Abstract: Systems and processes are disclosed for detecting phishing emails and text messages. The method involves accessing the internet to gather data from various online sources, executing multi-threaded downloaders to handle multiple data streams, and storing the downloaded data in a repository. A web scraping agent analyzes and extracts relevant features from the stored data, transforming unstructured data into a structured data model. Both are stored in a database. An after-processing dataset is generated, including testing and training datasets for machine learning analysis. Random Forest models are evaluated to determine accuracy in predicting phishing attempts, and optimal models are selected, which generate phishing predictions from new data, with feature extraction identifying attributes relevant for detection. An evaluation model assesses feature extraction accuracy and overall system performance. The machine learning algorithm adapts to new phishing techniques.

Abstract: A computer services environment may include web servers providing access domains and a network ingress paths receiving application-layer request messages. The application-layer request messages may each be received from a respective source via a respective ingress path and may be directed to a domain. The computing services environment may also include an orchestration engine configured to determine and implement mitigation policies corresponding with the ingress paths based on a classification of a subset of the plurality of application-layer request messages as being sent from a subset of the sources associated with a distributed denial of service attack. The mitigation policies may include rules to prevent a subset of subsequent application-layer request messages from the subset of the sources from reaching one or more components of the computing services environment.

Abstract: Recovering a private key for a decentralized application transaction is described. Reset information corresponding to a user is sent. An access token that corresponds to the user is received. The access token is sent. A credential to enable the first computing environment to access a third party security service to decrypt encrypted private key information is received. A request for the encrypted private key information is sent. The encrypted private key information is received. The credential and the encrypted private key information is sent. The decrypted private key information is received.

Abstract: A method, involving; detecting an event; identifying one or more security tools that are currently part of an inventory of security tools; generating a playbook based on the inventory, the playbook being generated responsive to the event, the playbook being a script that includes one or more commands, each of the commands corresponding to a respective security tool in the inventory of security tools; and executing the playbook.

Abstract: Determining additional signals for determining cybersecurity risk is disclosed, including: obtaining signals associated with a cybersecurity risk, wherein the obtained signals include technographic signals and query derived signals obtained from queries; combining the technographic signals and the query derived signals into a Bayesian model indicating the cybersecurity risk; and determining additional technographic signals or additional query derived signals associated with the cybersecurity risk to obtain such that the additional technographic signals or the additional query derived signals are to be computed to impact the cybersecurity risk.

Abstract: A computing services environment may provide computing services to a plurality of recipients via the Internet. The computing services environment may include application gateways receiving application-layer request messages from various sources. The computing services environment may also include an orchestration engine determining mitigation policies corresponding with the application gateways based on a classification of a subset of the application-layer request messages as being sent from sources associated with a distributed denial of service attack. The computing services environment may also include application-layer web application firewalls corresponding to the application gateways and transitioning from a deactivated state to an activated state upon receipt of an instruction from the orchestration engine.

Abstract: Systems, apparatuses, and methods are described for preauthorizing a batch of access rights licenses, e.g., Digital Rights Management (DRM) licenses, and storing them at a location. The preauthorization may be based on predicting a batch of content items to be viewed. The location may be a content server or a user device. After receiving a request from the user device to play back a content item of the batch of predicted content items, the DRM license may be provided from the storage location instead of performing an authorization operation to obtain one from a DRM server. Providing the DRM license from the storage location may take less time than performing the authorization operation to obtain the DRM license from the DRM server.

Abstract: A cyber threat defense system and a method for detecting a cyber threat may use a predictor, e.g. a Transformer deep learning model, which is configured to predict a next item in the sequence of events and to detect one or more anomalies in the sequence of events. This provides a notification comprising (i) information about the one or more anomalies; and (ii) a prediction of what would have been expected.

Abstract: An encrypted communication method is applied in a first electronic device, which includes a first processor communicating through encrypted channel of first Bluetooth, and a second processor communicating through unencrypted channel of second Bluetooth. The method includes: receiving, by the first processor, a key transmitted from a second electronic device, and transmitting the key to the second processor, the key being transmitted from the second electronic device to the first processor through the encrypted channel of the first Bluetooth; receiving, by the second processor in response to the first electronic device being switched to a system run by the second processor, a first ciphertext transmitted from the second electronic device, the first ciphertext being transmitted from the second electronic device to the second processor through the unencrypted channel of the second Bluetooth; and decrypting, by the second processor, the first ciphertext with the key to obtain the first plaintext.

Abstract: Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include receiving a report of a first anomaly based on real-time control flow graph diagram monitoring of an application at a first system and receiving a second report of a second anomaly from a second system. An exploit report may be generated by providing the first report and the second report to a machine learning model trained to output information related to an exploit based on input reports, and subsequently to provide the output information to a cloud-based reporting tool.

Abstract: A method and system for detecting and mitigation a cyber-attack scanner are provided. The method includes determining if a source network address designated in a received packet is suspicious as of a cyber-attack scanner, wherein the determination is based on a likelihood that the source address was previously frequently encountered; upon determining that the source network address is suspicious, determining diversity of destination network addresses sent by a source having the suspicious network address; and upon determining that the destination network addresses are diversified, generating an alarm indicating that a source network address is a cyber-attack scanner, wherein a cyber-attack scanner is a device to identify destination network addresses in a protected entity that be exploit for at least a cyber-attack scanner.

Abstract: Methods and systems are described herein for novel uses and/or improvements in application or service authentication for a provider of disparate applications and/or services using blockchain technology. As one example, a method and a system are described herein for a unified user device authentication mechanism across multiple lines of service using cryptographic tokens. The system may receive, as part of a login request from a user, an address associated with a cryptography-based storage application, a cryptographic signature, and an identifier associated with a cryptographic token. The system may verify that the cryptographic token is valid and that the cryptography-based storage application controls the cryptographic token to grant the user access to the application or line of service.

Abstract: A network vulnerability scanning system scans a target device for vulnerabilities to obtain network connection data for the target device. The network vulnerability scanning system determines the network connection data includes a network connection between the target device and a hidden network system. The network vulnerability scanning system installs a network scanning application on the target device in response to determining the network connection data includes the network connection between the target device and the hidden network system. The network vulnerability scanning system scans the hidden network system for vulnerabilities via the network scanning application installed on the target device.

Abstract: Past login activity is used to train a machine learning model and pre-compute network intrusion risk profiles. Subsequent login attempts can be evaluated with the pre-computed network intrusion risk profiles. If the profile shows sufficient intrusion risk, actions can be taken to avoid intrusion, such as requiring further authentication steps.

Abstract: In an example in accordance with the present disclosure, a system is described. The system includes a display device and a gaze tracking system to capture eye movements of a user looking at the display device. The system also includes a controller. The controller authenticates the user based on eye movements of the user matching an eye movement authentication pattern. The controller also calibrates a computing device based on the eye movements of the user.

Abstract: An endpoint in an enterprise network is instrumented with sensors to detect security-related events occurring on the endpoint. Event data from these sensors is augmented with contextual information about, e.g., a source of each event in order to facilitate improved correlation, analysis, and visualization at a threat management facility for the enterprise network.

Abstract: A system for encrypting and authenticating communications with mutual authentication of the communicators is used between two parties who exchange messages supported by a communication network in which the parties are unequivocally identified. The system includes processes supported by respective authentication applications available to each party on a hardware/software device, the applications having at least: an identifier (Id) of the authentication application (AA); an encryption key (CC) of each party; a random number generator for encrypting and authenticating messages (Mx); and an encryption algorithm that is shared with the rest of the parties of the system, allowing them to encrypt and decrypt the sent/received messages.

Abstract: In some embodiments, a computer-implemented method for preventing credential passing attacks may include receiving an input; determining whether the input is a credential access command, wherein the determination includes searching for occurrences of references to executables related to adding, reading, copying, or performing actions with respect to a credential, if the input is determined to be a credential access command, performing anomaly detection, wherein performing the anomaly detection includes evaluating whether a user is a valid domain user, whether an elapsed time of the credential is greater than a maximum lifetime of the credential, and whether a privilege attribute certificate of the credential is valid, determining that an anomaly exists if the command was generated by an invalid domain user; an elapsed time of a credential is greater than a maximum lifetime, or the privilege attribute certificate of the credential is invalid, and performing mitigation of the anomaly.

Abstract: Systems and methods of the disclosure provide for receiving, from a GUI on a client device, a request to download and install an OS image and integrated interactive service on a bootable resource; transmitting to the client device the OS image and the integrated interactive service to be installed on the bootable resource, wherein the bootable resource is configured to: on a restart of the client device, boot to the OS image and launch the interactive service; and deny access to any software, service, or resource not available on the bootable resource.

Abstract: An installation method needless of multiple requests for permissions includes executing a first command after a first startup program is run under a non-administrator permission, and starting at least one installation module through a second command after a second startup program is run. The first command is configured to run the second startup program with an administrator permission, and the second command is configured to execute the startup programs with the administrator permission.