Roy D Hodgman, 44238 Brookline St, Cambridge, MA 02139

8528049, Sep 3, 2013

Dec 21, 2010

12/974732

Amnon Khen - Tel Aviv, IL
Roy Hodgman - Wenham MA, US
Alon Kaufman - Bnei-Dror, IL

EMC Corporation - Hopkinton MA

H04L 29/06

726 2, 382119, 382187

A technique provides user authentication. The technique involves generating a pointer data profile entry in a pointer data profile database, the pointer data profile entry having a pointer data profile which is based on first pointer data obtained during a first user session. Such pointer data can be collected from a standard pointing device such as an electronic mouse, a touch-based track pad, a trackball, a scroll wheel, etc. The technique further involves receiving new pointer data during a second user session, and performing an authentication operation based on (i) the pointer data profile entry in the pointer data profile database and (ii) the new pointer data to determine whether a user providing the first pointer data during the first user session and a user providing the new pointer data during the second user session is the same person.

2022019, Jun 23, 2022

Mar 9, 2022

17/690304

- Boston MA, US
Roy Hodgman - Cambridge MA, US

Rapid7, Inc. - Boston MA

G06F 16/28
H04L 9/40
G06Q 10/06
G06F 16/215

Disclosed herein are methods, systems, and processes to optimize role level identification for computing resource allocation to perform security operations in networked computing environments. A role level classifier to process a training dataset that corresponds to a clean title is generated from a subset of entities associated with the clean title. An initial effective title determined by the role level classifier based on processing the training dataset is assigned to an entity. A new effective title based on feature differences between the initial effective title and the clean title is re-assigned to the entity. Performance of the generating, the assigning, and the re-assigning is repeated using the new effective title instead of the clean title.

2021038, Dec 9, 2021

Aug 24, 2021

17/409934

- Boston MA, US
Roy Hodgman - Cambridge MA, US

Rapid7, Inc. - Boston MA

H04L 29/06
G06F 16/28
G06N 20/00

Disclosed herein are methods, systems, and processes to detect valid clusters and eliminate spurious clusters in cybersecurity-based computing environments. A cluster detection and elimination model is trained by accessing a dataset with raw data that includes data points associated with computing devices in a network and applying two or more different clustering methodologies independently to the dataset. The resulting cluster detection and elimination model is used to compare two or more clusters to determine whether a cluster from one clustering methodology matches another cluster from another clustering methodology based on centroid locations and shared data points.

2021036, Nov 18, 2021

Aug 2, 2021

17/391407

- Boston MA, US
Roy Hodgman - Cambridge MA, US

Rapid7, Inc. - Boston MA

H04L 29/06
G06K 9/62
G06N 3/02
H04L 12/24

Methods and systems for identifying a network vulnerability. The system may gather data regarding a new or previously unknown network device, and compare the gathered data to one or more known devices that are scanned by a vulnerability assessment device. The vulnerability assessment device may then scan the previously unknown device upon a processor determining the previously unknown device shares at least one feature with a known device that is scanned.

2021028, Sep 16, 2021

Jun 2, 2021

17/336593

- Boston MA, US
Vasudha Shivamoggi - Cambridge MA, US
Roy Hodgman - Cambridge MA, US

Rapid7, Inc. - Boston MA

H04L 29/06
H04L 12/26
H04L 12/24

Disclosed herein are methods, systems, and processes for detecting data exfiltration. A data exfiltration event in a network is detected. Traffic data regarding outgoing traffic of a source in the network associated with the data exfiltration event is received. A logarithmic transformation is applied to the traffic data to generate transformed data. An outlier identification technique is selected based on the transformed data and is executed on the transformed data to determine that the outgoing traffic is indicative of the data exfiltration event. An alert is generated in response to the determination that the outgoing traffic is indicative of the data exfiltration event.

2020021, Jul 2, 2020

Dec 27, 2018

16/233631

- Boston MA, US
Roy Hodgman - Cambridge MA, US

H04L 29/06
H04L 29/08
G06K 9/62

Methods and systems for classifying network users. The system may receive a classification of a user account on a network and network activity data associated with the user account. Upon detecting a discrepancy between the expected behavior of the user account based on its classification and the present behavior of the user account, the system may obtain a corroborating result from one or more directory sources. An alert may then be issued based on the detected discrepancy and the corroborating result.

2020018, Jun 11, 2020

Dec 10, 2018

16/214309

- Boston MA, US
Roy Hodgman - Cambridge MA, US

G06N 20/00
G06K 9/62
G06N 5/04
G06F 16/28
H04L 29/06

Disclosed herein are methods, systems, and processes to automate cluster interpretation in computing environments to develop targeted remediation security actions. To interpret clusters that are generated by a clustering methodology without subjecting clustered data to classifier-based processing, separation quantifiers that indicate a spread in feature values across clusters are determined and used to discover relative feature importances of features that drive the formation of clusters, permitting a security server to identify features that discriminate between clusters.

2020017, Jun 4, 2020

Nov 29, 2018

16/203710

- Boston MA, US
Roy Hodgman - Cambridge MA, US

Rapid7, Inc. - Boston MA

H04L 29/06
G06N 20/00
G06F 16/28

Disclosed herein are methods, systems, and processes to detect valid clusters and eliminate spurious clusters in cybersecurity-based computing environments. A cluster detection and elimination model is trained by accessing a dataset with raw data that includes data points associated with computing devices in a network and applying two or more different clustering methodologies independently to the dataset. The resulting cluster detection and elimination model is used to compare two or more clusters to determine whether a cluster from one clustering methodology matches another cluster from another clustering methodology based on centroid locations and shared data points.