Abstract: Systems, apparatuses, and methods are described for preauthorizing a batch of access rights licenses, e.g., Digital Rights Management (DRM) licenses, and storing them at a location. The preauthorization may be based on predicting a batch of content items to be viewed. The location may be a content server or a user device. After receiving a request from the user device to play back a content item of the batch of predicted content items, the DRM license may be provided from the storage location instead of performing an authorization operation to obtain one from a DRM server. Providing the DRM license from the storage location may take less time than performing the authorization operation to obtain the DRM license from the DRM server.

Abstract: A cyber threat defense system and a method for detecting a cyber threat may use a predictor, e.g. a Transformer deep learning model, which is configured to predict a next item in the sequence of events and to detect one or more anomalies in the sequence of events. This provides a notification comprising (i) information about the one or more anomalies; and (ii) a prediction of what would have been expected.

Abstract: An encrypted communication method is applied in a first electronic device, which includes a first processor communicating through encrypted channel of first Bluetooth, and a second processor communicating through unencrypted channel of second Bluetooth. The method includes: receiving, by the first processor, a key transmitted from a second electronic device, and transmitting the key to the second processor, the key being transmitted from the second electronic device to the first processor through the encrypted channel of the first Bluetooth; receiving, by the second processor in response to the first electronic device being switched to a system run by the second processor, a first ciphertext transmitted from the second electronic device, the first ciphertext being transmitted from the second electronic device to the second processor through the unencrypted channel of the second Bluetooth; and decrypting, by the second processor, the first ciphertext with the key to obtain the first plaintext.

Abstract: Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include receiving a report of a first anomaly based on real-time control flow graph diagram monitoring of an application at a first system and receiving a second report of a second anomaly from a second system. An exploit report may be generated by providing the first report and the second report to a machine learning model trained to output information related to an exploit based on input reports, and subsequently to provide the output information to a cloud-based reporting tool.

Abstract: A method and system for detecting and mitigation a cyber-attack scanner are provided. The method includes determining if a source network address designated in a received packet is suspicious as of a cyber-attack scanner, wherein the determination is based on a likelihood that the source address was previously frequently encountered; upon determining that the source network address is suspicious, determining diversity of destination network addresses sent by a source having the suspicious network address; and upon determining that the destination network addresses are diversified, generating an alarm indicating that a source network address is a cyber-attack scanner, wherein a cyber-attack scanner is a device to identify destination network addresses in a protected entity that be exploit for at least a cyber-attack scanner.

Abstract: Methods and systems are described herein for novel uses and/or improvements in application or service authentication for a provider of disparate applications and/or services using blockchain technology. As one example, a method and a system are described herein for a unified user device authentication mechanism across multiple lines of service using cryptographic tokens. The system may receive, as part of a login request from a user, an address associated with a cryptography-based storage application, a cryptographic signature, and an identifier associated with a cryptographic token. The system may verify that the cryptographic token is valid and that the cryptography-based storage application controls the cryptographic token to grant the user access to the application or line of service.

Abstract: A network vulnerability scanning system scans a target device for vulnerabilities to obtain network connection data for the target device. The network vulnerability scanning system determines the network connection data includes a network connection between the target device and a hidden network system. The network vulnerability scanning system installs a network scanning application on the target device in response to determining the network connection data includes the network connection between the target device and the hidden network system. The network vulnerability scanning system scans the hidden network system for vulnerabilities via the network scanning application installed on the target device.

Abstract: Past login activity is used to train a machine learning model and pre-compute network intrusion risk profiles. Subsequent login attempts can be evaluated with the pre-computed network intrusion risk profiles. If the profile shows sufficient intrusion risk, actions can be taken to avoid intrusion, such as requiring further authentication steps.

Abstract: In an example in accordance with the present disclosure, a system is described. The system includes a display device and a gaze tracking system to capture eye movements of a user looking at the display device. The system also includes a controller. The controller authenticates the user based on eye movements of the user matching an eye movement authentication pattern. The controller also calibrates a computing device based on the eye movements of the user.

Abstract: An endpoint in an enterprise network is instrumented with sensors to detect security-related events occurring on the endpoint. Event data from these sensors is augmented with contextual information about, e.g., a source of each event in order to facilitate improved correlation, analysis, and visualization at a threat management facility for the enterprise network.

Abstract: A system for encrypting and authenticating communications with mutual authentication of the communicators is used between two parties who exchange messages supported by a communication network in which the parties are unequivocally identified. The system includes processes supported by respective authentication applications available to each party on a hardware/software device, the applications having at least: an identifier (Id) of the authentication application (AA); an encryption key (CC) of each party; a random number generator for encrypting and authenticating messages (Mx); and an encryption algorithm that is shared with the rest of the parties of the system, allowing them to encrypt and decrypt the sent/received messages.

Abstract: In some embodiments, a computer-implemented method for preventing credential passing attacks may include receiving an input; determining whether the input is a credential access command, wherein the determination includes searching for occurrences of references to executables related to adding, reading, copying, or performing actions with respect to a credential, if the input is determined to be a credential access command, performing anomaly detection, wherein performing the anomaly detection includes evaluating whether a user is a valid domain user, whether an elapsed time of the credential is greater than a maximum lifetime of the credential, and whether a privilege attribute certificate of the credential is valid, determining that an anomaly exists if the command was generated by an invalid domain user; an elapsed time of a credential is greater than a maximum lifetime, or the privilege attribute certificate of the credential is invalid, and performing mitigation of the anomaly.

Abstract: Systems and methods of the disclosure provide for receiving, from a GUI on a client device, a request to download and install an OS image and integrated interactive service on a bootable resource; transmitting to the client device the OS image and the integrated interactive service to be installed on the bootable resource, wherein the bootable resource is configured to: on a restart of the client device, boot to the OS image and launch the interactive service; and deny access to any software, service, or resource not available on the bootable resource.

Abstract: An installation method needless of multiple requests for permissions includes executing a first command after a first startup program is run under a non-administrator permission, and starting at least one installation module through a second command after a second startup program is run. The first command is configured to run the second startup program with an administrator permission, and the second command is configured to execute the startup programs with the administrator permission.

Abstract: A system and a method are disclosed for detecting a malicious website. In an embodiment, a computing device detects a uniform resource locator (URL) referencing an unknown website; pre-processes the URL to determine a first probability that the unknown website is malicious; and inputs the first probability into a machine learning model to receive a second probability that the unknown website is malicious. The machine learning model is trained using Secure Sockets Layer (SSL) certificates of known legitimate websites and known malicious websites. The computing device further determines whether the second probability is associated with at least a threshold risk. Responsive to the second probability being associated with at least the threshold risk, the computing device causes a graphical user interface of a client device to display a notification indicating a level of risk associated with the unknown website.

Abstract: Systems, methods and instrumentalities are described herein that provide security and/or privacy support for wireless transmit receive units (WTRUs) communicating via a WTRU to WTRU relay. A source WTRU may obtain a new IP address from a relay WTRU via a link identifier update request. The source WTRU may indicate to the relay WTRU which one or more target WTRUs are to be informed of the new IP address. The source WTRU may indicate to the relay WTRU whether the target WTRU's ID(s) should be changed. The relay WTRU may send the source WTRU's new IP address to authorized target WTRUs. The source, relay, and target WTRU may use tokens to grant or receive authorizations for sharing each other's IP addresses.

Abstract: Aspects of the disclosure relate to monitoring a computing network to determine data exfiltration. A computing platform may use time-series modeling to determine anomalous network activity with respect to outgoing data. Additional aspects of this disclosure relate to analysis of web activities associated with a user to determine compromised user accounts/devices. The computing platform may use domain categorization to determine if web activity associated with a user is anomalous.

Abstract: A method of securing sensitive data and hygiene compliance data may include receiving a first input and determining whether the first input is associated with a cleaning instance of one or more portions of a computing device. Based at least in part on the first input is not associated with a cleaning instance, the method may further include transmitting first data to a first computing system via a first communication channel. Based at least in part on the first input is associated with a cleaning instance, the method may further include transmitting second data to a second computing system via a second communication channel different from the first communication channel.

Abstract: An online service may maintain or create data for a user, and a user may be allowed to exert control over how the data are used. In one example, there may be several categories of data, and the user may be able to specify who may use the data, and the purpose for which the data may be used. Additionally, a user may be able to see how many of his “friends” (or other contacts) have extended trust to a particular entity, which may aid the user in making a decision about whether to extend trust to that entity. User interfaces may be provided to allow users to specify how their data are to be used.

Abstract: A method, device and non-transitory computer-readable medium for analysing a data package received by a recipient, using a framework. The framework comprises at least one adjuster; and a processing component for processing the received data package using the at least one adjuster. The at least one adjuster is configured to obtain payload data of the received data package and analyse the payload data for recipient-interactive content, wherein the recipient-interactive content provides access to remote content. The recipient-interactive content is substituted with sanitised recipient-interactive content, and recipient interaction with the sanitised recipient-interactive content is detected. A content check is performed when recipient interaction with the sanitised recipient-interactive content is detected. The content check comprises analysing the remote content, and determining, based on the content check whether the data package represents a security threat.