San Antonio, Texas Metropolitan Area
6K followers 500+ connections

Join to view profile

About

I build and execute a product vision.

I've been doing security my entire career.…

Experience & Education

  • Sevco Security

View J.J.’s full experience

See their title, tenure and more.

or

By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.

Volunteer Experience

  • Board Director

    Burnet County Emergency Services District #1

    - 3 years

    Emergency services districts (ESDs) are political subdivisions of the State of Texas, like a school district or a county. ESDs provide fire protection and emergency medical response to large portions of the state, where municipal or volunteer resources are otherwise unavailable.

    Burnet County ESD 1 provides EMS service to the areas of Horseshoe Bay in Burnet County.

Publications

  • SSL Anomaly Detection with Self-Organizing Maps [pdf]

    Using session-based features as inputs to a self-organizing map, your author develops an SSL anomaly detector to highlight any traffic that does not resemble HTTPS traffic. Additionally, it is shown that a map trained with traffic from one user browsing the web for a few hours is sufficient to filter 98.6% of HTTPS traffic from a large enterprise network with thousands of hosts.

    See publication

Patents

  • Method for verifying security technology deployment efficacy across a computer network

    Issued 12,034,735

    A method includes: accessing objects, generated by a set of sources, representing attributes of assets, affiliated with a computer network, including a set of endpoint devices and a first application; partitioning the objects into object groups including a first object group representing the first application; aggregating objects in the first object group into a first user container representing the first application during the first time interval; and, in response to selection of the first…

    A method includes: accessing objects, generated by a set of sources, representing attributes of assets, affiliated with a computer network, including a set of endpoint devices and a first application; partitioning the objects into object groups including a first object group representing the first application; aggregating objects in the first object group into a first user container representing the first application during the first time interval; and, in response to selection of the first application at an operator portal: generating a visualization representing a subset of endpoint devices, in the set of endpoint devices, on which the first application is installed during the first time interval based on a set of attributes, exhibited by the first application during the first time interval, contained in the first application container; and rendering the visualization at the operator interface.

    See patent

  • Method for configuring actions responsive to conditions of assets connected to a computer network

    Issued 11,882,157

    A method includes: generating a manifest of assets during the target time interval; labeling each asset in the manifest of assets with a set of attributes exhibited by the asset during the target time interval; defining a first attribute category exhibiting a first combination of attributes; assigning a first action to the first attribute category; identifying a subset of assets in the manifest of assets matching the first attribute category, each asset in the subset of assets exhibiting a set…

    A method includes: generating a manifest of assets during the target time interval; labeling each asset in the manifest of assets with a set of attributes exhibited by the asset during the target time interval; defining a first attribute category exhibiting a first combination of attributes; assigning a first action to the first attribute category; identifying a subset of assets in the manifest of assets matching the first attribute category, each asset in the subset of assets exhibiting a set of attributes including the first combination of attributes; and executing the first action on the first subset of assets.

    See patent

  • METHOD FOR CHARACTERIZING SECURITY TECHNOLOGY DEPLOYMENT TELEMETRY ACROSS A COMPUTER NETWORK

    Issued #11,659,008

    A method includes identifying a first group of objects generated by security tools during a first time interval and containing cotemporal , analogous characteristics identifying a first endpoint device connected to a computer network; based on the first group of objects , confirming detection of the first endpoint device by a first security tool and a second security tool during the first time interval; identifying a second group of objects generated by security tools during a second time…

    A method includes identifying a first group of objects generated by security tools during a first time interval and containing cotemporal , analogous characteristics identifying a first endpoint device connected to a computer network; based on the first group of objects , confirming detection of the first endpoint device by a first security tool and a second security tool during the first time interval; identifying a second group of objects generated by security tools during a second time interval and containing co-temporal, analogous characteristics identifying the first endpoint device; based on the second group of objects , confirming detection of the first endpoint device by the second security tool during the second time interval; and responsive to absence of detection of the first endpoint device by the first security tool during the second time interval , generating a source remove event specifying removal of the first security tool from the first endpoint device .

    See patent

  • METHOD FOR VERIFYING SECURITY TECHNOLOGY DEPLOYMENT EFFICACY ACROSS A COMPUTER NETWORK

    Issued US #11,647,027

    A method for monitoring endpoint devices affiliated with a computer network includes: for each security technology, accessing a set of objects generated by the security technology during a time interval and representing characteristics endpoint devices configured with the security technology, partitioning object groups representing individual endpoint devices , and aggregating characteristics represented in each object group into an endpoint device container associated with the security…

    A method for monitoring endpoint devices affiliated with a computer network includes: for each security technology, accessing a set of objects generated by the security technology during a time interval and representing characteristics endpoint devices configured with the security technology, partitioning object groups representing individual endpoint devices , and aggregating characteristics represented in each object group into an endpoint device container associated with the security technology and containing identifying data and status data representing one endpoint device ; identifying
    a first subset of endpoint devices configured with first and second security technologies based on correspondence between data contained endpoint device containers associated with the first and second security technologies ; and identifying a second subset of endpoint devices configured with the first security technology and excluding the second security technology based on absence of correspondence between data contained in endpoint device containers associated with the first and second security technologies.

    See patent

  • Method for predicting security risks of assets on a computer network

    Issued US 10,855,715

    One variation of a method for predicting security risks of assets on a computer network includes: over a first period of time, detecting an asset connected to the computer network and a first set of behaviors exhibited by the asset; associating the asset with a first set of assets based on similarity of the first set of behaviors to behaviors characteristic of the first set of assets; over a second period of time succeeding the first period of time, detecting the asset connected to the computer…

    One variation of a method for predicting security risks of assets on a computer network includes: over a first period of time, detecting an asset connected to the computer network and a first set of behaviors exhibited by the asset; associating the asset with a first set of assets based on similarity of the first set of behaviors to behaviors characteristic of the first set of assets; over a second period of time succeeding the first period of time, detecting the asset connected to the computer network and a second set of behaviors exhibited by the asset; detecting deviation of the asset from the first set of assets based on differences between the second set of behaviors and behaviors characteristic of the first set of assets; and generating a security alert for the asset in response to deviation of the asset from the first set of assets.

    See patent

  • Methods and Systems for Identifying Potential Enterprise Software Threats Based on Visual and Non-Visual Data

    Issued US 9,197,663

    Phishing attacks that trick users into double-clicking on malware by appearing to be an Office document/PDF/zip/etc have one thing in common: the icon has to look right. By using image recognition algorithms to classify the icon into a set of known applications, you can then inspect the underlying binary for the digital artifacts expected from that application. This changes the detection problem from the very difficult "identify malicious binaries from the universe of all possible…

    Phishing attacks that trick users into double-clicking on malware by appearing to be an Office document/PDF/zip/etc have one thing in common: the icon has to look right. By using image recognition algorithms to classify the icon into a set of known applications, you can then inspect the underlying binary for the digital artifacts expected from that application. This changes the detection problem from the very difficult "identify malicious binaries from the universe of all possible binaries" to the relatively straightforward "identify if this binary comes from that vendor."

    See patent

Languages

  • English

    Native or bilingual proficiency

  • Spanish

    Professional working proficiency

View J.J.’s full profile

  • See who you know in common
  • Get introduced
  • Contact J.J. directly
Join to view full profile

Other similar profiles

Explore more posts

Explore top content on LinkedIn

Find curated posts and insights for relevant topics all in one place.

View top content