Abstract: A method for validating an interaction is disclosed. A first interaction cryptogram can be generated by a first device using information about a first party to the interaction and a second party to the interaction. A second interaction cryptogram can be generated by a second device also using information about the first party to the interaction and the second party to the interaction. Verifying each cryptogram can validate that the interaction details have not been changed, and that both the first party and second party legitimately authorized the interaction.

Abstract: A computer implemented method of detecting malicious code in a software application executing with a runtime environment in a computer system, the method including: receiving a definition of one or more runtime exception trigger conditions, each trigger condition defining criteria for the runtime environment to enter a software exception state and having associated a definition of a resulting state of the runtime environment having entered the exception state; monitoring the runtime environment to detect the satisfaction of a detected trigger condition by the runtime environment and, in response to a determination that the runtime environment fails to enter a resulting state associated with the detected trigger condition, identifying the software application as including malicious code.

Abstract: Methods and apparatuses disclosed herein for improved mobile app security testing via bridged native and web user interface interaction. In one example embodiment, a method is provided comprising receiving, by a security instrumentation system, an app for analysis, and discovering, by the security instrumentation system, one or more user interface elements provided by the app. Thereafter, interrogating, by the security instrumentation system, the one or more user interface elements provided by the app and serializing, by the security instrumentation system, the one or more user interface elements. In some embodiments, after serializing the one or more user interface elements, causing presentation of the serialized one or more interface elements via a web browser.

Abstract: A computerized method is described that is adapted to compare extracted features of a received object under analysis with one or more features associated with each known malicious object of a plurality of known malicious objects accessible to the one or more servers. Responsive to determining that the extracted features satisfy a prescribed level of correlation with the one or more features of a first known malicious object of the plurality of known malicious objects, identifying the received object as a malicious object. Also, responsive to determining that the extracted features fail to satisfy the prescribed level of correlation, conducting a second analysis that includes a comparison of the extracted features to the one or more features associated with each of the plurality of known malicious objects being of a type of malware other than malware targeting a specific entity.

Abstract: A method of revalidating a connection tracking table of a flow-based managed forwarding element (MFE) that stores a set of firewall rules associated with each of a set of network connections and a connection table that stores a firewall rule identification and a set of state values associated with each of said network connections. The method receives a change in one or more firewall rules stored at the MFE. The method receives a packet that requires stateful firewall rule check on a particular connection after the change in the firewall rules. When the rule identification retrieved from the connection table is not the same as the new firewall rule associated with the particular connection, the method updates the firewall rule identification and the set of state values associated the particular connection using the new firewall rule identification associated with the particular connection.

Abstract: Technologies pertaining to limiting access to secret data through utilization of sensor-based constraints are described herein. A sensor-based constraint is a constraint that can only be satisfied by predefined readings that may be output by at least one sensor on a mobile computing device. If the sensor on the mobile computing device outputs a reading that satisfies the sensor-based constraint, secret data is provided to a requesting application. Otherwise, the requesting application is prevented from accessing the secret data.

Abstract: The embodiments of the present invention provide a secure establishment method, system and device of a wireless local area network. The method includes: acquiring, by a UE, a first key; the first key is a shared key of the UE and a network element equipment in a mobile communication network accessed by the UE when implementing air interface security, or is derived according to the shared key; deriving, by the UE, according to the first key and a derivation parameter to acquire a derivation key; establishing, by the UE, according to the derivation key, a secure connection with a WLAN node acquiring a derivation key, wherein the derivation key acquired by the WLAN node is the same as the derivation key acquired by the UE.

Abstract: Systems and methods are provided that securely authenticate a user of a web application. For example, the user may utilize a bot from within a first application, such as a chat application. The user may request the bot to access a second application (e.g., a social-networking application) that is remote from the first application. If the bot does not have authorization, the bot may redirect the user to a webpage for the second application, where the user may enter login credentials. Upon verification, the second application may provide an access token to a webpage associated with the bot. To authenticate the bot user, the bot webpage may generate and cache a nonce that is transmitted back to the first application, which then transmits it to the bot. The bot may then compare the received nonce with the cached nonce. If the nonces match, the user may be securely authenticated.

Abstract: Method for authenticating a first and a second electronic devices associated through a communication line includes: creating a unique ID, by a third electronic device; transmitting the unique ID to the first electronic device; signing the transmitted unique ID by the first electronic device; transmitting the signed unique ID to the second electronic device, by the first electronic device; signing the transmitted signed unique ID by the second electronic device; transmitting the unique ID signed by the first and second electronic devices to the third electronic device; verifying and accepting the unique ID signed by the first device and the second device, by the third device; issuing a certificate for a secure communication line between the first electronic device and the second electronic device; and transmitting the certificate to the first electronic device and the second electronic device.

Abstract: Disclosed herein are a number of example embodiments for data management and analysis in connection with life science operations such as flow cytometry. For example, disclosed herein are (1) a networked link between an acquisition computer and a computer performing analysis on the acquired data, (2) modular experiment templates that can be divided into individual components for future use in multiple experiments, and (3) an automated pipeline of experiment elements.

Abstract: A tamper sensor assembly includes a lid having a surface and a sensor substrate on the surface of the lid. The sensor substrate has conductive lines that extend across at least a major portion of the surface of the lid and conform to three dimensional characteristics of the surface of the lid. The security processor is electrically connected to the conductive lines of the sensor substrate and is configured to identify occurrence of tampering with the lid based on an electrical characteristic of signals conducted through the conductive lines, and to perform an anti-tampering operation responsive to identifying occurrence of tampering.

Abstract: A communication apparatus determines whether the communication apparatus is connected with a wireless network, and accepts an instruction for starting setting processing of a communication parameter, which is used in performing wireless communication, with another communication apparatus that has read an image including information about a frequency channel used in the setting processing. If the communication apparatus is determined to be connected with the wireless network, the communication apparatus does not start waiting for a request for the setting processing even when the instruction is accepted. If the communication apparatus is determined not to be connected with the wireless network, the communication apparatus starts waiting for the request for the setting processing in response to acceptance of the instruction.

Abstract: The invention provides a computer-implemented authentication method comprising the step of enabling a user to input an identifier (e.g. a PIN) into an electronic device having a screen and a keypad operable within a keypad zone of the screen; by operating at least one key of the keypad via an image of at least part of a scrambled keypad which is displayed at least partially within the keypad zone. The user's operation of the keypad key via the image generates an encoded version of the user's intended input. In one sense the invention can be perceived as superimposing a non-functional image of a scrambled keyboard over an underlying, functional keypad. The image may be any type of electronic image, and may include a video image. The invention is particularly suited for use with, but not limited to, mobile phones, tablet computer, PCs etc. It can be implemented in any system wherein a user's identity must be verified before access is granted to a controlled resource.

Abstract: Approaches for monitoring a host operating system. A threat model is stored and maintained. The threat model identifies for any process executing on a host operating system how trustworthy the process should be deemed based on a pattern of observed behavior. The execution of the process and those processes in a monitoring circle relationship thereto are monitored. The monitoring circle relationship includes a parent process, any process in communication with a member of monitoring circle relationship, and any process instantiated by a present member of monitoring circle relationship. Observed process behavior is correlated with the threat model. Upon determining that a particular process has behaved in a manner inconsistent with a pattern of allowable behavior identified by the threat model for that process, a responsive action is taken.

Abstract: Some embodiments described herein relate to a method of defining and/or calculating an accuracy score for untrusted location data. The method can include receiving multiple signals including location data. Some or all of the signals may include untrusted location data. When a signal including location data is received, that location data can be stored, for example in a database. The accuracy score can be defined based on the number of entries in the database matching the received location data. If location data is statistically overrepresented in the database, it may be an indication that the location data has been assigned by an untrusted third party, rather than organically determined by the mobile communication device. Accordingly, a relatively low accuracy score indicating that the location data is synthetic can be defined when received location data matches a location that is statistically overrepresented in the database.

Abstract: A method according to one embodiment includes determining whether a guest associated with a guest device is authorized to control an access control device based on an access control list, generating a caveated cryptographic bearer token in response to determining the guest is authorized to control the access control device, the caveated cryptographic bearer token including a time-based caveat defining a time limit for control of the access control device, transmitting the caveated cryptographic bearer token to the guest device in response to generating the caveated cryptographic bearer token, transmitting, in response to receiving the caveated cryptographic bearer token, a request including the caveated cryptographic bearer token to control the access control device to the access control device, and authenticating the request based on the received caveated cryptographic bearer token, a base cryptographic bearer token stored on the access control device, and a real-time clock of the access control device.

Abstract: A method and system for an automated classification rating of browser extensions is provided. One embodiments of the present invention can track the behavior of a large number of users in order to determine the reputation of browser extensions such as toolbars. The rating can be determined based on similarity analysis of previously rated browser extension attributes, and can be adjusted in response to a determination of the user's choice on the browser extension removal and reinstallation.

Abstract: A method of authorizing enrollment of an RFID device including a biometric sensor may include separately sending the RFID device and an authorization code associated with the RFID device to the user. The RFID device is configured such that, when the user presents the RFID device to an RFID terminal and inputs the authorization code to the terminal, the RFID device will enter an enrollment mode during which the user is authorized to enroll their biometric data.

Abstract: A system that implements a Hypertext Transfer Protocol Secure (HTTPS) enabled client tool to facilitate HTTPS communication between a client device (on which the tool is installed) and a remote browser through which online product support to the client device is provided. The client tool creates a unique self-signed digital certificate on the fly and is used for client-server authentication purpose. The validity of the certificate is set to one day to avoid its re-use. A unique private key for the certificate is generated as well and is neither shared with other client devices nor made available after authentication. In an HTTPS session, the certificate is renewed and re-authenticated every one hour of interaction with the remote browser. The most recent version of the certificate is stored. When the client tool application is exited or stopped, the stored certificate is deleted. This ensures a secure communication between the client device and the remote browser.

Abstract: Disclosed is a method for detecting anomaly traffic using an autoencoder based on an inception-residual network-v2 which is one type of machine learning methods, the method including generating a plurality of encoders on the basis of traffic data for learning; generating a plurality of pieces of image data on the basis of traffic data for each session, which is a detection target; and determining whether the traffic data for each session is abnormal using at least one among the traffic data for learning, the plurality of encoders, and the plurality of pieces of image data.