Abstract: The disclosed computer-implemented method for protecting user data privacy against the use of fake first-party domains by hidden web trackers may include (i) identifying a group of subdomains associated with one or more websites, (ii) comparing an Internet Protocol (IP) address range for each of the subdomains, (iii) determining, based on the comparison, that an IP address range for a target subdomain is potentially utilized by a hidden web tracker as a fake first-party subdomain in the websites, (iv) detecting similarities between any scripts loaded by websites associated with the target subdomain and any functions performed by the scripts, and (v) perform a security action that protects against utilizing fake domains for evading web browser tracking protection by identifying the target subdomain as the fake first-party subdomain based on the detected similarities. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Systems and methods for protecting against an estimated level of online tracking are disclosed. In one embodiment, a method may include collecting data relating to a plurality of known users. This first data may include browser histories and a level of online tracking for each known user. The known users may be organized into clusters and second data relating to an unknown user may be received. The second data may include an identification of one or more categories of websites that the unknown user visits, and one or more websites within each of the one or more categories of websites that the unknown user visits. A matching cluster for the unknown user may be identified and levels of online tracking for similar known users within the matching cluster may be used to estimate a level of online tracking for the unknown user.

Abstract: Preserving web page functionality through dynamic analysis of host web pages. Web pages accessed by a user device may be monitored. The web browser may apply a blocking policy that blocks an external domain from loading functional content into the web page, which results in a breakage in the web page. The breakage in the web page may be identified through a dynamic analysis of the web page and correlated with the functional content from the blocked external domain. Once identified and correlated, the blocking policy may be modified to allow the external domain to load the functional content and reloading the web page.

Abstract: Methods and systems for efficient scaling of a domain name system (DNS) service architecture. In some embodiments a plurality of messaging servers may be separated into a number of pools. A plurality of client devices may be connected to a messaging server within a pool. When a notification is received for a target client device, a backend server may identify the pool that includes the messaging server that is connected to the target client device. The backend server may send the notification to the group of messaging servers within the identified pool while avoiding sending the notification to messaging servers within different pools.

Abstract: Distinguishing between functional tracking domains and nonfunctional tracking domains on a host web page. In particular, a list of known tracking domains that load content into host web pages may be received. This list of tracking domains may include tracking domains that are functional and tracking domains that are nonfunctional. The tracking domains that are functional may be determined by evaluating various behaviors and characteristics of the tracking domains. Once functional tracking domains have been determined, these functional tracking domains may be allowed, and other tracking domains may be blocked from loading content onto host web pages thereby preserving the functionality of the web pages.

Abstract: The disclosed computer-implemented method for dynamic formjacking protection may include identifying a sensitive data input field element on a webform loaded in a browser, creating a secure isolated container overlaid on the identified sensitive data input field element, and collecting, via the secure isolated container, real input data intended for the sensitive data input field element. The method may also include inserting dummy data into the sensitive data input field element and intercepting a form submit request from the webform to a destination. The method may further include determining whether the destination is a trusted destination, and when the destination is determined to be the trusted destination, modifying the form submit request to allow the real input data to be sent to the trusted destination. The method may also include sending the form submit request to the destination. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for managing privacy policy violations may include obtaining, by the computing device, an intermediate representation of a privacy policy, wherein the intermediate representation denotes a formal policy and is generated by extracting the privacy policy in natural language from a website and parsing the privacy policy. The method may also include comparing, by the computing device, behavior of the website against the intermediate representation, thereby detecting at least one violation of the formal policy. The method may further include enforcing, by the computing device, the formal policy at least in part by taking a security action in response to the violation. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for protecting sensitive data from being exposed in graph embedding vectors. In some embodiments, a method may include generating first graph embedding vectors from an original graph and generating a proxy graph from the first graph embedding vectors. The proxy graph may include a plurality of proxy nodes and proxy edges connecting the proxy nodes. The proxy nodes may include one or more attributes of the original nodes that are included in the first graph embedding vectors. Second graph embedding vectors may then be generated by encoding the proxy graph and a reconstructed graph may be generated from the second graph embedding vectors. Finally, the reconstructed graph may be compared to the original graph and if a threshold level of similarity is met, a security action may be performed to protect sensitive data from being exposed.

Abstract: Location-based anomaly detection based on geotagged digital photographs. In some embodiments, a method may include identifying a completed transaction associated with a user. The method may also include determining a transaction geographic location associated with the completed transaction. The method may further include identifying a mobile device associated with the user. The method may also include identifying one or more geotagged digital photographs taken by the mobile device. The method may further include extracting one or more photograph geographic locations from the one or more geotagged digital photographs. The method may also include, in response to determining that the transaction geographic location is not within a threshold distance of any of the one or more photograph geographic locations, identifying the completed transaction as a suspicious transaction and performing a remedial action.

Abstract: Security functions for a memory corresponding to a smart security storage may be facilitated or executed through operation of utility application corresponding to a smart device. For example, encryption/decryption of data stored on the memory may be facilitated or executed by a security module under control of an access application corresponding to the smart device. Data securely stored on the memory may be explored and accessed by the smart device or a host computing device under control of the access application.

Abstract: A gateway server and methods operating as a web service providing a self-serve methodology for establishing a domain name registry over a communications network, comprising: receiving a request from the computing device to establish the domain name registry of a specified type; determining the specified type requires ICANN approval and receiving access credentials of the RO; confirming completion of a Registry Agreement between ICANN and the RO; collecting registry technical information for the domain name registry from the computing device; using the access credentials to access via the communications network the RO account on the server during a registry testing phase of the self-serve methodology to complete registry services testing for the domain name registry with ICANN; and updating a workflow interface with a completion status of the registry testing phase for subsequent access by the computing device of the RO over the communications network.

Abstract: Assigning privacy ratings to tracking domains in order to increase user awareness of online privacy violations. A list of known tracking domains and raw data from a set of host websites may be received. A prevalence, frequency, and role for each tracking domain may be determined from the raw data. Each tracking domain may be assigned to a prevalence cluster, a frequency cluster, and a role cluster. A rank may be determined for each prevalence cluster, frequency cluster, and role cluster. A domain privacy rating may be assigned to each tracking domain that is based on the ranks of the clusters to which each tracking domain is assigned. A privacy action may be performed based on the domain privacy rating assigned to each tracking domain.

Abstract: The disclosed computer-implemented method for removing whitespace from blocked resources in websites may include identifying elements arranged in a hierarchy from a website at least partially loaded in a browser and identifying one or more whitespace candidates to be displayed as whitespace in the browser. The method may also include selecting an element relating to the one or more whitespace candidates based on the hierarchy and establishing a mutation observer for monitoring a change in the selected element. The method may further include modifying a display attribute of the selected element based on the monitoring by the mutation observer. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for protecting user privacy may include (i) receiving an indication to protect a photo with privacy-protecting blurring, (ii) generating a blurred version of the photo, (iii) generating, based on the blurred version of the photo, a video that progressively de-blurs the photo, (iv) linking through metadata the blurred version of the photo and the video that progressively de-blurs the photo as a combined motion-photo-object, and (v) storing the combined motion-photo-object in a configured location such that a photo display program uses the blurred version of the photo as a preview of the motion-photo-object when browsing but plays the video that progressively de-blurs the photo in response to additional user input selecting the preview. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for protecting data on devices may include (i) identifying a device that is operated by a user and that comprises private data pertaining to the user, (ii) determining that stalkerware on the device is sending the private data to an unauthorized device not operated by the user, (iii) requesting, in response to determining that the stalkerware is sending the private data to the unauthorized device, that the user select at least one safety plan step from a set of safety plan options, and (iv) modifying, at least in part based on the safety plan step selected by the user, outgoing data sent by the stalkerware to the unauthorized device. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for preventing social engineering attacks using distributed fact checking may include (i) capturing one or more words or tones received by a party to a communication, (ii) extracting speech features associated with the words or tones to identify one or more alleged facts in the communication, (iii) generating one or more queries to verify the alleged facts in the communication, (iv) determining, utilizing distributed fact checking, whether the alleged facts are true based on the queries, and (v) performing a security action that generates an alert to protect against a potential social engineering attack on the receiving party when at least one of the alleged facts are determined to be false. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for protecting customer payment data against malware attacks on inline frame payment forms may include (i) detecting a payment form in a payment page on an online merchant website (e.g., by monitoring the website for a user entry of payment information during a customer transaction session or by analyzing, in hypertext markup language associated with an inline frame (iframe), a document object model (DOM)) to identify the payment form, (ii) identifying the iframe on the online merchant website, (iii) determining whether the iframe is associated with a trusted domain utilized for processing the payment information to complete the customer transaction session, and (iv) performing a security action that protects against a potential malware attack by preventing completion of the customer transaction upon determining that the iframe is unassociated with the trusted domain. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for utilizing user identity notifications to protect against potential privacy attacks on mobile devices may include (i) monitoring a mobile computing device to detect one or more user interactions by a current user, (ii) identifying the current user of the mobile computing device, (iii) determining that the current user is a potentially malicious user associated with one or more privacy-invasive applications installed on the mobile computing device, and (iv) performing a security action that protects a benign user of the mobile computing device against an attack initiated by the potentially malicious user associated with the privacy-invasive applications. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for detecting coordinated propagation of social media content may include calculating, by a computing device, a content similarity score for each social media post in relation to other social media posts in a set of social media posts. The method may also include identifying a related subset of social media posts based on the content similarity score. Additionally, the method may include detecting one or more clusters of social media posts in the related subset by clustering social media posts based on content similarity scores and timing. Furthermore, the method may include determining that a user account associated with a social media post in a detected cluster is in a coordinated network of user accounts. Finally, the method may include performing a security action in response to determining that the user account is in the coordinated network. Various other methods, systems, and computer-readable media are also disclosed.