Abstract: A method and an electronic device for training a classifier to identify a user of the electronic device are provided. The method comprises: receiving training key stroke data associated with the user, a given portion of the training key stroke data having been generated in response to the user inputting a respective symbol of a predetermined text into the electronic device, by interacting with a given key of the plurality of keys; determining, based on the given portion of the training key stroke data, a plurality of time intervals associated with the user; determining most stable ones of the plurality of time intervals for inclusion thereof in a training set of data; training, based on the training set of data, the classifier to determine if the predetermined text inputted into the electronic device in future has been inputted by the user.

Abstract: There is disclosed a method for training a Machine Learning Algorithm (MLA) for classifying a user action sequence that is performed by a user with an electronic service on a computer device. The method comprises: receiving an indication of interface elements of the electronic service and events associated with the interface elements to be monitored; receiving a plurality of indications of the user action sequence, the plurality of indications being of at least two different types of classes, for which the MLA is to be trained for classifying user actions into; generating a training set by: subdividing the given user action sequence into subsequences, determining a frequency of each subsequence appearing in the user action sequences belonging to a given one of the at least two different types of classes; scoring each subsequence based on the frequency; selecting n most informative subsequences.

Abstract: Methods and systems for determining an affiliation of a given software with target software are provided. The method comprises: receiving a software source code of the given software; executing the software source code in an isolated program environment to identify at least one outgoing request of the given software, the at least one outgoing request being indicative of at least one respective function of the software source code; generating, based on the at least one outgoing request, a respective function identifier associated with the at least one respective function; applying at least one classifier to the respective function identifier to determine a likelihood parameter indicative of the given software being affiliated to a respective target software; in response to the likelihood parameter being equal to or greater than a predetermined likelihood parameter threshold: identifying the given software as being affiliated to the respective target software.

Abstract: There is disclosed a method of creating a template of original video content, which is performed on a computer device that has access to a previously generated database of original video content. The method comprises receiving identifiers for at least a portion of an original video content; extracting at least a portion of metadata of the original video content; extracting at least a portion of frames from a sequence of frames of the original video content; identifying a sequence of scenes; creating a vector of the sequence of scenes; generating a template of the original video content that includes at least the portion of the metadata, and a vector of the sequence of scenes of the original video content; and storing the template in a database.

Abstract: A method and a system for determining an affiliation of a given software with target software are provided. The method comprises: receiving a file including a machine code associated with the given software; determining a file format; identifying, based on the file format, in the machine code, at least one function of a plurality of functions; generating, for each one of the plurality of functions associated with the given software, a respective function identifier; aggregating respective function identifiers, thereby generating an aggregated array of function identifiers associated with the given software; applying at least one classifier to the aggregated array of function identifiers to determine a likelihood parameter indicative of the given software being affiliated to a respective target software; in response to the likelihood parameter being equal to or greater than a predetermined likelihood parameter threshold: identifying the given software as being affiliated to the respective target software.

Abstract: A method and a system for user identification of a user in a computer system are provided. The method comprising: obtaining a user identifier associated with the user; assigning a respective window identifier to each user interface window opened by the user on the computing device; for a given working session of a pre-determined number of working sessions: storing a sequence of user interface windows opened by the user; identify, within user interface windows opened over the pre-determined number of working sessions, at least one pattern including a pre-determined number of repetitive sequences of user interface windows; generating a set of parameters characterizing a time elapsed between a transition from a first user interface window to an other user interface window within the at least one pattern; using the set of parameters associated with the at least one pattern and the user identifier to train at least one classifier.

Abstract: A method and an electronic device for training a classifier to identify a user of the electronic device are provided. The method comprises: receiving training key stroke data associated with the user, a given portion of the training key stroke data having been generated in response to the user inputting a respective symbol of a predetermined text into the electronic device, by interacting with a given key of the plurality of keys; determining, based on the given portion of the training key stroke data, a plurality of time intervals associated with the user; determining most stable ones of the plurality of time intervals for inclusion thereof in a training set of data; training, based on the training set of data, the classifier to determine if the predetermined text inputted into the electronic device in future has been inputted by the user.

Abstract: A method and a system for determining an affiliation of a given software with target software are provided. The method comprises: receiving a file including a machine code associated with the given software; determining a file format; identifying, based on the file format, in the machine code, at least one function of a plurality of functions; generating, for each one of the plurality of functions associated with the given software, a respective function identifier; aggregating respective function identifiers, thereby generating an aggregated array of function identifiers associated with the given software; applying at least one classifier to the aggregated array of function identifiers to determine a likelihood parameter indicative of the given software being affiliated to a respective target software; in response to the likelihood parameter being equal to or greater than a predetermined likelihood parameter threshold: identifying the given software as being affiliated to the respective target software.

Abstract: Methods and systems for determining an affiliation of a given software with target software are provided. The method comprises: receiving a software source code of the given software; executing the software source code in an isolated program environment to identify at least one outgoing request of the given software, the at least one outgoing request being indicative of at least one respective function of the software source code; generating, based on the at least one outgoing request, a respective function identifier associated with the at least one respective function; applying at least one classifier to the respective function identifier to determine a likelihood parameter indicative of the given software being affiliated to a respective target software; in response to the likelihood parameter being equal to or greater than a predetermined likelihood parameter threshold: identifying the given software as being affiliated to the respective target software.

Abstract: The disclosed non-limiting embodiments of the present technology are directed to methods and systems for warning in regard to cyber threats, especially methods to detect malicious web resources, in particular phishing websites, and mirrors of blocked and/or prohibited websites. The disclosed method comprises receiving, by the computer device, pointers for a plurality of web resources; extracting, by the computer device, at least some of the content elements of each web resource of the plurality of web resources. Iteratively combining, by the computer device, at least two content elements into subgroups and then iteratively combining subgroups into groups in response to a number of web resources including the at least two content elements exceeding a predefined minimum threshold of web resources for the at least one first subgroup and/or group.

Abstract: There is disclosed a method of creating a template of original video content, which is performed on a computer device that has access to a previously generated database of original video content. The method comprises receiving identifiers for at least a portion of an original video content; extracting at least a portion of metadata of the original video content; extracting at least a portion of frames from a sequence of frames of the original video content; identifying a sequence of scenes; creating a vector of the sequence of scenes; generating a template of the original video content that includes at least the portion of the metadata, and a vector of the sequence of scenes of the original video content; and storing the template in a database.

Abstract: There is disclosed a method to automatically identify fuzzy video content copies, which is performed on a computer device that has access to a previously generated database of original video content. The method comprises: receiving identifiers for video content; extracting each Nth frame from the video stream of received video content to obtain a sequence of frames, where N>1; identifying the sequence of scenes by comparing at least fragments of adjacent frames; creating a vector of the sequence of scenes of the received video content; comparing the vector of the sequence of scenes of received video content with the vector of the sequence of scenes of at least one template of original video content from a previously generated database of original video content; identifying a fuzzy copy of original video content when the sequence of scenes of original video content and scenes of received video content coincide to an extent that exceeds a predefined threshold.

Abstract: The disclosed non-limiting embodiments of the present technologt are directed to methods and systems for warning in regard to cyber threats, especially methods to detect malicious web resources, in particular phishing websites, and mirrors of blocked and/or prohibited websites. The disclosed method comprises receiving, by the computer device, pointers for a plurality of web resources; extracting, by the computer device, at least some of the content elements of each web resource of the plurality of web resources. Iteratively combining, by the computer device, at least two content elements into subgroups and then iteratively combining subgroups into groupls in response to a number of web resources including the at least two content elements exceeding a predefined minimum threshold of web resources for the at least one first subgroup and/or group.

Abstract: There is disclosed a method to automatically identify fuzzy video content copies, which is performed on a computer device that has access to a previously generated database of original video content. The method comprises: receiving identifiers for video content; extracting each Nth frame from the video stream of received video content to obtain a sequence of frames, where N>1; identifying the sequence of scenes by comparing at least fragments of adjacent frames; creating a vector of the sequence of scenes of the received video content; comparing the vector of the sequence of scenes of received video content with the vector of the sequence of scenes of at least one template of original video content from a previously generated database of original video content; identifying a fuzzy copy of original video content when the sequence of scenes of original video content and scenes of received video content coincide to an extent that exceeds a predefined threshold.

Abstract: There is disclosed a method for training a Machine Learning Algorithm (MLA) for classifying a user action sequence that is performed by a user with an electronic service on a computer device. The method comprises: receiving an indication of interface elements of the electronic service and events associated with the interface elements to be monitored; receiving a plurality of indications of the user action sequence, the plurality of indications being of at least two different types of classes, for which the MLA is to be trained for classifying user actions into; generating a training set by: subdividing the given user action sequence into subsequences, determining a frequency of each subsequence appearing in the user action sequences belonging to a given one of the at least two different types of classes; scoring each subsequence based on the frequency; selecting n most informative subsequences.