication of corresponding components of query embeddings and document embeddings; (f) organizing the feature vectors into a structured dataset, and splitting it into a training subset and a validation subset; (g) training a logistic regression Machine Learning (ML) model using to predict the relevance of query-document pairs, and validating the model; (h) integrating the ML model into the RAG system for real-time relevance scoring of documents that the RAG system retrieves in response to new user queries.

Disclosed is a system and method for automated data collaboration protection of sensitive content across an enterprise computer network. A machine learning model is trained to determine whether users are authorized to view instances of the sensitive content based on a plurality of signals. Responsive to an indication that an instance the sensitive content was shared with a user, the disclose system determines whether the user is authorized to view the instance based on the training of the machine learning model and, only when the model determines that the respective user is authorized to view the sensitive content, allows the instance of sensitive content to be shared with the user, and when the model determines that the respective user was not authorized to view the instance of sensitive content, prevents the instance from being shared with the user.

Automatically investigating security incidents and generating security incident reports using a Large Language Model (LLM). A computerized system receives an incoming Security Alert Message pertaining to a possible security-related incident. The system automatically feeds into the LLM at least: the content of the Security Alert Message; the metadata of the Security Alert Message; context information describing a security domain; and organization context information pertaining to users and machines of that organization. The system automatically prompts the LLM to automatically investigate the Security Alert Message and to automatically generate a detailed Incident Report pertaining to the Security Alert Message.

Automatic detection and handling of security-related anomalies by utilizing machine learning and a large language model (LLM). A computerized method for detecting and handling security threats in an organizational network of an organization includes: (a) collecting event data that pertain to organizational users, organizational devices, and organizational resources of the organizational network; (b) constructing user profiles, device profiles, and resource profiles; (c) constructing Organizational Context information that pertains to organizational users, organizational devices, and organizational resources; (d) constructing a time-series of events, enriched with the Organizational Context information; (e) analyzing the time-series of events using a Machine Learning process that detects an anomalous event, and automatically generating an alert message pertaining to and describing the anomalous event.

A process for training machine learning models. A model is initially trained using a set of labelled documents, and the trained model is used to predict outputs for a further set of unlabelled documents. A subset of those unlabelled documents is selected, labelled, and utilised in further training of the model.

A threat intelligence system utilising language models to generate queries for external threat intelligence systems, receive and filter responses, and generate alerts and reports using further language models.

The present techniques provide a method for automatically and quickly providing information after a data breach or incident in relation to data has occurred. The present application provides a method for issuing data incident notifications when data items naming specific entities have been accessed by someone who should not have access to them. This enables the entities to obtain information on the data items they are named in and which have been accessed. An index may be used to quickly identify the data items which are subject to an incident and which name entities. After these data items are identified, a notification list can be generated that shows each data item naming an entity. A system administrator or security officer can then generate a data incident notification to notify an entity about the impacted data items in which they are named.

A system, including a computer with a processor and memory executing an application configured to perform: receiving one or more events occurring in a computer network, querying a feature suppression list to determine if to suppress generation of specific features, generating features from the received events, which are not in the feature suppression list, examining each feature to determine if to initiate an alert and setting a severity level for the alert, analyzing the alert suppression rules to determine which features serve as a basis for alerts that are acted on and which features serve as a basis for alerts that are suppressed, generating the feature suppression list, listing features that should be suppressed.