Abstract: A computer-implemented method includes monitoring, by a power monitor on a computer device, for a peripheral device connection. The peripheral device connection connecting a peripheral device to an input/output port of the computer device. The input/output port is configured to provide power from a power supply of the computer device to the peripheral device. In response to the monitoring for the peripheral device connection identifying the peripheral device connection, the method includes determining, by the power monitor, a device type and a negotiated power of the peripheral device as connected. The power monitor determines whether the negotiated power of the peripheral device as connected matches expected power information. In response to determining the negotiated power of the peripheral device does not match the expected power information, the power monitor takes action on the computer device.

Abstract: According to one embodiment, a memory system is connectable to a host including a first volatile memory and includes a non-volatile memory and a controller. The controller may use a first area of the first volatile memory as a temporary storage memory of data stored in the non-volatile memory and controls the non-volatile memory. The controller generates a first parity by using first data stored in the non-volatile memory and a key value to store the first data and the generated first parity in the first area. In the case of reading the first data stored in the first area, the controller reads the first data and the first parity to verify the read first data using the read first parity and the key value.

Abstract: A method for (of) automatically detecting a security vulnerability in a source code using a machine learning model, characterized in that the method includes: obtaining the source code from a client codebase, wherein the client codebase is a complete or an incomplete body of the source code for a given software program or an application; and using a machine learning (ML) model to perform a ML based analysis on an abstract syntax tree (AST) for detecting a first security vulnerability over a static source code, the machine learning based analysis comprise (i) flattening the abstract syntax tree (AST) into a sequence of structured tokens, wherein the sequence of structured tokens includes a semantic structure and a syntactic structure of the source code, (ii) implementing a natural language processing technique on the sequence of structured tokens for mapping the sequence of structured tokens to one or more integers, (iii) pre-training the machine learning model using an unlabeled source code as an input to pre

Abstract: Systems, computer program products, and methods are described herein for detection and classification of intrusion using machine learning techniques. The present invention is configured to electronically receive, from a computing device of a user, an indication that the user has initiated a first resource interaction; retrieve information associated with the first resource interaction, wherein the information comprises at least one or more parameters associated with the first resource interaction; initiate a machine learning model on the one or more parameters associated with the first resource interaction; and classify, using the machine learning model, the first resource interaction into one or more classes, wherein the one or more classes comprises one or more access types.

Abstract: Artificial intelligence (AI) anomaly monitoring in a storage system. The AI anomaly monitoring may include writing commands into a log jointly with the execution of the commands on storage media of a drive. The log includes information regarding the operation of the drive including, at least, the commands. In turn, each drive in the storage system may include an AI processor core that may access the log and apply an AI analysis to the log to monitor for an anomaly regarding the operation of the drive. As each drive in the storage system may use the AI process core to detect anomalies locally to the drive, the computational and network resources needed to employ the AI monitoring may be reduced.

Abstract: Policy-based techniques are provided for dynamic access control for resources. One method comprises, upon a user attempt to access a given resource, identifying a policy defined for access to the given resource, wherein the policy comprises a rule and an allowed issuer of a verifiable claim; determining if the rule and the allowed issuer are satisfied based on an evaluation of the verifiable claim; and allowing the user to access the given resource if the rule and the allowed issuer are satisfied. A given rule can specify a threshold for a data item obtained from an allowed issuer. The policy can be stored by one or more policy hubs. A plurality of policy hubs can be organized in a hierarchical structure, such that one given policy is applied to the given resource in a predictable manner.

Abstract: In one embodiment, a client device accesses an online application via a browser executed by the client device. The client device makes an assessment as to whether the online application uses Hypertext Transfer Protocol (HTTP) security headers that satisfy a security header policy. The client device generates scoring for the webpage based on the assessment. The client device presents the generated scoring to a user of the client device.

Abstract: A computing device according to an embodiment includes one or more processors, a memory in which one or more programs to be executed by the one or more processors are stored, a queue manager configured to receive a security detection request including a detection target file, a plurality of detectors configured to perform a security detection operation on the target detection file, and an operation distributor configured to acquire detection policy information related to the detection target file and distribute the detection target file received from the queue manager to one or more of the plurality of detectors based on the detection policy information.

Abstract: Access to a shared library API is restricted for a customer application by a security system. A profile for each of a plurality of trusted applications is generated and stored in a security database. When a customer application attempts to access the shared library API, the customer application is verified by extracting a customer application profile for the customer application, comparing the customer application profile with each stored trusted application profile, and verifying that the customer application can access the shared library API based on the comparison. Based on the verification, the customer application may be allowed to or access to the shared library API or may be prevented from accessing the shared library API.

Abstract: The technology disclosed includes a system to group security alerts generated in a computer network and prioritize grouped security alerts for analysis. The system includes graphing entities in the computer network as entities connected by one or more edges. Native scores for pending alerts are assigned to nodes or to edges between the nodes. A connection type is assigned to each edge and weights are assigned to edges representing relationship strength between the nodes. The technology disclosed includes traversing the graph starting at starting nodes and propagating native scores through and to neighboring nodes connected by the edges. Aggregate score for a visited node is calculated by accumulating propagated scores at visited nodes with their respective native scores. The technology disclosed forms clusters of connected nodes in the graph that have a respective aggregate score above a selected threshold. The clusters are ranking and prioritized for analysis.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a system profile store; and a ransomware detection engine including instructions encoded within the memory to instruct the processor to: detect an operation, by a process, that results in an operation on a file, wherein the operation includes newly creating the file including a file type identifier, or where the file is an existing file, changing a file type identifier for the file; querying the system profile store with a combination of the file type identifier and metadata about the file; based at least in part on the querying, determining that the process is a suspected ransomware attack; and taking a remedial action.

Abstract: The present invention discloses a method for managing cloud service authority in a cloud storage system, which includes: a set of cloud data and a plurality of data servers. The cloud data includes a plurality of user object files and global access control information. Each data server includes an access control enforcement unit for executing or rejecting I/O requests from the client computers, where the access control enforcement unit includes local access control information. The method includes steps of: changing the content of the global access control information in the cloud data; downloading, by the data servers, the changed global access control information from the cloud data; updating, by the data servers, the local access control information therein according to the downloaded global access control information; and processing, by the data servers, I/O requests from the client computers according to the updated local access control information.

Abstract: In an embodiment, a threat score prediction model is generated for assigning a threat score to a software vulnerability. The threat score prediction model may factor one or more of (i) a degree to which the software vulnerability is described across a set of public media sources, (ii) a degree to which one or more exploits that have already been developed for the software vulnerability are described across one or more public exploit databases, (iii) information from one or more third party threat intelligence sources that characterizes one or more historic threat events associated with the software vulnerability, and/or (iv) information that characterizes at least one behavior of an enterprise network in association with the software vulnerability.

Abstract: Embodiments of the present disclosure relate to verifying a third-party resource by automatically validating multi-factor message codes associated with the third-party resource to enable access to functionality associated with the third-party resource via a multi-app communication system. An example embodiment includes a multi-app communication system including at least one processor and at least one memory. The embodiment multi-app communication system is configured to receive a sign-in request from a multi-app communication system application executed on a client device, and cause transmission of a multi-factor confirmation message to a verified third-party multi-factor authentication resource. The embodiment multi-app communication system is further configured query the verified third-party multi-factor authentication resource to identify the multi-factor confirmation message, and enable access to the third-party resource.

Abstract: Embodiments of the disclosure relate to a computer-implemented consequence-driven cyber-informed engineering tool for performing and reporting consequence-based prioritization, system-of-systems breakdown, consequence-based targeting, and mitigations and protections. Embodiments of a CCE tool may perform one or more steps of defining a target industrial control system (ICS), wherein the target ICS includes operational goals, critical functions, and critical services; determining one or more scored high consequence events (HCE) associated with the defined target ICS; prioritizing the scored HCEs according to an HCE severity index; and updating a dashboard with one or more representations of the prioritized HCEs, wherein the updated dashboard is associated with the CCE tool and presented at a display.

Abstract: Techniques are described with regard to client authentication management. An associated method includes constructing an authentication resolution model specific to a client based upon error patterns respectively included in a plurality of erroneous authentication submissions inconsistent with a proper authentication submission. The method further includes receiving, via an authentication interface, a new erroneous authentication submission inconsistent with the proper authentication submission. Responsive to determining that the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model, the method further includes completing authentication. Responsive to determining that the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model, the method further includes performing at least one client account warning protection activity.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed for anomalous memory access pattern detection for translational lookaside buffers. An example apparatus includes a communication interface to retrieve a first eviction data set from a translational lookaside buffer associated with a central processing unit; a machine learning engine to: generate an anomaly detection model based upon at least one of a second eviction data set not including an anomaly and a third eviction data set including the anomaly; and determine whether the anomaly is present in the first eviction data set based on the anomaly detection model; and an alert generator to at least one of modify a bit value or terminate memory access operations when the anomaly is determined to be present.

Abstract: There is provided a method of detecting a threat against a computer system. The method includes monitoring installation and operation of multiple different versions of the same application in a computer system; analysing evolutionary changes between the behaviours of the different versions of the same application; detecting and monitoring a new version of the same application in a computer system; monitoring the behavior of the computer system to detect one or more procedures of the monitored application that do not match expected behaviors of the monitored application on the basis of the analysis; and upon detection of one or more procedures not matching the expected behaviors of the monitored application, identifying the monitored application as malicious or suspicious.

Abstract: Systems and methods are provided for authenticating a user. The method includes accepting, using a graphical user interface coupled to an electronic computing device, a login request from the user to access a remote server, wherein the login request includes biometric data of the user, using a non-tactile biometric scanner, and comparing, using a processor on an intermediary server, the biometric data of the user with biometric data stored in memory of the intermediary server, wherein the biometric data stored in the memory is associated with one or more known users. The method further includes determining, based on the comparison, whether an identity of the user is authentic, and if the identity of the user is authenticated, relaying the login request to the remote server.

Abstract: A system and methods for facilitating secure computing device control and operation. The invention discloses a framework to supply security and policy-based control to computing applications as a software service. Clients running the framework make requests for services whereby they identify the service needed and its required parameters, encrypt and sign them, and send them to the service handler. The service handler decrypts, checks for policy allowance, and then, if allowed, executes the functions. The handler then encrypts and returns the response to the client. The framework allows for an aggregator that collects service requests for any number of clients and manages the distribution to service handlers and communications back to the clients.