Abstract: In some aspects, the disclosure is directed to methods and systems for providing coordinative security among network devices across multi-level networks. Shared cryptographic secrets among the network devices are used as the basis for mutual security authentication and peering among these devices. The cryptographic secrets can be embedded in the SoC devices for these devices or dynamically generated based on unique identification information and attributes of these SoC devices. The messages for authentication and peering can be communicated directly among the network devices or indirectly via a cloud security portal entity that acts as a messaging proxy. The mutual authentication and peering process can be carried out coordinately among the network devices and a cloud security portal in a one-to-one mesh relationship, or in a transitive layering relationship, where each network entity authenticates and peers with its direct subordinates in a multi-level network.

Abstract: A plurality of containers related to one or more containerized applications are managed by monitoring an execution of the one or more containers; determining that a given one of the one or more containers exhibits anomalous behavior; and in response to the determining, adjusting a retention time of the given container, wherein the retention time of the given container determines when the given container is one or more of terminated and changes role to a honeypot container. The anomalous behavior comprises, for example, the given container exhibiting behavior that is different than a learned baseline model of the given container or including program code consistent with malicious activity. An alert notification of the anomalous behavior is optionally generated. The retention time of the given container can be adjusted for example, to an interval between deployment of the given container and the time the anomalous behavior is detected.

Abstract: A distributed event system includes a plurality of publishers, a communication infrastructure, and a key manager that manages access to publishing of events by one or more applications. An event is published, by a publisher, when the publisher determines an occurrence of an event and, in response, obtains a key from the key manager. The publisher then encrypts the event with the key to produce an encrypted event and transmits the encrypted event for consumption by a subscriber to the event.

Abstract: For lingual transformation-based encryption, a method parses communication data into lingual units. The method further generates a validation nonce from the lingual units. In addition, the method generates a transform unit for each lingual unit by applying a lingual message transformation to each lingual unit as an encryption function of a selection rule.

Abstract: Observable characteristics of an encrypted data transmission can be analyzed and used to make inferences about the content of the data transmission. This information leakage is reduced by obscuring the observable characteristics of the data transmission. An obscuring engine is installed into the networking stack of a computer system that performs data transmission operations. The obscuring engine performs a variety of obscuring operations to obscure characteristics of the data transmission. The obscuring operations can include altering the size, packet ordering, packet partitioning, packet timing, and structure of the data transmission.

Abstract: A computer-implemented method for detecting malware-induced crashes may include (1) identifying, by analyzing a health log associated with a previously stable computing device, the occurrence of an unexpected stability problem on the previously stable computing device, (2) identifying, by analyzing an event log associated with the previously stable computing device, an event that is potentially responsible for the occurrence of the unexpected stability problem on the previously stable computing device, (3) determining, due at least in part to the event being potentially responsible for the occurrence of the unexpected stability problem on the previously stable computing device, that the event is potentially malicious, and (4) performing a security action in response to determining that the event is potentially malicious. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Techniques are presented for establishing context awareness during first negotiation of secure key exchange. These techniques may be embodied as a method, apparatus or instructions in a computer-readable storage media. At a first network device, a message is received from a second network device as part of an initial exchange of information of a secure key exchange, the message containing information indicating one or more secure key exchange policies acceptable to the second network device and defining one or more associated security parameters. The message further contains context-specific information identifying a context of the second network device. The first network device selects a secure key exchange policy for communicating with the second network device based upon the context-specific information and sends a response message to the second network device containing the selected secure key exchange policy. If the context was understood, the response message also includes context-specific information.