Abstract: The disclosed computer-implemented method for preventing potential phishing attacks by translating double-byte character set domain name system records may include (i) extracting a domain extension from a double-byte character set (DBCS) domain name in a universal resource locator (URL) received by a computing device, (ii) identifying a locale code associated with a language utilized on the computing device, (iii) determining if the domain extension matches the locale code, (iv) translating the DBCS domain name to a corresponding single byte character set (SBCS) domain name system (DNS) record when the domain extension matches the locale code, and (v) performing a security action that protects against a potential phishing attack based on the translated DBCS domain name. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for selectively monitoring devices may include (i) identifying a set of characteristics of a device-usage session of a device, (ii) calculating, based on the set of characteristics, a privacy score for the device-usage session, (iii) selecting, for the device, a device monitoring profile that is correlated with the privacy score and that defines an intensity level of monitoring actions to be performed on the device, and (iv) monitoring activity performed on the device during the device-usage session in accordance with the device monitoring profile that is correlated with the privacy score for the device-usage session. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Detecting malware by linking Background Intelligent Transfer Service (BITS) and Scheduled Task Service (STS) activities to a source program. Using send Advanced Local Procedure Call (ALPC) messages and receive ALPC messages, source programs that initiate the creation of temporary files and perform defined operations may be identified. If the source programs responsible for the temporary files and defined operations are determined to be malware programs, a security action may be performed on the source programs.

Abstract: The disclosed computer-implemented method for securing authentication procedures includes (i) monitoring, by a third-party security application, to detect reception of a second factor authentication token as an input to complete a second factor authentication procedure in connection with a second application that is independent from the third-party security application, (ii) verifying, by the third-party security application, whether or not the second factor authentication token was transmitted by a valid server in coordination with the second application as part of an authentic version of the second factor authentication procedure, and (iii) performing a security action to protect a user account based on a result of verifying whether or not the second factor authentication token was transmitted by the valid server in coordination with the second application as part of the authentic version of the second factor authentication procedure.

Abstract: The disclosed computer-implemented method for protecting user data privacy against web tracking during browsing sessions may include (i) detecting a user request, including a private domain, for a website in a web browser address bar during a browsing session, (ii) separating, utilizing a browser container, a user browsing state associated with the private domain from other domains during the browsing session, (iii) routing the user website request to one or more servers in a random order to run the browsing session, (iv) performing a browsing state security action that protects against cross-website tracking by discarding user browsing state data collected during the browsing session, and (v) performing a web isolation security action that protects against use of browser fingerprint data for conducting malicious attacks based on the routing of the user website request to the servers in the random order. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for managing digital personas for online services may include generating a digital persona and a persona wear indicator (PWI) score for a user of an anonymized inbox with a communication alias to use for an online entity, determining, based on one or more communication messages associated with the communication alias, that the online entity has leaked information associated with the digital persona, recalculating the PWI score for the digital persona based at least in part on the determination that the online entity has leaked the information, determining that the PWI score exceeds a privacy score threshold; and in response to determining that the PWI score exceeds the privacy score threshold, performing a security action that protects privacy of the user. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for protecting search privacy may include (i) receiving, via a search interface, a search query comprising at least one search term, (ii) determining a sensitivity level of the search query based on the at least one search term, (iii) directing the search query to a search engine that has a level of privacy correlated with the sensitivity level of the search query, and (iv) returning, via the search interface, at least one result of directing the search query to the search engine that has the level of privacy correlated with the sensitivity level of the search query. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for authenticating application points of entry to prevent unauthorized use of locked mobile applications may include (i) identifying one or more mobile applications having an access restriction and a group of application entry points associated with at least one mobile application function, (ii) intercepting a series of device inputs from a user for accessing the application entry points to bypass the access restriction for the mobile applications, (iii) requesting authentication credentials to bypass the access restriction from the application entry points, (iv) determining that the requested authentication credentials are invalid, and (v) performing a security action that protects against potentially malicious activity associated with unauthorized access to the mobile applications upon determining that the requested authentication credentials are invalid. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for protecting against misleading clicks on websites may include (i) detecting a user click event on a uniform resource locator (URL) for navigating to a website during a web browsing session, (ii) analyzing the user click event to identify expected domain behavior associated with navigating to the website based on the URL, (iii) determining, based on the analysis, that the user click event deviates from the expected domain behavior associated with navigating to the website based on the URL, and (iv) performing a security action that protects against potentially malicious activity caused by the user click event deviating from the expected domain behavior associated with navigating to the website based on the URL. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for detecting inter-personal attack applications may include (i) receiving application marketplace information describing application feature information, (ii) creating, by performing natural language processing on the feature information, a feature vector identifying a potentially malicious functionality of the application, (iii) creating a profiling vector that is a categorical feature representation of installation information from an application installation file, and (iv) performing a security action including (A) mapping, using a machine learning model, the feature vector and the profiling vector to a multi-dimensional output vector having element corresponding to a malware category and (B) determining a malicious extent of the application by combining the categories identified by the multi-dimensional output vector with bi-partite graph information identifying (I) relations between a plurality of applications and (II) relations between a plurality of computing

Abstract: The disclosed computer-implemented method for proactive call spam/scam protection may include intercepting network traffic by the at least one processor employing a network extension feature of an operating system of a computing device. The method may additionally include capturing, by the at least one processor employing the network extension feature, a phone number in the network traffic. The method may also include comparing, by the at least one processor employing the network extension feature, the phone number to a plurality of entries in a spam/scam repository. The method may further include performing, by the at least one processor, a security action in response to the comparison. Various other methods, systems, and computer-readable media are also disclosed.