Abstract: A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed for dynamic re-distribution of detection content and algorithms for exploit detection. An example apparatus includes at least one processor, and memory including instructions that, when executed, cause the at least one processor to deploy respective ones of a plurality of standard detection algorithms and content (SDACs) to respective ones of a first endpoint and a second endpoint, deploy a first set of enhanced detection algorithms and content (EDACs) to the first endpoint, deploy a second set of the EDACs to the second endpoint, the second set of EDACs different from the first set of EDACs, and in response to obtaining a notification indicative of an exploit attack from the first endpoint, distribute the first set of EDACs to the second endpoint to facilitate detection of the exploit attack at the second endpoint.

Abstract: The present disclosure relates to a system and method for performing anti-malware scanning of data files that is data-centric rather than device-centric. In the example, a plurality of computing devices are connected via a network. An originating device creates or first receives data, and scans the data for malware. After scanning the data, the originating device creates and attaches to the data a metadata record including the results of the malware scan. The originating device may also scan the data for malware contextually-relevant to a second device.

Abstract: Disclosed examples include at least one processor; and memory including instructions that, when executed by the at least one processor, cause the at least one processor to install a configuration profile; activate an internal virtual private network service; and cause the internal virtual private network service to activate a local proxy.

Abstract: A computer system, comprising one or more processors and a memory including instructions that, when executed, cause the one or more processors to at least: execute a first executable application; access a first registration request from a second executable application; validate a digital certification of the one or more components of the second executable; in response to the validating of the digital certification of the one or more components, save information from the first registration request into a registration store, wherein the information saved from the first registration request includes a unique identifier including (1) an identification of one or more types of events, and (2) a package family name; and send a raised event without requiring further authentication from the second executable application.

Abstract: Mechanisms for controlling traffic to an Internet of Things (IoT) device are provided, the mechanisms comprising: identifying a first IoT device having an Internet Protocol (IP) address and a Media Access Control (MAC) address; sending a first Address Resolution Protocol (ARP) broadcast on a local area network (LAN) indicating that the IP address of the first IoT device is to be associated with a MAC address of a router on the LAN; receiving first traffic on the LAN; extracting the IP Address of the first IoT device from the first traffic; determining that the first traffic is allowed; and forwarding the first traffic to the first IoT device by inserting the MAC address of the first IoT device in the first traffic and re-broadcasting the first traffic.

Abstract: Particular embodiments described herein provide for an electronic device that can be configured to intercept a process, store execution profiling for the process if the process involves a privileged resource or a privileged operation, and analyze the code involved in each stack frame to determine malicious activity. If the process does not involve a privileged resource or a privileged operation, then the process is not analyzed.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a user application; telemetry probes to collect telemetry about use of the user space application; a detection proxy to collect telemetry data from the telemetry probes and forward the telemetry data to a detection cloud service; and logic to receive from the detection cloud service a detection message that the user application has exhibited behavior consistent with tampering, and to take remedial action responsive to the detection message.

Abstract: An apparatus, related devices and methods, having a memory element operable to store instructions; and a processor operable to execute the instructions, such that the apparatus is configured to identify, on an electronic device, a phone number of an incoming caller device; request, via an out-of-band control channel, a digital certificate for the phone number from the incoming caller device; receive, via the out-of-band control channel, the digital certificate for the phone number from the incoming caller device; determine whether the digital certificate for the phone number is authentic; and indicate, on the electronic device, based on a determination that the digital certificate for the phone number is authentic or not authentic, whether the phone number is authentic or not authentic.

Abstract: Methods, systems, and media for protecting computer systems from user-created objects are provided.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a network interface; a userspace application store including a plurality of userspace applications, wherein at least some of the userspace applications are programmed to communicate via the network interface; and instructions encoded within the memory to: enumerate social connections of a user via the userspace applications; assign the social connections to virtual groups according, at least in part, to correlated connection services; assign data transfer policies to the virtual groups; detect an attempted data transfer to a social connection; and enforce the data transfer policy for a virtual group of the social connection of the attempted data transfer.

Abstract: A method in one example implementation includes extracting a plurality of data elements from a record of a data file, tokenizing the data elements into tokens, and storing the tokens in a first tuple of a registration list. The method further includes selecting one of the tokens as a token key for the first tuple, where the token is selected because it occurs less frequently in the registration list than each of the other tokens in the first tuple. In specific embodiments, at least one data element is an expression element having a character pattern matching a predefined expression pattern that represents at least two words and a separator between the words. In other embodiments, at least one data element is a word defined by a character pattern of one or more consecutive essential characters. Other specific embodiments include determining an end of the record by recognizing a predefined delimiter.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a closed operating system including instructions within the memory to sandbox userspace applications; and a sandboxed userspace application, including: instructions to provide a user interface and user application code; and an agentless security library within the sandboxed userspace application, the agentless security library including instructions to provide security or privacy services to the sandboxed userspace application with minimal direct interaction from the user interface and user application code.

Abstract: The invention provides a method for managing access to a network resource on a network from a mobile device, the method including the steps of intercepting a data stream from the mobile device attempting to access the network resource, extracting information from the intercepted data stream relating to at least one of the mobile device or a user of the mobile device, accessing at least one of enterprise service based information and third party information regarding at least one of the mobile device or the user of the mobile device, determining whether the mobile device is authorized to access the network resource, preparing an access decision that specifies whether the mobile device is authorized to access the network resource, and storing the access decision in a database on the network.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor circuit and a memory circuit; first means for accessing a machine learning engine; second means for accessing a user interface; and instructions encoded within the memory to instruct the processor to: load into the machine learning engine via the first means an object prevalence model, including an enterprise-specific prevalence model; provide to the machine learning engine an object set from the enterprise; identify an enterprise-novel object from the object set; solicit and receive via the second means user-sourced feedback for the enterprise-novel object; and act according to the user-sourced feedback.

Abstract: There is disclosed in one example a computing apparatus, including: a processor; and a memory having encoded therein executable instructions to instruct the processor to: divide a file-under-analysis into a plurality of features; build a plurality of categories from the plurality of features, including a category of unrelated features; construct a first decision tree from a first category of the plurality of features, the first category including related features; construct a second decision tree from a second category of the plurality of features, the second decision tree including unrelated features; and determine, based at least partly on the first decision tree and the second decision tree, that the file under analysis has malware content.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to perform malware detection using a generative adversarial network. An example apparatus includes a first encoder network to encode an input sample into a first encoded sample, the first encoder network implemented using a multilayer perception (MLP) network, a generator network to reconstruct the first encoded sample to generate a reconstructed sample, a discriminator network to, in response to obtaining the first encoded sample and the reconstructed sample, generate a loss function based on the reconstructed sample and the input sample, and an optimization processor to, when the loss function satisfies a threshold loss value, classify the input sample as malicious.

Abstract: There is disclosed in one example a method of detecting computer malware, including: receiving a binary object for analysis; allocating the binary object to a sandbox; within the sandbox, loading the binary object into an executable memory region; performing a memory dump of the executable memory region; and analyzing the memory dump for malware characteristics.

Abstract: There is disclosed in an example, a gateway apparatus, including a hardware platform having a processor and a memory; a wireless network interface; and instructions encoded within the memory to instruct the processor to: provide a first virtual access point (VAP) secured by an IEEE 802.1x extensible authentication protocol (EAP) enterprise security method; provide a second VAP secured by a WiFi protected access pre-shared key (WPA-PSK) method; onboard a device, comprising determining whether the device supports the EAP method, and enrolling the device with the EAP method if the device supports the EAP method; and if the device does not support the EAP method, enrolling the device with the WPA-PSK method.

Abstract: An apparatus, including systems and methods, for classifying, mapping, and predicting cybercriminal activity is disclosed herein. For example, in some embodiments, an apparatus is configured to: receive cybercriminal communication (CCC) data of postings from a source forum; identify, classify, and rank a threat topic for each posting; identify a first subset of postings that includes postings assigned the threat topic classification with the greatest threat topic rank; for each posting of the first subset of postings: identify and rank the threat actor; identify a second subset of postings that includes postings associated with the threat actor assigned the greatest threat actor rank; and send, to a cybersecurity data exchange module, the CCC data of the second subset of postings and associated enriched data including the source forum, the threat topic classifications, the threat actor, the threat actor rank, or the other threat actors that mentioned the threat actor.