Abstract: A computer-implemented method includes creating an account including an account value on an online service. The account value is modified periodically to activate a plurality of account values respectively associated with a plurality of times at which the plurality of account values were respectively activated on the account. A network-accessible data repository is scanned to detect a first value of the plurality of account values, the first value associated with a first time of the plurality of times at which the first value was activated. Responsive to detecting the first value a notification is provided indicating a data leak from the online service including an indication of when the data leak occurred based on the first time at which the first value was activated on the account and a second time at which a second value was activated on the account to replace the first value.

Abstract: Technology related to a network application firewall is disclosed. In one example, a method includes intercepting a response from a network application and destined for a client. The response can be associated with a user identifier. A modified response can be forwarded to the client. The modified response can include a honeytrap embedded within the intercepted response. Engagement with the honeytrap can be detected in a subsequent request to the network application. In response to detecting the engagement with the honeytrap, an indication that the user identifier is malicious can be stored.

Abstract: Computer-implemented systems and methods include receiving unknown content in a cloud-based sandbox; performing an analysis of the unknown content in the cloud-based sandbox, to obtain a score to determine whether or not the unknown content is malware; obtaining events based on the analysis; running one or more rules on the events; and adjusting the score based on a result of the one or more. The systems and methods can include classifying the unknown content as malware or clean based on the adjusted score. The analysis can include a static analysis and a dynamic analysis, with the events generated based thereon.

Abstract: Techniques for evaluating cyber assets are disclosed. A system obtains, from data sources in an experimental environment, raw data generated in response to execution of a cyber asset. The system generates, from the raw data, at least one instance model corresponding to the data sources. The at least one instance model includes instances of concepts represented in a cyber impact ontology.

Abstract: This disclosure relates generally to online learning against data poisoning attack. Conventional methods used data sanitization techniques for online learning against data poisoning attack. However, these methods do not remove poisoned data points from training dataset completely. Embodiments of the present disclosure method provide an influence based defense method for secure online learning against data poisoning attack. The method initially filters a subset of poisoned data points in the training dataset for training a machine learning model using data sanitization technique. Further the method computes an influence of the data points and performs an influence minimization based on a predefined threshold. Updated data points for the learning model are generated and used for training the machine learning model. The disclosed method can be used against data poisoning attacks in applications such as spam filtering, malware detection, recommender system and so on.

Abstract: A method is disclosed that includes receiving, at a computing device, an event log including events derived from machine data, and determining a score by comparing an event from the event log with frequent patterns of features. Determining the score includes determining a length of a frequent pattern within the event in the event log and a count of occurrences of the frequent pattern within the events, determining a contribution of the frequent pattern based on the length and the count, determining a penalty for an unmatched feature of the first event based on a cardinality of the events, and averaging the contribution and the penalty to obtain the score. The method further includes issuing an alert identifying the first event as an anomaly using the first score and an anomaly score threshold.

Abstract: Approaches for detecting and rectifying the malware in the computing systems are described. In an example, a request by a process or is intercepted by the malware detection module. Relevant information and characteristics pertaining to the request are extracted and on the based on the extraction, operational attributes are generated. These extracted operational attributes are analyzed and compared with the baseline attributes and if there are any anomalies present, the susceptible code or process originating from the intercepted request is ascertained as malicious.

Abstract: A data analytics application receives a workflow that includes a sequence of tools. Each tool performs a data analytics function. The data analytics application processes a data file using the sequence of tools to generate a result item representing an outcome of the processing of the data file. The data analytics application stores one or more metadata files, each of which includes data generated by an interactive tool in the sequence during the processing of the data file. The data analytics application receives a user input through an interactive element associated with an interactive tool in the sequence. The interactive element can modify an operation of the interactive tool based on the user input. The data analytics application retrieves the metadata file for the interactive tool and processes the metadata file by using a subset of the sequence of tools and the user input to generate a different result item.

Abstract: A threat detection system for detecting malware can automatically decide, without manual expert-level interaction, the best set of features on which to train a classifier, which can result in the automatic creation of a signature-less malware detection engine. The system can use a combination of execution graphs, anomaly detection and automatic feature pruning. Execution graphs can provide a much richer structure of runtime execution behavior than conventional flat execution trace files, allowing the capture of interdependencies while preserving attribution (e.g., D happened because of A followed by B followed by C). Performing anomaly detection on this runtime execution behavior can provide higher order knowledge as to what behaviors are anomalous or not among the sample files. During training the system can automatically prune the features on which a classifier is trained based on this higher order knowledge without any manual intervention until a desired level of accuracy is achieved.

Abstract: The embodiments disclose a system and method including a random number generator coupled to the randomized machine learning-based malware detector configured for determining changes of settings and selections of parameters, candidate classifiers integrated with the randomized machine learning-based malware detector and configured to be initiated by a random number to avoid transferable learning, a set of feature combinations for random feature selection including monitoring granularity and detection prediction latency and a random number for identifying a set of feature combinations that minimize the overhead and maintain enough variance in data for baffling the malware adversarial attacks.

Abstract: Techniques are provided for detection of unauthorized encryption using one or more deduplication efficiency metrics. One method comprises obtaining a deduplication efficiency value for a deduplication operation in a storage system; evaluating the deduplication efficiency value for the deduplication operation relative to an expected deduplication efficiency value; and performing one or more automated remedial actions, such as generating an alert notification, in response to the evaluating satisfying one or more deduplication criteria. A count of a number of concurrent users may be compared to an expected number of concurrent users, and/or (ii) a count of a number of concurrent sessions for a given user may be compared to an expected number of concurrent sessions for the given user. A ransomware alert or an unauthorized encryption alert may be generated when the evaluating and/or the comparison satisfy predefined attack criteria.

Abstract: A method and system for detecting vulnerable wireless networks coexisting in a wireless environment of an organization are provided. The method includes receiving intercepted traffic, wherein the intercepted traffic is transmitted by at least one wireless device operable in an airspace of the wireless environment, wherein the intercepted traffic is transported using at least one type of wireless protocol; analyzing the received traffic to detect at least one active connection between a legitimate wireless device of the at least one wireless device and at least one unknown wireless device, wherein the legitimate wireless device is at least legitimately authorized to access a protected computing resource of the organization; and determining if the at least one detected active connection forms a vulnerable wireless network.

Abstract: A method of detecting and responding to anomalous activity within a system involves generating a two-dimensional graphical image of a first dimension and a second dimension, and wherein the first dimension corresponds to a cyclical repeating interval made up of multiple bins, the graphical image having been generated such that a bin of the multiple bins, is the bin having a highest count, and the bin is scaled to the second dimension, and counts of all other bins in the interval are scaled relative to that highest count, graphically comparing the generated graphical image to an immediately preceding graphical image for similarity, and when a result of the comparison fails to satisfy a pre-specified similarity threshold, automatically triggering an appropriate anomaly detection-based follow-on action.

Abstract: A system (100) for security assessment of a plurality of IoT devices (210, 220, 230, 240) includes a programmed processing unit (110) adapted to carry out a vulnerability and/or “penetration test” method; according to this method, at least wireless communication medium and at least one communication protocol are determined to be used for the assessment, then at least one scan tool is selected based on the communication medium and communication protocol, then the scan tool is executed on the IoT devices (210, 220, 230, 240), and then data from the scan tool are collected, the data being obtained from reaction of the IoT devices to the scan tool; the computerized system performs a scan of a predetermined frequency bandwidth in order to identify the IoT devices to be assessed and the communication protocol to be used for the assessment.

Abstract: Described herein are embodiments for transferring knowledge of intrusion signatures derived from a number of software-defined data centers (SDDCs), each of which has an intrusion detection system (IDS) with a convolutional neural network (CNN) to a centralized neural network. The centralized neural network is implemented as a generative adversarial neural network (GANN) having a multi-feed discriminator and a generator, which is trained from the discriminator. Knowledge in the GANN is then transferred back to the CNNs in each of the SDDCs. In this manner, each CNN obtains the learning of the CNNs in nearby IDSs of a region so that a distributed attack on each of the CNNs, such as a denial of service attack, can be defended by each of the CNNs.

Abstract: The technology disclosed provides systems and methods related to preventing exfiltration of training data by feature reconstruction attacks on model instances trained on the training data during a training job. The system comprises a privacy interface that presents a plurality of modulators for a plurality of training parameters. The modulators are configured to respond to selection commands via the privacy interface to trigger procedural calls. The procedural calls modify corresponding training parameters in the plurality of training parameters for respective training cycles in the training job. The system comprises a trainer configured to execute the training cycles in dependence on the modified training parameters. The trainer can determine a performance accuracy of the model instances for each of the executed training cycles.

Abstract: This disclosure describes techniques for calculating a vulnerability score for a malicious threat based on Indicator of Compromise (IoC) metadata retrieved from a computing device or underlying network. Further, an Indicator of Compromise (IoC) Calculation (IoC-C) system is described that may monitor a client interaction on a computing device, and further identify IoC metadata that may relate to a malicious threat. The IoC-C system may further generate a vulnerability score that numerically quantifies a risk that the malicious threat poses to the computing device or underlying network. The vulnerability score may account for environmental criteria that mitigate an effect of the malicious threat. The IoC-C system may also generate a reporting data packet that includes an informational message identifying a potential risk posed by a malicious threat, or a response protocol that dynamically prevents, mitigates or quarantines an effect of the malicious threat on a computing device or underlying network.

Abstract: A method comprising: receiving raw data related to one or more network nodes, wherein dissimilar data types are aligned as input events; filtering one or more of the input events by using an adjustable threshold that is based on a filtering score, wherein the filtering score is an estimate of the likelihood that the input event is followed by a security related detection; processing only input events passed through the filtering by an enrichment process; and analysing the data received from the enrichment process for generating a security related decision.

Abstract: A device may generate a display of a firewall policy management GUI. The device may generate a display in the firewall policy management GUI of a list of existing firewall policies and a firewall policy interface that is adjacent to the list of existing firewall policies in a same view of the firewall policy management GUI. The device may generate a display in the firewall policy management GUI of at least one of a plurality of candidate sources for a new firewall policy, a plurality of candidate destinations for the new firewall policy, or a plurality of candidate security configurations for the new firewall policy. The device may display, in the firewall policy interface, at least one of a first column that includes two or more sources, a second column that includes two or more destinations, or a third column that includes two or more security configurations.

Abstract: A computer-implemented method for processing data, which are associated with at least one message received via a communications system, such as a bus system. The method includes: determining a first variable, which characterizes a transmitting time of the at least one message; evaluating the first variable with regard to at least one time frame of possible transmitting times of the at least one message.

Abstract: Aspects of vulnerability scanning are disclosed. In one example, configuration and context information of a first device for which vulnerability scanning is to be performed is obtained. The configuration information includes telemetry data of the first device. A second device is provisioned based on the configuration information to create a cloned first device. The vulnerability scanning is performed on the cloned first device based on the context information to obtain a scan report.

Abstract: An approach to predicting the outcome of a computer security response. The approach can analyze an unlabeled set of network data and based on the analysis, create a language model of the network. The approach can process the language model to predict a reduction factor associated with network availability. The approach can further process the language model and a malicious sequence to predict an effectiveness factor associated with blocking the malicious sequence. The approach can output bot the reduction factor and the effectiveness factor to a network administrator for determining the applicability of the computer security response.

Abstract: A device and a computer-implemented method for classifying data, in particular for a Controller Area Network or an automotive Ethernet network. A plurality of messages is received from a communications network. A message that has a predefined message type is selected for an input variable for an input model of a plurality of input models of an artificial neural network associated with the predefined message type. The input variable is determined as a function of the message, and in an output area of the artificial neural network a prediction is output that is usable for classifying the message as a function of the input variable, or a reconstruction of an input variable is output that is usable for classifying the message as a function of this input variable.

Abstract: Aspects of the present disclosure involve a system and method for malware detection. The system and method introduce a probabilistic model that can observe user transaction data over a predetermined window of time. Then, using posterior probability, the system can determine whether multiple users where present during the window observed.

Abstract: Systems and methods for dynamically mitigating a DDOS attack. In an aspect, the technology relates to a computer-implemented method for dynamically mitigating a distributed-denial-of-service (DDOS) attack. The computer-implemented method may include detecting a DDOS attack directing malicious traffic to a target, identifying one or more source locations of the malicious traffic, and in response to detecting the DDOS attack, activating one or more scrub clusters in the identified one or more source locations of the malicious traffic. The method may further include directing traffic intended for the target to the to the activated one or more scrub clusters, detecting an end of the DDOS attack, and in response to detecting the end of the DDOS attack, deactivating the one or more scrub clusters to release hardware resources.

Abstract: Example methods are provided a computer system to perform context-aware domain name system (DNS) query handling in a software-defined networking (SDN) environment. One example method may comprise detecting a DNS query to translate a domain name; identifying DNS record information that translates the domain name to a network address assigned to a virtualized computing instance; and identifying context information that is associated with the virtualized computing instance and mapped to the DNS record information. The method may also comprise: in response to detecting a potential security threat based on the context information, performing a remediation action to block access to the virtualized computing instance; but otherwise, generating and sending a DNS reply specifying the network address assigned to allow access to the virtualized computing instance.

Abstract: A cyber threat intelligence (CTI) gateway device may receive rules for filtering TCP/IP packet communications events that are configured to cause the CTI gateway device to identify communications corresponding to indicators, signatures, and behavioral patterns of network threats. The CTI gateway device may receive packets that compose endpoint-to-endpoint communication events and, for each event, may determine that the event corresponds to criteria specified by a filtering rule. The criteria may correspond to one or more of the network threat indicators, signatures, and behavioral patterns. The CTI gateway may create a log of the threat event and forward the threat event log to a task queue managed by a cyberanalysis workflow application. Human cyberanalysts use the cyberanalysis workflow application to service the task queue by removing the task at the front of the queue, investigating the threat event, and deciding whether the event is a reportable finding that should be reported to the proper authorities.

Abstract: Computer system security is often implemented using rules-based systems (e.g., allow traffic to this network port, deny it for those network ports; user A is allowed access to these files, but not those files). In enterprises, multiple such systems may be deployed, but fail to be able to intelligently handle anomalies that may technically be permissible but in reality represents a high possibility that there is an underlying threat or problem. The present disclosure describes the ability to build adaptive models using machine learning techniques that integrate data from multiple different domains (e.g. user identity domain, system device domain) and allow for automated decision making and mitigation actions that can provide greater effectiveness than previous systems allowed.

Abstract: Methods, non-transitory computer readable media, and database activity monitor devices that deploy a monitoring proxy into a virtual private cloud (VPC) network hosted by a first public cloud network following detection in the VPC network of a new database associated with an entity. The monitoring proxy is configured to obtain and report the activity data based on a first database type of the cloud database. A determination is made when at least one security check defined in at least one security policy is violated based on an analysis of the activity data. An alert is automatically output via a communication network, when the determination indicates the security check is violated. One or more interactive dashboards are generated and output based on the activity data. The interactive dashboards comprise a historical database activity report for the entity.

Abstract: A method, including receiving, from multiple sources, respective sets of incidents, and respective suspiciousness labels for the incidents. A set of rules are applied so as to assign training labels to respective incidents in a subset of the incidents in the received sets. For each given incident in the subset, the respective training label is compared to the respective suspiciousness label so as to compute a respective quality score for each given source. Any sources having respective label quality scores meeting a predefined criterion are identified, and a model for computing predicted labels is fit to the incidents received from the identified sources and the respective suspiciousness labels of the incidents. The model is applied to an additional incident received from one of the sources to compute a predicted label for the additional incident, and a notification of the additional incident is prioritized in response to the predicted label.

Abstract: A system is provided for classifying an instruction sequence with a machine learning model. The system may include at least one processor and at least one memory. The memory may include program code that provides operations when executed by the at least one processor. The operations may include: processing an instruction sequence with a trained machine learning model configured to detect one or more interdependencies amongst a plurality of tokens in the instruction sequence and determine a classification for the instruction sequence based on the one or more interdependencies amongst the plurality of tokens; and providing, as an output, the classification of the instruction sequence. Related methods and articles of manufacture, including computer program products, are also provided.

Abstract: An information handling system may include at least one processor and a memory. The information handling system may be configured to receive a plurality of address resolution protocol (ARP) packets based on requests that have been transmitted from a provisioning system to a plurality of network addresses; based on contents of the plurality of ARP packets, determine one of the plurality of network addresses as a potential network address; based on the contents of the plurality of ARP packets, determine a potential gateway address; and use the potential network address to attempt to communicate with the provisioning system via the potential gateway address.

Abstract: A device configured to obtain a first user interaction data at a first time instance for user devices, to obtain a first set of clusters from a machine learning model based on the first user interaction data, and to determine a first cluster quantity for the first set of clusters. The device is further configured to obtain a second user interaction data at a second time instance for the user devices, to obtain a second set of clusters from the machine learning model based on the second user interaction data, and to determine a second cluster quantity for the second set of clusters. The device is further configured to determine the second cluster quantity is greater than the first cluster quantity, to identify a cluster that is not present in the first set of clusters, and to modify settings on a user device from within the cluster.

Abstract: A first dataset that includes an indication of a plurality of network events associated with a time-period is received. For each time sub-period from a plurality of time sub-periods that together span the time-period and to generate a second dataset, a value for each network event from the plurality of network events that occur within that time sub-period is summed. A discrete Fourier transform is performed based on the second dataset to generate a third dataset that includes an indication of a plurality of frequency ranges and a plurality of magnitude values for the plurality of frequency ranges. Each frequency from the plurality of frequencies ranges is associated with a magnitude value from the plurality of magnitude values. A set of candidate frequencies from the plurality of frequencies determined to potentially cause periodic behavior is identified based on the plurality of frequency ranges and the plurality of magnitude values.

Abstract: A system is provided for detecting and remediating computing system breaches using computing network traffic monitoring. In particular, the system may identify one or more computing systems within a network as well as relationships between such computing systems to determine a network topology. Based on the network topology, the system may use historical network traffic data associated with the computing systems in the network to generate predicted entry points and lateral pathways of a security breach that may take place within particular computing systems. Then, based on the computing systems affected as well as entry points and path traversals of the breach, the system may generate and/or implement one or more remediation steps to address existing and/or future breaches. In this way, the system may provide an intelligent method of augmenting the security of a computing network.

Abstract: A method comprises generating a first set of hardware performance counter (HPC) events that is ranked based on an ability of an individual HPC event to profile a malware class, generating a second set of HPC event combinations that is ranked based on an ability of a set of at least two joint HPC events to profile a malware class, generating a third set of extended HPC event combinations, profiling one or more malware events and one or more benign applications to obtain a detection accuracy parameter for each malware event, applying a machine learning model to rank the third set of HPC event combinations based on malware detection accuracy, and applying a genetic algorithm to the third set of HPC event combinations to identify a subset of the third set of extended combinations of HPC events to be used for malware detection and classification.

Abstract: Systems, methods, and apparatuses for generating a protected stack allocation pointer. In certain examples, a hardware processor core comprises a decoder circuit to decode a single instruction into a decoded single instruction, the single instruction comprising one or more fields to indicate a stack allocation index as an operand, and an opcode to indicate that an execution circuit is to generate a stack allocation pointer to reference an address in a stack and an address in a shadow stack; and an execution circuit to execute the decoded single instruction according to the opcode.

Abstract: A surveying system includes a target unit having a reflection target and an encoder pattern showing an angle of the target unit; a scanner configured to acquire three-dimensional point cloud data, measured coordinates of the target, and optically read the encoder pattern to acquire an encoder pattern read angle; and a leveling base configured to selectively allow either of the target unit and the scanner to be removably mounted. The scanner calculates a direction angle of the leveling base based on the encoder pattern read angle and the offset angle of the target unit, calculates coordinates of an installation point of the target unit based on the measured coordinates of the target and the direction angle of the target, and calculates a direction angle of the scanner based on the offset angle of the scanner and the direction angle of the leveling base on which the scanner is mounted.

Abstract: Described herein is a system that detects ransomware infection in filesystems. The system detects ransomware infection by using backup data of machines. The system detects ransomware infection in two stages. In the first stage, the system analyzes a filesystem's behavior. The filesystem's behavior can be obtained by loading the backup data and crawling the filesystem to create a filesystem metadata including information about file operations during a time interval. The filesystem determines a pattern of the file operations and compares the pattern to a normal patter to analyze the filesystem's behavior. If the filesystem's behavior is abnormal, the system proceeds to the second stage to analyze the content of the files to look for signs of encryption in the filesystem. The system combines the analysis of both stages to determine whether the filesystem is infected by ransomware.

Abstract: In some implementation, a system for identifying malicious attacks on a convolutional neural network (CNN) model includes a target computing system that performs classification of objects using a CNN model, and an attack identification computing system that identifies an injected neural attack. The attack identification computing system can be configured to generate, based on the CNN model and associated parameters, an ecosystem of CNN models by modifying original weights of the parameters associated with the CNN model; update the original weights of the parameters with the modified weights; store, in a secure data store, the updated weights of the parameters; generate, based on the updated weights, an update file for the CNN model; update, using the update file, the CNN model; and transmit the updated CNN model to a targeting computing system configured to detect neural attacks by an attacker computing system based on the updated CNN model.

Abstract: Disclosed herein is a method of detecting a security event associated with an IoT device configured to store data on a primary blockchain, in accordance with some embodiments. Accordingly, the method may include receiving, using a communication device, actual operational data associated with the IoT device. Further, the method may include retrieving, using a storage device, standard operational data associated with the IoT device. Further, the method may include analyzing, using a processing device, each of the actual operational data and the standard operational data. Further, the method may include detecting, using the processing device, the security event based on the analyzing. Further, the method may include generating, using the processing device, a notification based on the detecting. Further, the method may include transmitting, using the communication device, the notification to at least one user device associated with the IoT device.

Abstract: A method for compressing a behavior event and a computer device therefor are provided. The method for compressing the behavior event includes generating, by a processor of the computer, an event block on the basis of an event target, when the behavior event occurs, updating, by the processor, input/output (I/O) information while the behavior event occurs to the event block, and storing, by the processor, the event block, when the behavior event is ended.

Abstract: Aspects of the disclosure relate to a data integrity system for transmission of data. A computing platform may detect transmission of data to a second enterprise computing device, and may intercept the data content in transmission. Then, the computing platform may convert the data content to an electronic file in a standardized textual format. Then, the computing platform may add an alert message to a message queue indicating that the electronic file is available for processing. Subsequently, the computing platform may cause one or more content processors to process the electronic file to identify a portion of the data content for review prior to transmission, and output a notification message to the message queue providing information related to the identified portion. Then, the computing platform may modify the data content, generate a link to the modified data content, and provide the generated link to the second enterprise computing device.

Abstract: Systems and methods include obtaining unused user accounts associated with a cloud application where an unused user account is one where a corresponding user has not accessed the cloud application in a certain period of time; determining a subset of the unused user accounts that are abnormal user accounts, wherein an abnormal user account is one that is anomalous compared to similar users; scoring and ranking the unused and abnormal user accounts; and remediating a set of the ranked unused and abnormal user accounts.

Abstract: Methods, systems, and media for detecting malicious activity from user devices are provided. In some embodiments, a method for detecting malicious activity from user devices is provided, the method comprising: receiving information indicating a requested connection to a destination by a first user device; adding the received information to information received from a plurality of user devices to generate aggregated connection information; determining that the requested connection to the destination by the first user device is part of an attack, wherein determining that the requested connection to the destination by the first user device is part of the attack on the destination comprises determining that more than a predetermined percentage of user devices have requested connections to the destination; receiving information indicating a requested connection to the destination by a second user device; and causing the connection to the destination by the second user device to be blocked.

Abstract: A method of detecting bots, preferably in an operating environment supported by a content delivery network (CDN) that comprises a shared infrastructure of distributed edge servers from which CDN customer content is delivered to requesting end users (clients). The method begins as clients interact with the edge servers. As such interactions occur, transaction data is collected. The transaction data is mined against a set of “primitive” or “compound” features sets to generate a database of information. In particular, preferably the database comprises one or more data structures, wherein a given data structure associates a feature value with its relative percentage occurrence across the collected transaction data. Thereafter, and upon receipt of a new transaction request, primitive or compound feature set data derived from the new transaction request are compared against the database. Based on the comparison, an end user client associated with the new transaction request is then characterized, e.g.

Abstract: A file integrity monitoring system supports monitoring of system-critical, enterprise-critical and user-critical data by reporting events to a threat management facility in response to changes in certain files, folders, registry keys and registry values of the computing environment in which the system is operating and/or monitoring. The file integrity monitoring system may dynamically create, adapt and apply context-based rules to improve the sensitivity and relevance of reported events to undesirable changes in the data footprint of a monitored device.

Abstract: Systems and methods for classifying malware based on the frequency of feature reuse are provided. The system can identify a malicious feature frequency, a benign feature frequency, and a first weight value. The system can generate a first reuse vector based on the malicious feature frequency and the benign feature frequency. The system can determine that a training binary associated with a known classification includes the first feature and a second feature, the second feature associated with a second reuse vector and a second weight value. The system can construct, responsive to the determination that the first binary includes the first feature and the second feature, a reuse tensor using the first reuse vector, the second reuse vector, the first weight value, and the second weight value. The system can train a malware classification model using the reuse tensor and the known classification associated with the training binary.

Abstract: Systems and methods for providing security services during a power management mode are disclosed. In some embodiments, a method comprises detecting with a mobile security system a wake event on a mobile device, providing from the mobile security system a wake signal, the providing being in response to the wake event to wake a mobile device from a power management mode, and managing with the mobile security system security services of the mobile device. Managing security services may comprise scanning a hard drive of the mobile devices for viruses and/or other malware. Managing security services may also comprise updating security applications or scanning the mobile device for unauthorized data.

Abstract: The present invention discloses a computer implemented method for developing an anomaly detector which is adapted to detect/predict anomaly in one or more network terminals and optimize the behavior of the network terminals. The said method is adapted to collect and monitor the behavior of the network terminals and compare it with the behavior profile of the network terminals in order to detect the anomaly parameter. The behavior profile is the normal interaction of the software and hardware components of the network terminals. A system for implementation and execution of such anomaly detector is also disclosed.