Abstract: A computer-implemented method for providing security for synchronized files may include (1) synchronizing, using a cloud folder synchronization service, a backend server with both a client folder on a client machine and an additional client folder on an additional client machine, (2) propagating a file from the client folder to the backend server through the cloud folder synchronization service, (3) identifying, using the cloud folder synchronization service, a result of a security scan of the propagated file, and (4) adjusting, using the cloud folder synchronization service, the synchronization of the file with the additional client folder based on the result of the security scan. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for completing multi-factor authentication via mobile devices may include (1) identifying a request to communicate with a user's mobile device to complete multi-factor authentication of the user to an online service, (2) determining that authentication notifications are disabled for attempts made by the user to login to the online service, (3) preventing an authentication notification from being displayed on the user's mobile device, (4) receiving an out-of-band authentication communication from a mobile device, (5) determining that the mobile device that sent the out-of-band authentication communication is the user's mobile device and is therefore trusted to complete the multi-factor authentication of the user to the online service, and (6) enabling the user to login to the online service and automatically receive future notification. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for detecting security threats based on user profiles may include 1) identifying behavior on a computing system that is potentially indicative of a security threat, 2) identifying a user profile for a user of the computing system that estimates a level of the user's technical sophistication, 3) comparing the identified behavior with the estimated level of the user's technical sophistication, and 4) determining whether the identified behavior indicates a security threat based at least in part on the comparison of the identified behavior with the estimated level of the user's technical sophistication. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for capturing input from users to prevent data loss may include (1) intercepting, as part of a data-loss-prevention application, user input intended for a data-processing application that would, if received by the data-processing application, cause the data-processing application to perform an operation on data that may violate a data-loss-prevention policy, (2) upon intercepting the user input, causing the data-processing application to perform an alternative operation on the data that makes the data accessible to the data-loss-prevention application, (3) scanning, while the data-processing application is prevented from performing the operation, the data for compliance with the data-loss-prevention policy, (4) determining, based on a result of the scanning, that the data complies with the data-loss-prevention policy, and (5) causing, in response to determining that the data complies with the data-loss-prevention policy, the data-processing application to perform the

Abstract: A method, system, and computer program product for presenting content indicative of one or more entities which contributed to a window being displayed using a processing system. The method comprises determining one or more properties of the window; identifying, using the one or more properties and a set of rules, one or more entities which contributed to the window being displayed; and providing to a user, using the processing system, content indicative of the one or more entities which contributed to the window being displayed.

Abstract: A computer-implemented method may include facilitating registration for a service capable of determining whether strangers who come in contact with one another share one or more characteristics in common. The computer-implemented method may also include obtaining, as part of the registration for the service, permission for the service to access at least a portion of one or more social-networking accounts associated with each of the strangers. The computer-implemented method may further include determining, subsequent to the registration for the service, that the strangers registered for the service have come in contact with one another and then providing the service to the strangers in response to this determination. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for associating installed software components with software products. The method may include 1) maintaining a catalog of software products that may be installed on a computing system, each entry in the catalog comprising a software product and a corresponding set of regular expressions, 2) identifying a software component installed on the computing system, 3) searching the product catalog for a software product that matches the installed software component by, for one or more software products in the product catalog, determining whether the set of regular expressions corresponding to the software product matches information that identifies the installed software component, and 4) associating the installed software component with the software product whose set of regular expressions matches the information that identifies the installed software component. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The present disclosure provides for determining whether object accesses that occur in a file system qualify as relevant events, and displaying information about relevant events in a social file storage interface. A social file storage interface can provide a news feed of recent relevant events, a subscription list that displays information about relevant events performed by colleagues, and an access map that displays a visual representation of relevant events and relevant objects in the file system. An object access qualifies as a relevant event if an attribute of the object access satisfies relevance criteria defined by a user. If a user is not authorized to access an object, a relevant event pertaining to that object will not be displayed to the user in the social file storage interface. An object can also be accessed and opened from within the social file storage interface.

Abstract: A computer system and method is disclosed for storing large volumes of event data. The system receives access event logs including indications of access events to files stored on a set of storage devices. Each indication includes respective values for a plurality of access event attributes. The system uses the indications to store multiple segment files, each corresponding to a respective subset of the indications. Each segment file stores data as multiple tiles, where each tile includes a compressed copy of those access event indications of the segment file that have a shared value for one of the access event attributes. Each tile is stored contiguously within a set of storage devices.

Abstract: A computer-implemented method of community detection of a missing device is described. The method includes receiving a missing device report having identifying information of a missing device, sending a search command to an agent including the missing device report, and receiving a search report from the agent comprising whether or not the identifying information of the missing device is detected in a network to which the agent is connected. Also a method of community detection of a missing device through receiving a search command having identifying information of a missing device is described. The method includes monitoring network activity of a network for the identifying information of the missing device connected to the network, and sending a search report comprising whether or not the identifying information of the missing device is detected in the network.

Abstract: A method for learning aspects of messages in an industrial control system is provided. The method includes obtaining a plurality of messages. The method includes starting at a first message field, proceeding via recursion to each next message field, and identifying message values at that message field as constant when constant in messages in a group, as random when random in messages in a group, as length when expressive of a shared length of messages in a group, as opcode when correlated with a shared structure of messages in a group, and otherwise as parameter. The method includes subdividing message groups into subgroups according to the identified message values at that message field, with the recursion applied to each subgroup. A method and system for monitoring messages in an industrial control system is provided.

Abstract: A computer-implemented method to assign a security policy is described. A plurality of components of a device are detected. An individual reputation for each of the plurality of components is determined. An overall reputation is determined based on the individual reputations. A security policy is assigned based at least in part on the overall reputation. In some cases, access to at least one component on the device is restricted according to the security policy.

Abstract: A computer-implemented method for trusting digitally signed files in the absence of verifiable signature conditions may include (1) receiving, from an agent on at least one endpoint device, signature information that indicates that a file encountered by the endpoint device has been digitally signed, (2) generating, based at least in part on the signature information received from the endpoint device, a reputation for the file that indicates the file's trustworthiness, (3) receiving a request from an additional agent for reputation information for the file, and (4) sending, in response to receiving the request, the reputation for the file to the additional agent to enable the additional agent to determine the trustworthiness of the file in the absence of verifiable signature conditions. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for updating applications may include (1) identifying each version of an application, (2) determining possible upgrade paths to upgrade the application from an initial version of the application to a desired version of the application by, for each version of the application (a) creating a connection between the version and each subsequent version to which the version can be upgraded and (b) weighting each connection with a success rate that indicates the probability that the version will be successfully upgraded to the subsequent version, and (3) identifying, from among the possible upgrade paths, an optimal upgrade path for upgrading the application from the initial version to the desired version based on an analysis of both the combined weight and the combined length of the connections within each possible upgrade path. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Locations of animate and inanimate items are tracked over time. Tracking policies concerning the items are enforced, based on detected spatiotemporal events. Multiple routers each maintain a captive network to which mobile computing devices automatically connect. Users register mobile computing devices, which are associated with items to be tracked. A backend server maintains records concerning registered mobile computing devices. Records contain identifiers of registered mobile computing devices and their associated items, as well as categorization information and tracking policies concerning the items. Over time, registered mobile computing devices are moved around, causing them to connect to and disconnect from different captive networks. These connection events are reported to the backend, which uses this data to track locations of items over time.

Abstract: Method and apparatus for monitoring product purchasing activity on a network are described. In some examples, processing of network traffic in a network is performed. Web content is extracted from the network traffic at a node in the network. A statistical analysis of the web content is performed to detect product purchasing activity. Product attributes associated with the product purchasing activity are extracted. The product attributes are stored in a log implemented in a memory on the network.

Abstract: Techniques for presenting information on a graphical user interface are disclosed. In one particular embodiment, the techniques may be realized as a method for presenting information on a graphical user interface including generating a first display for the graphical user interface, wherein the first display displays content of a web browser, displaying, on a display unit, the first display, determining whether an icon of the first display has been selected, generating a thumbnail based on content of the web browser when the icon has been selected, generating a new display for the graphical user interface comprising the thumbnail, and displaying, on the display unit, the new display.

Abstract: A method for intruder detection is provided. The method includes monitoring, at a wireless sniffer in a building, received signal strength relative to each of a plurality of wireless access points, wherein a first wireless access point of the plurality of wireless access points is located within the building and a second wireless access point of the plurality of wireless access points is located external to the building. The method includes creating a profile of the received signal strength from each of the plurality of wireless access points, during a learn mode and comparing activity of the received signal strength from each of the plurality of wireless access points to the profile, during an intruder detection mode. The method includes issuing a notification, based on the comparing. An intruder detection system is also provided.