Abstract: Disclosed herein are device and method for performing a total internal reflection scattering (TIRS) measurement to a sample slide. The device comprises a first reflective plate having a first opening; a second reflective plate having second and third openings and disposed on top of the first reflective plate thereby forming a slot therebetween for accommodating the sample slide, wherein the first opening of the first reflective plate is disposed directly underneath the second opening of the second reflective plate; a white light source disposed in the space formed by the third opening of the second reflective plate and configured to emit a white light into the slot; and a first blackout layer disposed on top of the third opening thereby covering the white light source and keeping the emitted white light from leaking. When the sample slide is inserted into the slot, the white light source illuminates the sample slide so as to achieve the TIRS measurement to the sample slide.

Abstract: Systems and methods for Internet access control are presented. A third-party application is hosted by a third-party server on the Internet. The third-party application has third-party data of a user. An Internet access control device detects an Internet access by the user to a target server on the Internet. The Internet access control device allows or blocks the Internet access depending on whether the Internet access is permitted or prohibited based on the third-party data.

Abstract: Methods and systems for managing security in a cloud computing environment are provided. Exemplary methods include: gathering data about workloads and applications in the cloud computing environment; updating a graph database using the data, the graph database representing the workloads of the cloud computing environment as nodes and relationships between the workloads as edges; receiving a security template, the security template logically describing targets in the cloud computing environment to be protected and how to protect the targets; creating a security policy using the security template and information in the graph database; and deploying the security policy in the cloud computing environment.

Abstract: Methods and systems for managing security in a cloud computing environment are provided. Exemplary methods include: gathering data about workloads and applications in the cloud computing environment; updating a graph database using the data, the graph database representing the workloads of the cloud computing environment as nodes and relationships between the workloads as edges; receiving a security template, the security template logically describing targets in the cloud computing environment to be protected and how to protect the targets; creating a security policy using the security template and information in the graph database; and deploying the security policy in the cloud computing environment.

Abstract: Methods and systems for deception using distributed threat detection are provided. Exemplary methods by an enforcement point, the enforcement point communicatively coupled to a first data network and a second data network, the enforcement point not providing services in the second data network, include: receiving, from a first workload in the second data network, a data packet addressed to a second workload in the second data network, the data packet requesting a service from the second workload; determining the data packet is for unauthorized access of the second workload, the determining using at least some of a 5-tuple of the data packet; identifying a deception point using the service, the deception point being in the first data network and including a decoy for the service; and redirecting the data packet to the deception point in the first data network.

Abstract: Methods and systems for deception using distributed threat detection are provided. Exemplary methods by an enforcement point, the enforcement point communicatively coupled to a first data network and a second data network, the enforcement point not providing services in the second data network, include: receiving, from a first workload in the second data network, a data packet addressed to a second workload in the second data network, the data packet requesting a service from the second workload; determining the data packet is for unauthorized access of the second workload, the determining using at least some of a 5-tuple of the data packet; identifying a deception point using the service, the deception point being in the first data network and including a decoy for the service; and redirecting the data packet to the deception point in the first data network.

Abstract: Methods and systems for diversifying coverage of a deception point are provided. Exemplary methods include: receiving, by a first enforcement point in a first data network segment, a first data packet addressed to a first workload in the first data network segment; forwarding the first data packet to the deception point using a first low-level security rule set, the deception point logging the first data packet to produce a first log, receiving, by a second enforcement point in a second data network segment, a second data packet addressed to a second workload in the second data network segment, forwarding the second data packet to the deception point using a second low-level security rule set, the deception point logging the second data packet to produce a second log, the deception point providing the first and second logs to a security director for analysis.

Abstract: In one embodiment, a server computer determines whether an email entering a private computer network is malicious (e.g., part of a directory harvest attack or bounce-source attack) by determining the recipient email address of the email and the Internet Protocol (IP) address of the source of the email. When the server computer determines that the email is malicious, the server computer may reject the email by sending a non-deterministic response to the source of the email. The non-deterministic response may include an error message that is different from the actual reason why the email is being rejected. The rejection may be sent as an immediate reply or postponed, for example.

Abstract: In one embodiment, a method of generating a listing of valid email addresses in a private computer network includes monitoring of inbound emails and outbound delivery failure notification emails. Recipient email addresses of inbound emails may be indicated in the listing as valid email addresses. The delivery failure notification emails may be indicative of receipt in the private computer network of an undeliverable email. The recipient email address of the undeliverable email may be identified in the listing as an invalid email address. Comparing the recipient email addresses of undeliverable emails and inbound emails advantageously allows generation of the listing of valid email addresses in the private computer network without having to ask an email server for such a listing.

Abstract: A training model for malware detection is developed using common substrings extracted from known malware samples. The probability of each substring occurring within a malware family is determined and a decision tree is constructed using the substrings. An enterprise server receives indications from client machines that a particular file is suspected of being malware. The suspect file is retrieved and the decision tree is walked using the suspect file. A leaf node is reached that identifies a particular common substring, a byte offset within the suspect file at which it is likely that the common substring begins, and a probability distribution that the common substring appears in a number of malware families. A hash value of the common substring is compared (exact or approximate) against the corresponding substring in the suspect file. If positive, a result is returned to the enterprise server indicating the probability that the suspect file is a member of a particular malware family.

Abstract: Methods and arrangements for implementing new email handling policies in gateway logic that is inserted upstream of the existing email system (which may or may not have an existing email gateway). By inserting the gateway logic upstream of the existing email system, it is unnecessary to reconfigure existing email handling logic since the remainder of the email system downstream of the newly inserted gateway logic is substantially undisturbed. Techniques and arrangements are proposed to ensure the remainder of the email system continues to function correctly after the insertion of the new gateway logic.