Abstract: There is disclosed a computer-implemented system and method for categorizing unclassified websites, including computing a data sketch of an unclassified website, wherein the data sketch is a probabilistic data structure that represents text of the unclassified website; computing an intersection value between the data sketch and a comparison set, wherein the comparison set comprises data sketches of known, classified websites; assigning matches for a subset of websites from the comparison set, wherein the subset includes intersections above an intersection threshold; classifying the website into a category of a website from the subset; and performing web traffic management based on the classification.

Abstract: There is described herein a computer-implemented system and method for providing domain name system (DNS) over hypertext transfer protocol secure (HTTPS) (DoH) resolution for a domain, including forming a DoH query for an entity, comprising inserting an entity access token into a uniform resource identifier (URI) template; sending the DoH query to a DoH service; resolving the DoH query, comprising using the entity access token to determine an entity context policy for the DoH query; and returning a DoH response that enacts the entity context policy.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed to translate hash-based signature signals for machine learning applications. In one example, the apparatus includes a processor to execute instructions to determine an element count for a plurality of hash elements of a locality sensitivity hash, preserve ones of hash elements of the plurality of hash elements that satisfy an element count threshold, and produce a cluster of encoded feature vectors of the preserved ones of the hash elements. The processor further to execute instructions to determine an occurrence frequency of hash elements in the cluster and create a synthetic hash of the cluster based on a subset of the hash elements in the cluster that satisfy an occurrence frequency threshold.

Abstract: There is disclosed a computer-implemented system and method of classifying a target sample, wherein the target sample is a computer object having a feature vector, the method comprising: creating n sorted containers, comprising sorting a universe of samples based on feature vector distances from the samples to n vantage points, wherein n is a positive integer; storing the n sorted containers to a computer memory; bucketizing the n sorted containers; for the n vantage points, selecting, from the n bucketized sorted containers, n meta-buckets of that the target sample belongs to; creating an intersection container, comprising samples that appear in all n meta-buckets; selecting, as a target cluster, samples from the intersection container that have a feature vector distance from the target sample less than a threshold; and acting on the target cluster.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed for suppression of false positive malware detection. An example apparatus includes at least one memory, machine-readable instructions, and processor circuitry to at least one of instantiate or execute the machine-readable instructions to execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output. The processor circuitry is further to, identify, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature invoking a false positive suppression rule. Additionally, the processor circuitry is to cause execution of the executable file based on the identification of the malware detection.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a network interface; a userspace application store including a plurality of userspace applications, wherein at least some of the userspace applications are programmed to communicate via the network interface; and instructions encoded within the memory to: enumerate social connections of a user via the userspace applications; assign the social connections to virtual groups according, at least in part, to correlated connection services; assign data transfer policies to the virtual groups; detect an attempted data transfer to a social connection; and enforce the data transfer policy for a virtual group of the social connection of the attempted data transfer.

Abstract: Systems, apparatus, articles of manufacture, and methods are disclosed. An example apparatus includes interface circuitry; machine readable instructions; and programmable circuitry to at least one of instantiate or execute the machine readable instructions to: remove content data from a file corresponding to a first webpage, the file to include structure determiners after the removal of the content data; normalize data within the structure determiners; group the normalized structure determiners into tiles; compute a first output of a hashing algorithm using the tiles; and compare the first output to a second output of the hashing algorithm to generate a similarity value, the second output corresponding to a second webpage, the similarity value representing a structural similarity between the first webpage and the second webpage.

Abstract: There is disclosed a computer-implemented method of assigning reputations to objects, including: for respective samples in a dataset, extracting n features from a sample into a feature vector, where n is an integer greater than 1; assigning the sample a globally unique or pseudo-unique identifier (GUID); according to a clustering algorithm, mapping the feature vector into an n-dimensional space and computing distances between the sample and other samples in the n-dimensional space; assigning groups of objects to clusters according to their distances in the n-dimensional space; correlating the clusters to cluster tags based on the GUIDs of the samples, wherein the cluster tags are stored in a persistent cluster tag storage; and assigning the sample a reputation based on reputations of other samples in a cluster that the sample clustered with.

Abstract: Disclosed examples include obtaining malicious neighbor samples based on a non-classified sample; obtaining clean neighbor samples based on the non-classified sample; generating a malicious proximity vector representing first distances between the non-classified sample and a first malicious neighbor sample from the malicious neighbor samples; generating a clean proximity vector representing second distances between the non-classified sample and a first clean neighbor sample from the clean neighbor samples; and classifying the non-classified sample as a clean sample or a malicious sample based on at least one of the malicious proximity vector or the clean proximity vector.

Abstract: Systems, apparatus, articles of manufacture, and methods to self-guardrail large language model responses are disclosed. An example apparatus includes interface circuitry, instructions, and programmable circuitry to at least one of execute or instantiate the instructions to access a first response message provided by a first large language model, the first response message generated based on an initial prompt, cause a second large language model to determine the first response message is inappropriate, modify the initial prompt to create a modified prompt, and provide the modified prompt to the first large language model to trigger generation of a second response message.

Abstract: Systems, apparatus, articles of manufacture, and methods are disclosed to improve the efficiency of an artificial intelligence-based threat detection model. An example apparatus includes interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to: obtain an email address from a group of email addresses to be considered as candidates for adding to the list of non-suspicious email addresses, determine that a domain of the email address is indicative of a non-email service providing entity, determine that the email address has a policy configured for a domain-based message authentication, reporting, and conformance (DMARC) record, add the email address associated to the list of non-suspicious email addresses, and cause the artificial intelligence-based threat detection model to skip an analysis of an email associated with the email address.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus includes at least one memory, instructions; and processor circuitry to execute the instructions to train a neural network with a plurality of raw byte data samples, perform feature extraction on ones of the plurality of raw byte data samples, determine whether ones of the plurality of raw byte data samples are clean or malicious using the extracted features, and determine a family of malware to which an identified malicious sample belongs.

Abstract: There is disclosed a system and method of providing services on a home gateway, including providing a set of security scans for traffic to and from a plurality of devices on a home network; cryptographically verifying that a secured device from the plurality of devices provides for itself internal security services; and based on the cryptographic verification, skipping at least one security scan of the set of security scans for traffic of the secured device.

Abstract: By way of example, a method includes, responsive to a user request to download, from the internet, a downloadable file with executable content, downloading a portion of the downloadable file, wherein the downloadable file is not executable with the portion; after download the portion of the downloadable file, scanning the portion of the downloadable file for malware characteristics to classify the downloadable file; and completing downloading the downloadable file only after determining, based on the scanning of the portion of the downloadable file, that the downloadable file is not malware.

Abstract: A computer-implemented method provides phishing mitigation. Upon a human user accessing a website, request from a cloud reputation service a reputation for a uniform resource locator (URL) associated with the website; determine that the URL does not have a reliable reputation; determine that the human user has entered data into the website, and that the data comprise sensitive data; log a data packet in a user sensitive information data store, wherein the data packet includes the URL and at least some of the sensitive data; periodically query the cloud reputation service to determine whether the URL has received a reliable reputation; and upon determining that the URL has received a reputation as a phishing website, notify the human user and provide a recommendation for a remedial action to protect the sensitive data.

Abstract: Methods and apparatus for voice transformation, authentication, and metadata communication are disclosed.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus comprises at least one memory, instructions, and processor circuitry to execute the instructions. The processor circuitry executes the instructions to provide a neural network a plurality of raw bytes for malware classification. The processor circuitry executes the instructions to generate a visualization of features extracted from the plurality of raw bytes. The processor circuitry executes the instructions to generate a heatmap for the plurality of raw bytes based on gradient activations of the neural networks. The processor circuitry executes the instructions to perform a dimensionality reduction based on features of the plurality of raw bytes identified in the heatmap.

Abstract: A method includes determining first data stored in a clipboard of an operating system, determining second data is stored in the clipboard, performing a comparison of the second data against malicious data, at least in part based on a determination that the first data has changed to the second data, and performing a first security operation, at least in part based on the comparison.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed to improve offloading of malware scans. An example apparatus is to, based on a trigger to perform a scan of a volume of data, estimate a computational burden associated with performing the scan using the CPU, the volume of data representative of at least one of a file or an object. Additionally, the example apparatus is to determine whether the computational burden satisfies a threshold associated with offloading the scan to the GPU. The example apparatus is also to cause at least one of the CPU or the GPU to perform the scan based on whether the computational burden satisfies the threshold.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus includes at least one memory, instructions, and processor circuitry to execute the instructions. The processor circuitry executes the instructions to identify a test data distribution, generate a first visualization of the identified test data distribution, select a visualization type for a machine learning model, generate a second visualization including an indication of features extracted from the test data by the machine learning model, and generate a third visualization of results of inference performed by the machine learning model, the inference performed on the test data.