Abstract: Responsive to the Application Programming Interface (API) consumption request, a security posture tag for to the specific API is calculated by a Zero Trust API Access (ZTAA) server and/or one or more agents running as daemons on one or more API network resources. The daemons can test the API network resources with API calls to generate initial security posture tags. Then the initial security posture tags are dynamically updated responsive to changes on the API network resources. API security rules relevant to the security posture tag of the API. Consumption of the API for allowed or denied per the API consumption request, according to the API consumption rate in view of API security rules associated with the API.

Abstract: Systems, devices, and methods are disclosed in relation to a vector space model that may be used to characterize a category of messages. In one of many possible implementations, the frequency of words found within a piece of text is determined. These frequencies are compared against the frequencies of words within a given corpus like the Oxford English Corpus by first converting the frequencies to probabilities via the inverse cumulative distribution function assuming a normal distribution of frequencies then via taking the absolute difference in frequencies. A small difference reduces the weight of the given word whereas a large weight increases the weight of the word, leading to excellent word ranking for automated feature selection filtering without the need for a negative corpus.

Abstract: A computer-implemented method includes identifying features including access point (AP) parameters and client device parameters that indicate a network health of a network of one or more access points (AP) and client devices, performing feature goodness classification (FGC) to classify each identified feature independently, computing cumulative scores periodically as a weighted sum of normalized values of each feature, determining if a network problem is identified based on the cumulative scores, and implementing a correlation model with supervised machine learning to determine correlation criteria and remediation actions based on features contributing to an identified network problem. The computer-implemented method may also implement a reinforcement learning (RL) based remediation model to rank intersection regions for correlation criteria based on rewards.

Abstract: A system is disclosed. The system includes one or more processing resources and a memory device, coupled to the one or more processing resource, having stored therein instructions that when executed by the processing resource cause the processing resources to detect a driver loading for execution, determine whether current baseline flag and callback values match baseline flag and callback values, load a driver image upon a determination that the current baseline values match the baseline values and validate the driver image.

Abstract: Detecting anomalous behavior using a browser extension, including: gathering first information describing activity associated with a user and generated by a browser extension on a user device; gathering second information describing activity associated with the user and generated by an application executed on the user device; and determining, based on the first information and the second information, whether the user has deviated from normal activity.

Abstract: Identifying anomalous behavior of end users or end user devices, including: detecting that a device associated with a user is located at a known location for the user, wherein the device is associated with a plurality of known locations for the user; determining device activity for the device; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user when the user is at the known location.

Abstract: An illustrative method includes determining a severity of an anomaly associated with one or more compute assets within a particular compute environment and associated with a particular customer, accessing a plurality of customer datasets collected from a plurality of compute environments associated with a plurality of customers, each compute environment associated with a different customer included in the plurality of customers, and adjusting, based on the plurality of customer datasets, the severity of the anomaly with respect to the particular compute environment.

Abstract: Providing immediate access to vulnerable resources identified by a deployment monitoring tool, including: identifying, in a deployment monitored by a security framework, a security issue associated with one or more resources in the deployment; identifying, based on ancestry information associated with the one or more resources, a portion of code that enables the security issue; and generating an alert indicating the portion of code that enabled the security issue.

Abstract: Deploying a security framework using temporary authorization credentials, including: receiving a request to deploy a security framework in a cloud environment; requesting, from a user, authorization with a cloud service provider of the cloud environment to modify the cloud environment; receiving temporary authorization credentials allowing modification of the cloud environment; and deploying the security framework in the cloud environment using the temporary authorization credentials.

Abstract: Described herein is a data carrier storing program code for causing one or more processors of a data processing system to perform the following steps, the processor(s) having access to multiple criteria, each criterion being associated with an event having a reporting priority: establish a software entity at the data processing system configured to act as a local monitoring entity for the data processing system; monitor the data processing system using the local monitoring entity; raise an event based on the monitoring of the data processing system in dependence on one or more criteria; and in dependence on the event having been raised, assign a heightened reporting priority to one or more other events, the one or more other events being raised in dependence on one or more other criteria.

Abstract: A data platform monitors a compute environment. For example, the data platform receives, from an agent operating in the environment, process data for a process in the environment, where the process data for the process is collected by the agent in response to the agent detecting an initiation of a network connection in the environment and determining that the process is associated with the network connection. The data platform performs an analysis on a combination of the process data received from the agent and additional data. The performance of the analysis may include generating a polygraph representing activities in the environment and/or detecting an anomaly in the environment.

Abstract: Leveraging generative artificial intelligence (AI) to prevent data exfiltration, including: monitoring network activity of a device; and determining, based on at least one generative artificial intelligence (AI) model, whether the network activity indicates a data exfiltration.

Abstract: Various embodiments provide systems and methods for reordering processed network traffic.

Abstract: A change of a user device from a wireless connection to the enterprise network to a wired connection to the enterprise network (or a cellular network) is detected. In response, a snapshot of network conditions relevant to the user device are detected. A health check on the network conditions can identify specific network issues negatively affecting the user device and the issues are remediated. A remediation model is generated with AI that a different user change will occur based on a later health check revealing similar network conditions to the earlier health check. In response, the issues are automatically remediating the specific network issues based on the earlier stored remediation the earlier.

Abstract: Secure mode is enabled on a secured port of a plurality of ports of the switch automatically provisions new access point in cooperation with a Wi-Fi controller. An access point profile is received from the Wi-Fi controller and forwarded to the new access point. The access point profile assigns VLAN IDs for the one or more VLANs to service set identifiers (SSIDs). Subsequent data traffic received from the new access point is forwarded according to a VLAN ID. A management access points automatically provisions VLAN configurations upstream to the switch and the Wi-Fi controller.

Abstract: Firewall statistics for a specific user are analyzed to determine security risk from browsing history and match a set of pre-defined phishing templates to the security risk determinations. A set of customized phishing templates is generated using AI, using a set of pre-defined phishing templates for individual websites is customized for individual users of the plurality of users. A resulting phishing campaign is deployed with simulations using phishing templates and collect user responses to the phishing campaign.

Abstract: Responsive to enabling the split traffic mode, a software-based switch is configured to split layer-2 data traffic between an aggregation link communicatively coupled to the WAN over the secure tunnel and layer 3 NAT communicatively coupled directly to the WAN. Responsive to a service type classification of data traffic matching at least one of the one or more split service types, the secure tunnel is bypassed for the session with the remote destination by switching to the layer 3 NAT for direct transmission to the WAN. Responsive to the service type classification not matching at least one of the one or more split service types, default mode is continued by switching to the aggregation link for transmission to the WAN through the remote firewall.

Abstract: An MPSK mode is enabled for an SSID assigned WPA3 capability for the Wi-Fi network. During connection, MAC binding to the specific WPA3 station is configured to provide a unique PSK, including adding the MAC address and the PSK to an MPSK table. A station type of the specific WPA3 station is detected and a VLAN of a plurality of VLANs is assigned based the station type. In turn, the VLAN applies a security policy specific to the station type.

Abstract: Leveraging a generative artificial intelligence (‘AI’) application to proactively prevent misconfigurations, including: receiving a request to change a cloud deployment; retrieving, based on the change, information describing a state of the cloud deployment; and generating, based on the information describing a state of the cloud deployment, one or more messages about the change.

Abstract: A scan request for a domain includes at least some dynamic pages that are no longer available on a front end of a web host. Responsive to not being available on the front end of the web host, a list of URLs is retrieved from an archive server that stores snapshots of the dynamic pages from when they were available on the front of the web host. The list of retrieved URLs is examined, with a back end of the web host, for vulnerabilities. Responsive to identifying at least one vulnerability on at least one of the dynamic pages, a security action is taken with respect to the at least one dynamic page.