Abstract: A method for protecting data files may include (1) identifying a data file to be protected against data loss, (2) identifying a set of software programs permitted to open the data file by (a) identifying a format of the data file and (b) identifying at least one software program capable of opening files of the format of the data file, (3) detecting an attempt to open the data file by a software program not included in the set of software programs, and (4) performing a security action in response to detecting the attempt to open the data file. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for dynamically adjusting server settings is described. In one embodiment, at least one parameter of a status of a server that diverges from a corresponding baseline setting of a policy maintained by the server may be identified. An adjustment to the baseline setting of the policy may be calculated based at least in part on the divergent parameter. The baseline setting of the policy may be adjusted according to the calculated adjustment. A command may be issued to send data representative of the adjusted baseline setting of the policy from the server to a client to update a user profile.

Abstract: A computer-implemented method for using reputation information to evaluate the trustworthiness of files obtained via torrent transactions may include (1) identifying a torrent file that includes metadata for facilitating a torrent transaction for obtaining a target file via a peer-to-peer file-sharing protocol, (2) identifying at least one entity involved in the torrent transaction, (3) obtaining reputation information associated with the entity involved in the torrent transaction, wherein the reputation information identifies a community's opinion on the trustworthiness of the entity, (4) determining, based at least in part on the reputation information associated with the entity involved in the torrent transaction, that the target file represents a potential security risk, and then (5) performing a security action on the target file. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Techniques for classifying non-process threats are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for classifying non-process threats comprising generating trace data of at least one observable event associated with execution of a process, representing a first feature of the at least one observable event of the trace data, calculating, using a computer processor, a similarity between the first feature and at least one sample feature, and classifying the process based on the similarity.

Abstract: The present disclosure relates to using signatures in a data loss prevention system. According to one embodiment, a DLP system identifies an occurrence of a data loss prevention (DLP) incident triggered by content and a DLP rule. The DLP system generates a first signature representing the DLP incident based on a specific pattern inherent to the content which triggered the DLP incident. The DLP system compares the first signature to one or more second signatures generated from other DLP incidents associated with the DLP rule. Upon determining the first signature matches at least one of the second signatures, the DLP system assigns an event status of the second matching signature to the first signature.

Abstract: A computer system monitors a set of inactive addresses. The computer system identifies a suspicious activity associated with at least one inactive address of the set of inactive addresses. The computer system determines a suspicion score for the at least one inactive address based on the suspicious activity associated with the at least one inactive address. The computer system categorizes the at least one inactive address as a potentially hijacked address if the suspicion score exceeds a threshold.

Abstract: A computer-implemented method for evaluating networks may include (1) identifying an initial set of recorded packet performance data that describes an instance of an attempt to establish a network connection path between an original node and a subsequent node in a network, (2) detecting, by a software security system, a network anomaly based on comparison data resulting from a comparison between the initial set of recorded packet performance data and an additional set of recorded packet performance data that describes another instance of an attempt to establish a network connection path between the original node and the subsequent node, and (3) performing, by the software security system, and in response to detecting the network anomaly based on the comparison between the sets of packet performance data, a security action to protect the computing device. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for analyzing suspected malware may include (1) identifying a file suspected of including malware, (2) performing a static analysis of the file to identify at least one indication of an attack vector that the file uses to attack computing systems, (3) obtaining, from at least one computing system, telemetry data that identifies at least one indication of an attack vector that the file uses to attack computing systems, (4) constructing, using the indications obtained from the static analysis and the telemetry data, an execution profile that describes an execution environment that provides the attack vectors indicated by the static analysis and the telemetry data, and (5) configuring the execution environment described in the execution profile to test the file for maliciousness. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for detecting information leakage by an organizational insider may include (1) identifying a set of organizational insiders of an organization, (2) identifying a set of public forums used by one or more organizational insiders, (3) identifying a set of messages posted to one or more public forums, (4) creating a message record corresponding to each message, with the record including a message summary, and a set of message metadata fields, (5) consolidating message records with common metadata fields into a message summary record, and (6) identifying, based on the message summary record, an information leakage threat. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for verifying the authenticity of graphical images may include (1) identifying a graphical image intended for presentation by a display and then, prior to facilitating presentation of the graphical image by the display, (2) identifying an original unique identifier of at least a portion of the graphical image encoded into the graphical image, (3) computing a subsequent unique identifier of the portion of the graphical image, and (4) determining, by comparing the subsequent unique identifier to the original unique identifier, whether the graphical image is authentic. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for identifying repackaged files may include (1) identifying an application package that packages files for a mobile device application that is to be executed through a mobile device operating system, (2) identifying, within the application package, a resource file that identifies resources for the application package defined in a programming language for the mobile device operating system, (3) parsing the resource file to identify a flag for a resource that specifies whether the resource is public, (4) determining that the flag for the resource has been set as public, and (5) classifying the application package as repackaged based at least in part on the determination that the flag for the resource has been set as public. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for detecting malicious files may include (1) identifying a length of at least one line within a textual file, (2) assessing, based at least in part on the length of the line within the textual file, a likelihood that at least a portion of the textual file has been encrypted, (3) determining, based on the likelihood that at least a portion of the textual file has been encrypted, a likelihood that the textual file is malicious, and (4) performing a remediation action based at least in part on determining the likelihood that the textual file is malicious. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: An intercepting proxy server processes traffic between an enterprise user and a cloud application which provides Software as a Service (SaaS). The intercepting proxy server provides interception of real data elements in communications from the enterprise to the cloud and replacing them with obfuscating information by encrypting individual real data elements without disturbing the validity of the application protocol. To the processing cloud application real data are only visible as encrypted tokens. Tokens included in results returned from the cloud, are intercepted by the intercepting proxy server, and replaced with the corresponding sensitive real data. In this way, the enterprise is able to enjoy the benefits of the cloud application, while protecting the privacy of real data.

Abstract: Dynamic on-device passcode to lock lost device is described. In one method, a security agent executing on a processor of a user device periodically generates a dynamic passcode using a cryptographic function and a cryptographic seed according to a predefined time interval. While the user device is in a first state, the security agent sends the cryptographic seed to an authentication service. The method receives an acknowledgement of receipt of the cryptographic seed from the authentication service and detects that the user device is in a potentially lost or stolen state based on a defined condition of the user device. In response to the detecting that the user device is in the potentially lost or stolen state, the method locks the user device and may unlock the user device when a current instance of the dynamic passcode is correctly entered on the user device.

Abstract: A computer-implemented method for scanning a file is described. A Golomb-Compressed Sequence (GCS) index may be queried to determine whether GCS data is associated with the scanned data. The GCS index may be stored in a first storage medium and the GCS data may be stored in a second storage medium. The second storage medium may be different from the first storage medium. Upon determining the GCS data is associated with the scanned data, the location of the GCS data associated with the scanned data may be identified. The GCS data may be retrieved from the identified location. At least a portion of the retrieved GCS data may be analyzed. Based on the analysis of the retrieved GCS data, it may be determined whether to perform additional data querying.

Abstract: Techniques for detecting security vulnerabilities are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting security vulnerabilities including assigning a reputation to an application, distributing the reputation to a client, receiving monitored system behavior from the client related to the client executing the application, determining whether to change the reputation of the application based on the monitored system behavior, distributing the changed reputation to the client, receiving further monitored system behavior from the client, and determining whether to generate a rule for the application based on the monitored system behavior received from the client.

Abstract: Techniques are disclosed for providing a device-based PIN authentication process used to protect encrypted data stored on a computing system, such as a tablet or mobile device. A client component and a server component each store distinct cryptographic keys needed to access encrypted data on the client. The mobile device stores a vault encryption key used to decrypt encrypted sensitive data stored on the mobile device. The vault key is encrypted using a first encryption key and stored on the mobile device. The first encryption key is itself encrypted using a second encryption key. The second encryption key is derived from the PIN value.

Abstract: A method and apparatus for analyzing end user license agreements and taking action based on the analysis outcome. In one embodiment, the method includes sensing initialization of an installable software program installation, extracting a EULA from the installable during installation, pausing presentation of the EULA to a user, providing a database of suspect terms, analyzing whether a suspect term exists in the EULA, and presenting at least one of the EULA or a suspect term to the user.

Abstract: A method for calculating a partial risk score for a data object may include identifying a request to calculate a partial risk score for a data object, the request including a partial risk score filter, and the data object being associated with one or more policies. The method may further include for each policy associated with the data object, determining whether characteristics associated with the policy match a parameter in the partial risk score filter, and when the characteristics associated with the policy match information in the partial risk score filter, including a data object risk score associated with the policy in the partial risk score for the data object.

Abstract: Techniques for automated application analysis are disclosed. In one embodiment, the techniques may be realized as a method comprising detecting a code creation activity; detecting the presence of a previously-unknown application; associating the detected application with the code creation activity; and permitting the application to run based on associating the detected application with the code creation activity.