Abstract: Clustering is provided of computer security attacks by the threat actor based on features of the attacks. Attack data is obtained for a given attack and a plurality of features of the given attack are extracted from a plurality of attack attributes. A feature-based score is computed for the given attack based on the extracted features relative to each of a plurality of attack clusters. Each attack cluster is comprised of a plurality of attacks performed by a particular attacker. The given computer security attack is assigned to a particular attack cluster if the feature-based score for the particular attack satisfies a predefined score criteria.

Abstract: Testing a system against fuzzing attacks includes negating all regular expressions used in the corresponding language, and applying those negated regular expressions to a system interface. Only expressions definitively outside the scope of protocol specification implicate vulnerabilities to fuzzing attacks. The system detects fuzzing attacks by continuously monitoring packets of data and only passing through packets that conform to regular expressions of the language.

Abstract: Methods and systems for securing communications with an enterprise from a remote computing system are disclosed. One method includes initiating a secured connection with a VPN appliance associated with an enterprise using service credentials maintained in a secure applet installed on a remote computing device, and initiating communication with an authentication server within an enterprise via the secured connection. The method also includes receiving specific credentials from the authentication server, terminating the secured connection with the VPN appliance, and initiating a second secured connection with the VPN appliance using the specific credentials, the specific credentials providing access to one or more computing devices within the enterprise being within a same community of interest as the remote computing device and obfuscating one or more other computing systems within the enterprise excluded from the community of interest.

Abstract: Storage end points, whether they are local, remote, network, or cloud, such as DROPBOX and APPLE, present security issues for the general public and corporate consumers. These storage end points are not always encrypted. Even when the end user does perform encryption, the drawback to normal implementations is that the entirety of the file, the file key, and the key store are encrypted and stored in a single location. Computers can be hacked and encryption can be broken when given access and time. Disclosed is a system and method that enhances file level security by shredding the file, file pointers, and key store into parts, allowing the parts to be stored in different storage end points specified by the user.

Abstract: In a computer-implemented method for signing a message by a user device of a public key infrastructure (PKI) system, the message and a user public key are sent to at least one attestation server and a server signature on the message is received from the attestation server. The server signature attests the validity of the user public key and is bound to the user public key and the message. The message and the server signature are signed with a user private key, thereby providing a user signature on the message. An attestation server and a related computer program product are also provided.

Abstract: A method for multi-factor authentication with a first client includes receiving a request associated with the first client, initiating an authentication transaction, generating a digital fingerprint based on a set of client properties collected in association with the first client, identifying a second client from data associated with the authentication transaction, analyzing a digital fingerprint based on a set of stored digital fingerprints; generating a concern metric based on the analysis; and notifying an entity that the login request may have originated from an unauthorized source.

Abstract: An entity authentication method includes: an entity A generates and sends NA to an entity B; the entity B generates NB and ZSEEDB, computes a key MKA?KEIA and first encrypted authentication data AuthEncDataB, and sends the NB?NA?AuthEncDataB to the entity A for verification; the entity A generates ZSEEDA, computes second encrypted authentication data AuthEncDataA, a shared key seed Z, a master key MK and a first message authentication identifier MacTagA, and sends the NA?NB?AuthEncDataA?MacTagA to the entity B for verification; the entity B computes Z, MK and MacTagA, compares the MacTagA with the received MacTagA, and if the two are equal, considers that the entity A is valid; the entity B computes and sends a second message authentication identifier MacTagB to the entity A; and the entity A computes MacTagB, compares the MacTagB with the received MacTagB, and if the two are equal, considers that the entity B is valid.

Abstract: A computerized system for recursively detecting anomalies in monitored behavior of entities. The system comprises a storage unit to store monitored events, event deviations and parameters related to each event and to each event deviation. The system comprises a processing unit configured to receive a plurality of input events, construct a plurality of baseline models, receive an input event that occurred during an analyzed timeframe, compare parameters of the received input event to a corresponding baseline model in order to detect an event deviation, and associate an event deviation score to the detected event deviation. Using the detected event deviation as an input event, said operations are repeated until a predetermined condition is satisfied, and an alert is generated, indicating suspicious activity has been detected. A viewer application configured to receive and display alerts relating to the detected event deviation is provided.

Abstract: An information processing apparatus sends a management apparatus execution information about processes that the information processing apparatus has executed while performing a task in response to an instruction from the management apparatus. The management apparatus stores the received execution information in a storage unit. A security detection program monitors the information processing apparatus, and when detecting an alert, sends alert information including information about a process or command being executed by the information processing apparatus, to the management apparatus. The management apparatus receives the alert information, and performs filtering of determining, on the basis of a schedule and the execution information, whether the alert information relates to a task that the management apparatus has instructed the information processing apparatus to perform.

Abstract: Embodiments for scanning data within and between distributed computing components by a processor. Data scanning functionality is allocated through an object storlet located at a local node of the distributed computing components. The data scanning functionality is performed using computational components of the object storlet on local data contained within the local node to alleviate transfer of the local data outside of the local node to be scanned.

Abstract: Entities of an organization may have difficulties generating and remembering strong passwords. A password management service may generate passwords with high entropy and aid entities in remembering generated passwords. The password management service may generate a list of passwords based on a seed value provided by the entities. The entities may then select a password from the list of passwords to be used at the entities' password. Furthermore, the entities may be allowed to save the list of passwords to aid the entities in remembering their selected password from the list of passwords.

Abstract: Methods and apparatus are provided for detecting suspicious network activity, such as in an enterprise network. An exemplary method comprises obtaining network event data for a plurality of user-server communications for a given user, determining a number of distinct servers the user communicated with during a predefined time window; determining a number of distinct servers the user failed in authenticating to during the predefined time window; and assigning a risk score to the user based on the number of distinct servers the user communicated with and the number of distinct servers the user failed in authenticating to during the predefined time window. Generally, the risk score provides a measure of an anomalousness of the user communicating with the number of servers during the predefined time window. An absolute score is optionally assigned based on an evaluation of the number of distinct servers the user communicated with during the predefined time window relative to a predefined threshold number.

Abstract: A mobile commissioning device for assisting in the commissioning of wireless public-key encrypted networks, the device being provided with: means for reading the public key from a network node to be integrated in the wireless network, the channel for reading the public key being physically different to the wireless network channel for which the node is to be commissioned, means for at least temporarily storing the read public key in the device, means for transferring a public key of the commissioning device to the network node to be commissioned, the channel for transferring the public key preferably being the wireless channel for which the node is to be commissioned, and means for transferring the read public key to a trust center.

Abstract: Encryption and decryption techniques based on one or more transposition vectors. A secret key is used to generate vectors that describe permutation (or repositioning) of characters within a segment length equal to a length of the transposition vector. The transposition vector is then inherited by the encryption process, which shifts characters and encrypts those characters using a variety of encryption processes, all completely reversible. In one embodiment, one or more auxiliary keys, transmitted as clear text header values, are used as initial values to vary the transposition vectors generated from the secret key, e.g., from encryption-to-encryption. Any number of rounds of encryption can be applied, each having associated headers used to “detokenize” encryption data and perform rounds to decryption to recover the original data (or parent token information). Format preserving encryption (FPE) techniques are also provided with application to, e.g., payment processing.

Abstract: A device protects an incoming multimedia signal with a protection that is controllable and configured for enabling or disabling an application for an interface protection on an outgoing signal coming from the incoming signal. An output interface is configured for delivering the outgoing signal on an output. An authorization process is performed for authorizing or otherwise a control over the enabling or disabling of the interface protection application depending on security rules.

Abstract: A method and system for scanning a computing system network for dark matter computing systems and computing devices. The method includes establishing a communication link between a master server and at least one target scanning agent that has at least one network computing system coupled thereto, creating a scanning job for the target scanning agent, building a scanning job command based on the scanning job, sending the scanning job command to the target scanning agent, receiving scanning job results from the target agent, parsing through the received scanning job results for identifying information of hosts in the network computing system detected during the scanning job, determining which detected hosts are known hosts and which detected hosts are unknown hosts based on the identifying information, and comparing the identifying information of the unknown hosts to reference identifying information to determine which of the unknown hosts are dark matter.

Abstract: A system and a method are disclosed for determining malicious web requests. The system processes incoming web requests to determine whether a request matches predetermined patterns of suspicious requests. The systems stores associations between patterns of suspicious requests, parts of the web request where each pattern occurs, and attack type associated with the pattern. If the system determines that an incoming web request matches a pattern of a suspicious request, the system determines whether to forward the request to the web server for processing or to hold the request. The system locks out a source of request for a period of time if the source sends requests that match certain attack patterns.

Abstract: According to some embodiments, a proxy server comprises one or more processors operable to establish communication with a secure client application of a device. The client is configured with a partition that contains data received from the proxy server within the secure application. If the client passes authentication, the server communicates preview information to the client previewing files that the server received from a business server on behalf of the client. The client requests a selected file. The server renders the selected file into a first portion and a second portion based on the immediate display capabilities of the client. The server communicates the first portion, determines that a trigger point was reached, and then communicates the second portion in response to the trigger point being reached. The client is configured to delete the first portion and the second portion in response to a completion event.

Abstract: An aspect of the present disclosure facilitates third parties/server system to perform batch processing of requests requiring authorization from resource owners for repeat access to resources. In one embodiment, a server system/third party selects a next request from a batch of requests, with the next request requiring a protected resource (hosted on a second party) owned by a owner/user (first party). The server system checks whether an access token is present authorizing access of the protected resource by the server system on behalf of the owner. If the access token is not present, the server system communicates in an offline mode with the owner to receive the access token. The server system then processes the next request by accessing the protected resource using the present/received access token.

Abstract: A device, method and product for port-scrambling-based networks. The method comprising in response to a device intending to transmit an outgoing communication to a target device in a computer network, via a first port, scrambling the first port of the outgoing communication to obtain a second port by applying a transformation function which utilizes a certificate that is shared among a portion of the devices in the computer network; and transmitting the outgoing communication to via the second target port. The method comprises receiving, via a second source port, an incoming communication from a source device in the computer network, descrambling the second source port of the incoming communication to obtain a first source port by applying a reverse function of the transformation function; and directing the incoming communication at the first source port instead of the second source port.