Abstract: A system for performing a computer-implemented method for preventing malicious network activity is provided. The method includes detecting a first click operation on a first window corresponding to a first uniform resource locator (“URL”), the first window displayed on a graphical user interface (“GUI”) of a computing system. A time of the first click operation is determined. A second click operation is detected on a second window corresponding to a second URL, the second window displayed on the GUI. A time of the second click operation on the second window is detected. The second click operation on the second window is blocked based on the time of the first click operation and the time of the second click operation.

Abstract: A computer-implemented method for password recovery within an untrusted environment may include (i) deconstructing an encryption key associated with accessing a password for a target user into key components, (ii) distributing the key components to a random subset of users associated with a password manager service, (iii) authenticating recovery signal data associated with a request to recover the target user password, (iv) publishing password recovery data to a recovery signal ledger in response to the request to recover the target user password, and (v) performing a security action that utilizes the password recovery data in the recovery signal ledger to send the key components from the random subset of users to the target user for reconstructing the encryption key. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for accessing a network resource including detecting an attempt by a user via a computing device to access a service enabled by a computing system via a network and transmitting via the network to the computing system a first request to access the service in response to detecting the attempt by the user to access the service, the first request including at least one empty personally identifiable data structure. A failure to access the service responsive to the first request is determined. A second request to access the service in response to the first failure to access the service is transmitted via the network to the computing system, the second request including artificial personally identifiable information, and access to the service from the computing system is received for the user.

Abstract: A system and method of controlling access to a webpage is provided. A plurality of webpages are crawled respectively at a plurality of network addresses on a network. A plurality of images of the plurality of webpages are captured. A plurality of identifiers are determined based on the plurality of images and the plurality of network addresses. A particular webpage at a particular network address is detected, and it is determined that the particular webpage includes a mechanism for user data extraction. A particular image of the particular webpage is captured responsive to the determining that the particular webpage includes the mechanism for user data extraction. A particular identifier is determined based on the particular image and the particular network address. The particular identifier is compared to the plurality of identifiers, and access by a particular computing device to the particular webpage is controlled based on the comparing.

Abstract: The disclosed computer-implemented method for utilizing user profile data to protect against phishing attacks may include (i) detecting a target user profile associated services accessed by a network-based application, (ii) determining identifiers associated with each of the services, (iii) extracting, for each of the identifiers, feature vectors describing exploitable screen elements in the network-based application associated with phishing attacks, (iv) updating, based on the feature vectors, previously extracted feature vectors in a data repository storing additional profiles for other users associated with the services, (v) predicting, utilizing a machine-learning model, phishing attack threats for target profile user based on a similarity with the additional profiles, and (vi) performing a security action that protects against the phishing attack threats. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for training a smart security assistant to create a dialogue tree leading to solutions to security problems may include (i) detecting a request for performing a security task, (ii) identifying potential security threats associated with the request, and (iii) performing a security action that matches a solution to the potential security threats. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Systems and methods provide context-aware password strength evaluation. In an embodiment, a method includes receiving a user password, wherein the user password is associated with at least one of a newly created password, an updated password, or an existing password to be analyzed; parsing the user password into one or more segments; determining, for each segment, discoverability measures relative to personal information associated with the user, wherein the personal information includes at least one of publicly available data or non-public data; calculating a context-aware password strength rating based on the discoverability measures of the one or more segments; and providing feedback to the user regarding the context-aware password strength rating.

Abstract: A generative artificial intelligence (GenAI) driven education platform provides personalized learning experiences by leveraging large language models (LLMs) and secure data storage. The platform refines training objectives, generates context-aware scenarios, and adjusts difficulty based on user performance. User data—such as past performance, roles, and preferences—remains on-premises for privacy, supporting dynamic content adaptation without exposing sensitive information to external servers. Contextual materials, including news articles or internal documents, enhance scenario realism. Real-time feedback pinpoints knowledge gaps, while iterative updates to test cases continually evolve training modules. Applications include phishing simulations, compliance training, professional exam preparation, and more. Interactive components, such as multimedia quizzes and immersive simulations, are rendered through a customizable interface.

Abstract: A method of identifying malicious activity in a sequence of computer instructions includes providing the sequence of computer instructions into a recurrent neural network configured to provide an output based on both the current instruction being input and at least one prior instruction in the sequence, and evaluating the provided sequence of computer instructions in the recurrent neural network at multiple points within the sequence. An output is provided indicating whether the network has determined the code sequence to that point is likely malicious.

Abstract: A third-party attempting to call a user is identified and authenticated by collecting multi-dimensional user data and user activity into a personalized large language model (LLM) residing on a user device. A general-purpose LLM generates third-party authentication questions based on an initial intent of the caller and the questions are provided to the personalized LLM with the answers from the personalized LLM ranked based on relevancy and accuracy. One or more of the highest ranked questions are prompted to the caller and the answers provided by the caller are compared to the answers provided by the personalized LLM to determine if the caller is a trusted contact or a likely malicious third-party.

Abstract: Differentiating between human interaction and computer interaction using a natural perception of human eyes to identify human users. One or more images may be displayed within one or more test fields on a web page. The one or more images themselves, or a duration for which they are presented, may cause a human eye to not see something that is in the images or to see something that is not in the images. Input may be received from the user identifying all images that are perceived by the user. A determination may be made that the user is a human user based on what the user identifies. Access to another web page may be granted to users who are determined to be human and denied to users that are not determined to be human.

Abstract: In one embodiment, a method may include receiving a first input query from a client device, generating a first set of related queries based on the first input query, executing a search to generate a first response to the first input query, storing the first response, the first input query, and the first set of related queries in a cache such that the first response is associated with the first input query and the first set of related queries, and providing, in response to receiving the first input query, the first response to the client device.

Abstract: A computer user is authenticated by collecting user data from at least two dimensions of user activity into a local large language model (LLM) residing on a user device, and generating user authentication questions from at least those two dimensions of user activity using the large language model. Questions having intersecting time or location are discarded, and questions from two or more dimensions are presented to the user for response. The user is authenticated by comparing the user response to known correct answers to the questions.

Abstract: Obfuscation techniques used in phishing attacks that evade detection using current machine learning models can be identified and statistically characterized for use in generating adversarial training samples to improve the performance of a machine learning model phishing classifier. By using statistical information regarding the prevalence and effectiveness of various obfuscation techniques observed in real-world samples, adversarial samples that are effective and realistic examples of phishing content that evades phishing content classifier detection can be generated and used to augment the data set used for training or re-training the machine learning model classifier.

Abstract: A method for accessing a network resource including detecting an attempt by a user via a computing device to access a service enabled by a computing system via a network and transmitting via the network to the computing system a first request to access the service in response to detecting the attempt by the user to access the service, the first request including at least one empty personally identifiable data structure. A failure to access the service responsive to the first request is determined. A second request to access the service in response to the first failure to access the service is transmitted via the network to the computing system, the second request including artificial personally identifiable information, and access to the service from the computing system is received for the user.

Abstract: Systems and methods for transacting over a network. A first agent and a second agent are provided. The second agent is operable to transact with a third agent for use of a network-enabled service based on a first transaction policy from a fourth agent, the third agent enabled to communicate with a fifth agent. The first agent is operable to communicate with the second agent to facilitate the transacting by the second agent with the third agent for the use of the network-enabled service based on the first transaction policy and communicate with the fifth agent to facilitate the transacting by the second agent with the third agent for the use of the network-enabled service.

Abstract: Systems and methods for classifying user intent based on the user interaction with an entry bar on a user device include receiving an input from a user in an entry box; classifying the input into a category of a plurality of categories including a category for an Artificial Intelligence (AI) session for an AI agent; and performing an action responsive to the classified category, including utilizing the AI agent for the AI session when the category is the category for the AI session and bypassing the AI agent for other categories of the plurality of categories.

Abstract: A malware classification system provides improved confidence in explanations of neural network classification outputs using methods such as weighting or masking when training the neural network to train the network on a sample resembling or including the explanation. The explanation in some examples comprises a subset of a hierarchical input vector that is responsible for the neural network's classification output. In another example the neural network has an inner portion configured to reduce the weight of elements of the output not significantly contributing to the explanation of the output, such as by reducing the weight of as many such outputs to zero as is practical in generating the desired output.

Abstract: A method and system detects at a plurality of network locations a plurality of accuracy ratings of a plurality of media instances and detects the plurality of media instances. A particular accuracy rating of one or more particular media instances is detected at a particular network location, and the one or more particular media instances are detected. A bias of the particular accuracy rating is determined based on the particular accuracy rating, the one or more particular media instances, the plurality of accuracy ratings, and the plurality of media instances. An indication is transmitted to a user based on the bias of the particular accuracy rating.

Abstract: Systems and methods for in-transit email review and data collection. In one embodiment, a method may include receiving a plurality of original emails at an alias email address. The alias email address may be associated with a user. Once a plurality of original emails are received at the alias email address, the method may include analyzing the plurality of original emails to identify relevant data contained within the plurality of original emails, and storing a copy of the identified relevant data in a database that is accessible by the user.