Abstract: Preserving web page functionality through dynamic analysis of host web pages. Web pages accessed by a user device may be monitored. The web browser may apply a blocking policy that blocks an external domain from loading functional content into the web page, which results in a breakage in the web page. The breakage in the web page may be identified through a dynamic analysis of the web page and correlated with the functional content from the blocked external domain. Once identified and correlated, the blocking policy may be modified to allow the external domain to load the functional content and reloading the web page.

Abstract: Methods and systems for efficient scaling of a domain name system (DNS) service architecture. In some embodiments a plurality of messaging servers may be separated into a number of pools. A plurality of client devices may be connected to a messaging server within a pool. When a notification is received for a target client device, a backend server may identify the pool that includes the messaging server that is connected to the target client device. The backend server may send the notification to the group of messaging servers within the identified pool while avoiding sending the notification to messaging servers within different pools.

Abstract: The disclosed computer-implemented method for dynamic formjacking protection may include identifying a sensitive data input field element on a webform loaded in a browser, creating a secure isolated container overlaid on the identified sensitive data input field element, and collecting, via the secure isolated container, real input data intended for the sensitive data input field element. The method may also include inserting dummy data into the sensitive data input field element and intercepting a form submit request from the webform to a destination. The method may further include determining whether the destination is a trusted destination, and when the destination is determined to be the trusted destination, modifying the form submit request to allow the real input data to be sent to the trusted destination. The method may also include sending the form submit request to the destination. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Distinguishing between functional tracking domains and nonfunctional tracking domains on a host web page. In particular, a list of known tracking domains that load content into host web pages may be received. This list of tracking domains may include tracking domains that are functional and tracking domains that are nonfunctional. The tracking domains that are functional may be determined by evaluating various behaviors and characteristics of the tracking domains. Once functional tracking domains have been determined, these functional tracking domains may be allowed, and other tracking domains may be blocked from loading content onto host web pages thereby preserving the functionality of the web pages.

Abstract: The disclosed computer-implemented method for managing privacy policy violations may include obtaining, by the computing device, an intermediate representation of a privacy policy, wherein the intermediate representation denotes a formal policy and is generated by extracting the privacy policy in natural language from a website and parsing the privacy policy. The method may also include comparing, by the computing device, behavior of the website against the intermediate representation, thereby detecting at least one violation of the formal policy. The method may further include enforcing, by the computing device, the formal policy at least in part by taking a security action in response to the violation. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for protecting sensitive data from being exposed in graph embedding vectors. In some embodiments, a method may include generating first graph embedding vectors from an original graph and generating a proxy graph from the first graph embedding vectors. The proxy graph may include a plurality of proxy nodes and proxy edges connecting the proxy nodes. The proxy nodes may include one or more attributes of the original nodes that are included in the first graph embedding vectors. Second graph embedding vectors may then be generated by encoding the proxy graph and a reconstructed graph may be generated from the second graph embedding vectors. Finally, the reconstructed graph may be compared to the original graph and if a threshold level of similarity is met, a security action may be performed to protect sensitive data from being exposed.

Abstract: Location-based anomaly detection based on geotagged digital photographs. In some embodiments, a method may include identifying a completed transaction associated with a user. The method may also include determining a transaction geographic location associated with the completed transaction. The method may further include identifying a mobile device associated with the user. The method may also include identifying one or more geotagged digital photographs taken by the mobile device. The method may further include extracting one or more photograph geographic locations from the one or more geotagged digital photographs. The method may also include, in response to determining that the transaction geographic location is not within a threshold distance of any of the one or more photograph geographic locations, identifying the completed transaction as a suspicious transaction and performing a remedial action.

Abstract: Assigning privacy ratings to tracking domains in order to increase user awareness of online privacy violations. A list of known tracking domains and raw data from a set of host websites may be received. A prevalence, frequency, and role for each tracking domain may be determined from the raw data. Each tracking domain may be assigned to a prevalence cluster, a frequency cluster, and a role cluster. A rank may be determined for each prevalence cluster, frequency cluster, and role cluster. A domain privacy rating may be assigned to each tracking domain that is based on the ranks of the clusters to which each tracking domain is assigned. A privacy action may be performed based on the domain privacy rating assigned to each tracking domain.

Abstract: The disclosed computer-implemented method for removing whitespace from blocked resources in websites may include identifying elements arranged in a hierarchy from a website at least partially loaded in a browser and identifying one or more whitespace candidates to be displayed as whitespace in the browser. The method may also include selecting an element relating to the one or more whitespace candidates based on the hierarchy and establishing a mutation observer for monitoring a change in the selected element. The method may further include modifying a display attribute of the selected element based on the monitoring by the mutation observer. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for protecting user privacy may include (i) receiving an indication to protect a photo with privacy-protecting blurring, (ii) generating a blurred version of the photo, (iii) generating, based on the blurred version of the photo, a video that progressively de-blurs the photo, (iv) linking through metadata the blurred version of the photo and the video that progressively de-blurs the photo as a combined motion-photo-object, and (v) storing the combined motion-photo-object in a configured location such that a photo display program uses the blurred version of the photo as a preview of the motion-photo-object when browsing but plays the video that progressively de-blurs the photo in response to additional user input selecting the preview. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for protecting data on devices may include (i) identifying a device that is operated by a user and that comprises private data pertaining to the user, (ii) determining that stalkerware on the device is sending the private data to an unauthorized device not operated by the user, (iii) requesting, in response to determining that the stalkerware is sending the private data to the unauthorized device, that the user select at least one safety plan step from a set of safety plan options, and (iv) modifying, at least in part based on the safety plan step selected by the user, outgoing data sent by the stalkerware to the unauthorized device. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for preventing social engineering attacks using distributed fact checking may include (i) capturing one or more words or tones received by a party to a communication, (ii) extracting speech features associated with the words or tones to identify one or more alleged facts in the communication, (iii) generating one or more queries to verify the alleged facts in the communication, (iv) determining, utilizing distributed fact checking, whether the alleged facts are true based on the queries, and (v) performing a security action that generates an alert to protect against a potential social engineering attack on the receiving party when at least one of the alleged facts are determined to be false. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for utilizing user identity notifications to protect against potential privacy attacks on mobile devices may include (i) monitoring a mobile computing device to detect one or more user interactions by a current user, (ii) identifying the current user of the mobile computing device, (iii) determining that the current user is a potentially malicious user associated with one or more privacy-invasive applications installed on the mobile computing device, and (iv) performing a security action that protects a benign user of the mobile computing device against an attack initiated by the potentially malicious user associated with the privacy-invasive applications. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for protecting customer payment data against malware attacks on inline frame payment forms may include (i) detecting a payment form in a payment page on an online merchant website (e.g., by monitoring the website for a user entry of payment information during a customer transaction session or by analyzing, in hypertext markup language associated with an inline frame (iframe), a document object model (DOM)) to identify the payment form, (ii) identifying the iframe on the online merchant website, (iii) determining whether the iframe is associated with a trusted domain utilized for processing the payment information to complete the customer transaction session, and (iv) performing a security action that protects against a potential malware attack by preventing completion of the customer transaction upon determining that the iframe is unassociated with the trusted domain. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for detecting coordinated propagation of social media content may include calculating, by a computing device, a content similarity score for each social media post in relation to other social media posts in a set of social media posts. The method may also include identifying a related subset of social media posts based on the content similarity score. Additionally, the method may include detecting one or more clusters of social media posts in the related subset by clustering social media posts based on content similarity scores and timing. Furthermore, the method may include determining that a user account associated with a social media post in a detected cluster is in a coordinated network of user accounts. Finally, the method may include performing a security action in response to determining that the user account is in the coordinated network. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for utilizing federated machine-learning to protect against potentially malicious data may include (i) arranging a set of client devices into groups for applying a federated machine-learning model, (ii) determining model updates for each of the groups over a predetermined period, (iii) training one or more recurrent neural networks to derive a low-dimensional representation of the model updates, (iv) calculating a data quality score for each of the client devices based on the model updates, (v) applying the federated machine-learning model to classify data instances on each of the client devices as including clean data or potentially corrupt data, and (vi) performing a security action that protects against the potentially malicious data by tagging the data instances classified as the potentially corrupt data. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Systems and methods for identifying and removing a tracking capability from an external domain that performs a tracking activity on a host web page. Tracking capabilities of an external domain may be removed by altering web requests and/or responses to API calls. Once these tracking capabilities of the external domain have been removed, the altered web requests and/or altered responses to API calls may be transmitted to a web browser and/or entity making the API call thereby protecting user privacy while allowing the external domain to interact with the host web page.

Abstract: The disclosed computer-implemented method for restricting capture of self-portrait images on mobile devices may include (i) capturing sensor data associated with a surrounding environment, (ii) detecting a user input for taking one or more self-portrait images, determining, based on the sensor data, one or more potential hazards associated with the taking of the self-portrait images within the surrounding environment, and (iv) performing a security action to protect against the potential hazards associated with the taking of the self-portrait images within the surrounding environment. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Protecting against a tracking parameter in a web link. In one embodiment, a method may include receiving an input URL during a browser navigation session on a user device, the input URL including parameters, determining that the parameters include a tracking parameter, pausing the browser navigation session on the user device, launching the input URL in a headless browser that operates in an isolated environment that simulates one or more features of the user device, landing on a destination web page in the isolated environment, identifying a URL of the destination web page as a destination URL, and resuming the browser navigation session on the user device by replacing the input URL, which includes the tracking parameter, with the destination URL, which does not include the tracking parameter, in order to protect the user device from the tracking parameter.

Abstract: Using physiological cues to measure data sensitivity and implement security on a user device. The method may include obtaining data associated with a first physiological state of a user engaged in a first activity on a user device, obtaining data associated with a second physiological state of the user engaged in a second activity on the user device, where the second activity is determined to be more sensitive to the user than the first activity, and where the second physiological state indicates the user's emotional response to the second activity, and implementing a security action on the user device based on the second physiological state of the user engaged in the second activity.