Abstract: The disclosed systems and methods are configured for metaverse monitoring and alerting therefrom.

Abstract: A method for disrupting a detected cyberthreat can include receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; verifying the request; and reporting the verified request and the one or more IOCs to a disruption network.

Abstract: Systems and methods are provided for unified cyberthreat searching.

Abstract: A system for detecting synthetic videos may include a server, a plurality of weak classifiers, and a strong classifier. The server may be configured to receive a prediction result from each of a plurality of weak classifiers; and send the prediction results from each of the plurality of weak classifiers to a strong classifier. The weak classifiers may be trained on real videos and known synthetic videos to analyze a distinct characteristic of a video file; detect irregularities of the distinct characteristic; generate a prediction result associated with the distinct characteristic, the prediction result being a prediction on whether the video file is synthetic; and output the prediction result to the server. The strong classifier may be trained to receive the prediction results of the plurality of weak classifiers from the server; analyze the prediction results; and determine if the video file is synthetic based on the prediction results.

Abstract: Systems and methods are provided to generate an attack surface for a protected entity. The method an include receiving identifying information associated with the protected entity; scanning one or more third parties to identify a host associated with the protected entity; determining that the host resolves to a webpage; resolving the webpage; extracting a uniform resource locator (URL) from the resolved webpage; determining, based on at least one rule, that the URL is associated with the protected entity; and generating the attack surface for the protected entity, the attack surface comprising the URL.

Abstract: The disclosed systems and methods provide roaming physical security intelligence.

Abstract: The disclosed systems and methods provide roaming physical security intelligence.

Abstract: Systems and methods are described for managing high volumes of alerts to increase security, reduce noise, reduce duplication of work, and increase productivity of analysts dealing with and triaging alerts. A work unit queue may be configured to buffer or smooth workflows and decouple heavy processing which may improve performance and scalability to prevent duplicate assignments. Queueing services provide lag times to prevent over-assignment or double assignment of alerts to work units. System security may be improved by creating an authentication or verification step before allowing users to update alert statuses such that only users with work unit tokens that match alert tokens may update alert statuses.

Abstract: A system may include: a server comprising a rule cache; a user device communicably coupled to the server; a computer-readable medium comprising instructions that cause the server to: monitor a plurality of third-party data sources; obtain, via a queueing service, a plurality of pieces of content from the plurality of third-party data sources; for each piece of content, fetch a rule ID from a list of rule IDs on the user device, wherein the rule ID is fetched based on the content and a pre-selected setting on the user device; use the rule ID to fetch a rule from the rule cache, the rule comprising a script, the script comprising executable code; execute the script on the piece of content to determine if the piece of content matches the rule; and in response to determining that the piece of content matches the rule, send an alert to the user device.

Abstract: Systems and methods are provided for unified cyberthreat searching.

Abstract: A system may include: a server comprising a rule cache; a user device communicably coupled to the server; a computer-readable medium comprising instructions that cause the server to: monitor a plurality of third-party data sources; obtain, via a queueing service, a plurality of pieces of content from the plurality of third-party data sources; for each piece of content, fetch a rule ID from a list of rule IDs on the user device, wherein the rule ID is fetched based on the content and a pre-selected setting on the user device; use the rule ID to fetch a rule from the rule cache, the rule comprising a script, the script comprising executable code; execute the script on the piece of content to determine if the piece of content matches the rule; and in response to determining that the piece of content matches the rule, send an alert to the user device.

Abstract: Systems and methods are provided to generate an attack surface for a protected entity. The method an include receiving identifying information associated with the protected entity; scanning one or more third parties to identify a host associated with the protected entity; determining that the host resolves to a webpage; resolving the webpage; extracting a uniform resource locator (URL) from the resolved webpage; determining, based on at least one rule, that the URL is associated with the protected entity; and generating the attack surface for the protected entity, the attack surface comprising the URL.

Abstract: A method for disrupting a detected cyberthreat can include receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; verifying the request; and reporting the verified request and the one or more IOCs to a disruption network.

Abstract: Systems and methods are provided to generate an attack surface for a protected entity. The method an include receiving identifying information associated with the protected entity; scanning one or more third parties to identify a host associated with the protected entity; determining that the host resolves to a webpage; resolving the webpage; extracting a uniform resource locator (URL) from the resolved webpage; determining, based on at least one rule, that the URL is associated with the protected entity; and generating the attack surface for the protected entity, the attack surface comprising the URL.

Abstract: A system may include: a server comprising a rule cache; a user device communicably coupled to the server; a computer-readable medium comprising instructions that cause the server to: monitor a plurality of third-party data sources; obtain, via a queueing service, a plurality of pieces of content from the plurality of third-party data sources; for each piece of content, fetch a rule ID from a list of rule IDs on the user device, wherein the rule ID is fetched based on the content and a pre-selected setting on the user device; use the rule ID to fetch a rule from the rule cache, the rule comprising a script, the script comprising executable code; execute the script on the piece of content to determine if the piece of content matches the rule; and in response to determining that the piece of content matches the rule, send an alert to the user device.

Abstract: A method for disrupting a detected cyberthreat can include receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; verifying the request; and reporting the verified request and the one or more IOCs to a disruption network.

Abstract: A computer-implemented method including scanning, by one or more processors, data that is maintained on one or more social networks, identifying, one or more social entities associated with the scanned data, determining a risk score for each of the one or more social entities, analyzing the scanned data using one or more machine learning techniques, assigning a rating to each of the one or more social entities based on the determined risk score and the analyzed data, and determining, based on the rating assigned to at least one of the one or more social entities that the at least one social entity is a security risk.

Abstract: A computer-implemented method including scanning, by one or more processors, data that is maintained on one or more social network profiles of a protected social entity, identifying, one or more social entities associated with the scanned data, determining a risk score for each of the one or more social entities, analyzing the scanned data using one or more machine learning techniques, assigning a rating to each of the one or more social entities based on the determined risk score and the analyzed data, and determining, based on the rating assigned to at least one of the one or more social entities that the at least one social entity is a security risk to the protected social entity.

Abstract: A method may include generating a first scaled variant pyramid associated with a first image and a second scaled variant pyramid associated with a second image; determining a pair of best-matching variants; detecting a first plurality of keypoints in the first variant and a second plurality of keypoints in the second variant; generating a descriptor for each keypoint of the first plurality of keypoints to create a first plurality of keypoint descriptors; generating a descriptor for each keypoint of the second plurality of keypoints to create a second plurality of keypoint descriptors; for each keypoint of the first plurality of keypoints, identifying a keypoint match from the second plurality of keypoints; determining that a number of keypoint matches is above a threshold number; and in response to determining that the number of keypoint matches is above the threshold number, determining that the first image matches the second image.

Abstract: A computer implemented method includes receiving instructions from a user for identifying data on one or more social networks, wherein the instructions received from the user comprise one or more conditions and one or more actions, identifying, on the one or more social networks, data that is associated with one or more social entities, determining one or more characteristics of the identified data, determining, based on the one or more characteristics of the identified data, that the identified data meets one or more conditions for identifying data specified in the instructions received from the user, in response to determining that the identified data meets one or more conditions specified in the instructions received from the user, performing one or more actions specified in the instructions received from the user.