Abstract: Obfuscation techniques used in phishing attacks that evade detection using current machine learning models can be identified and statistically characterized for use in generating adversarial training samples to improve the performance of a machine learning model phishing classifier. By using statistical information regarding the prevalence and effectiveness of various obfuscation techniques observed in real-world samples, adversarial samples that are effective and realistic examples of phishing content that evades phishing content classifier detection can be generated and used to augment the data set used for training or re-training the machine learning model classifier.

Abstract: A media docking device includes an input circuit, an output circuit and a processing circuit. The input circuit is electrically connected to a media source device for receiving media data. The output circuit is electrically connected to a media play device. The processing circuit is electrically connected to the input circuit and the output circuit. The processing circuit determines if a verification procedure is passed. If the verification procedure is passed, the processing circuit transfers the media data to the media play device. If the verification procedure is not passed, the processing circuit limits a transmission of the media data, such that the media data will not be completely played by the media play device.

Abstract: Some embodiments address technical challenges arising from efforts to identify and mitigate security risks, in particular but not only, risks that sensitive data will be exfiltrated. Some embodiments provide or utilize an anomaly detector which is configured to detect a security anomaly in data based on at least a distribution of sensitive information type documents in a collection of documents and classifications of documents by trainable classifiers based on machine learning. Some embodiments provide or utilize a security policy generator which is configured to proactively and automatically generate security policy recommendations, rank at least two of the security policy recommendations, and present at least one top-ranked generated security policy recommendation in a user interface. Some embodiments generate a security policy in a managed computing system based on at least an anomaly score, and then configure the managed computing system according to the generated security policy.

Abstract: Aspects of the subject disclosure may include, for example, obtaining first network performance data characterizing a wireless network, wherein the wireless network provides one or more users of a plurality of users access to a collection of servers that enable a plurality of services; obtaining second network performance data characterizing a wired network, wherein the wired network provides the one or more users access to the collection of servers that enable the plurality of services; obtaining first service performance data characterizing a first service of the plurality of services that are enabled by the collection of servers; obtaining first service requirements of the first service; and responsive to a first user of the one or more users indicating a preference to utilize the first service, selecting one of the wireless network or the wired network as a selected network for the first user, wherein the selecting of the selected network is based upon the first network performance data, the second networ

Abstract: It is provided a method comprising: receiving one or more received data sets, wherein each of the received data sets comprises data each representing a value of a respective status parameter of a system, and at least one of the data sets comprises a respective value quality score representing a quality of the value of the respective status parameter: calculating, by a cognitive function, an optimal configuration range set and a confidence score of the optimal configuration range set based on the one or more received data sets; providing the calculated optimal configuration range set and the confidence score to a controller.

Abstract: Disclosed are various embodiments for managing a graph of decentralized identifiers (DIDs) associated with verifiable credentials (VCs) and verifiable credential linkages or relationships including those denoting linkages amongst verifiable credentials of different users. The DID tree graph can be maintained and managed to ensure that the DIDs and corresponding VCs are accurate and that the linkages or relationships between DIDs and corresponding VCs are still valid. The DID tree graph can be queried to identify DIDs associated with a DID subtree representing an established relationship or linkage between one or more VCs.

Abstract: A system for instantly empowering any social network, and /or application, and/or workflow with live collaboration tools, enterprise messaging and data collection without any code modification. The system is incorporated with cross domain network configuration and comprises a server including a processor and a memory having a plugin component or browser extension executed by the processor. The plugin or browser extension component comprises a registration module, a link generation module, and an instant communication module. The registration module enables a service provider to create an account by registering one or more credentials. The link generation module generates a first URL for each registered service provider. The first URL prompts visitor to install or download the browser extension or plugin, respectively. Upon a visitor clicking on a link the system activates a live video conferencing, chat and data collection and scheduling modules.

Abstract: Techniques for monitoring video conferencing quality-of-service in autonomous systems are disclosed. In an example method, a video conference provider establishes a video conference including a plurality of client devices, in which each client device is connected to an autonomous system of a plurality of autonomous systems. The video conference includes a first client device connected to a first autonomous system administered by a communication service provider (CSP). The video conference provider determines, from packets received from the first client device, video conference information. The video conference provider determines one or more metrics about performance of the video conference in the first autonomous system based on the video conference information and outputs the metrics in real-time.

Abstract: Systems and methods for cryptographic key storage management whereby the system receives a first request to access a first API and communicatively connects a channel to a key management service (KMS) that is on a serverless computing platform. After receiving a cryptographic key from the KMS, the system attaches the cryptographic key to the first API, thereby creating a first data structure. The system stores the first data structure to a writable storage location that has a predetermined maximum capacity for data structures. The system receives a second request to access the first API and retrieves and uses the stored first data structure to grant access to the first API. The system also determines when the writable storage location has reached the predetermined capacity and determines and evicts a least recently used data structure stored to the writable storage location.

Abstract: A system for validating communications and publications. A mobile device, such as an Internet of Things (IoT) device, generates time, location and possibly environmental data associated with an individual or an event. A secure storage vault stores the time, location, and environmental data generated by the mobile device or an associated server. The storage vault receives communications and publications associated with the individual or the event and that include their own created time, location, and environmental data; compares the stored data from the storage vault with the created data in the communications and publications; and verifies or refutes the authenticity of the communications and publications based on the comparison.

Abstract: Techniques and architecture are described for a pull model for obtaining and implementing config changes on network devices are described herein. A user submits intent configuration to the network controller that needs to be delivered to several network sites. The network controller generates a config file. The network controller sends a pull notification message to all network devices that need to retrieve the config file. This pull notification message only contains a corresponding transaction ID for each network device and a location for the network device to use to pull the config file. The network devices may utilize a HTTP REST API exposed by the network controller to obtain the config file from the network controller. The network devices may utilize a REST API exposed by the network controller to reply with statuses of the configuration transaction. The techniques and architecture may be applied to multi-tenant network devices.

Abstract: A method for establishing connections and forming groups in an edge computing system includes detecting and identifying devices attempting to connect to the network using a processor. The method involves authenticating detected devices with a common pre-shared key (PSK) stored in memory, forming groups of connected devices based on predefined criteria, and sharing the PSK within each group via a secured channel. It also includes creating a subnetwork or private LAN for each subscriber using network configuration data, assigning virtual pre-shared keys (vPSKs) to devices based on service requirements, determining device capabilities by analyzing received device-specific information, and identifying supported applications based on device capabilities and application compatibility data stored in memory.

Abstract: An edge computing system configured to dynamically distribute in an Elastic Edge Computing Platform (ECP) that includes one or more processors or devices configured to perform dynamic grouping operations for the automatic formation of logical groups that may be used for more efficient resource sharing among edge nodes and devices. A processor in the ECP system may collect information about edge nodes and associated end devices within the ECP system, use the collected information to determine characteristics of the edge nodes and end devices, determine a group objective for each of groups, request membership to one of available groups, cluster the edge nodes based on the determined characteristics and group memberships, and dynamically adjust the group configurations or group memberships based on changes in conditions in the ECP system.

Abstract: Mitigating bias in a machine learning-augmented threat disposition platform can include generating a group of alerts in response to determining a similarity among the alerts. The alerts are generated in real time by a threat monitoring tool in response to one or more potential threats to a networked computing system. One or more alert spikes can be determined by partitioning the group into one or more alert spike subgroups. Each alert spike subgroup corresponds to an alert spike and contains two or more similar alerts that were generated within a predetermined time interval of one another. Duplicate alerts in each alert spike can be eliminated and each non-discarded alert labeled. The labeled alerts are used for training a reduced-bias machine learning model.

Abstract: A bot detection service associated with an overlay network operates to score traffic as a probability of being a bot, as opposed to returning a binary classification (i.e., bot or human). According to the approach herein, scoring is determined through probability estimates, wherein a score (the probability) is based on considering a set of detections concurrently. In one embodiment, all (or substantially all) triggered (current) threat detections contribute to the score. The preferred approach penalizes requests that fail all (or substantially all) combinations of detection algorithms. According to a further feature, an automated tuning (autotuning) is also applied, e.g., using real-time empirical statistical models, to adapt the measurement of false positive probability for one or more threat detection algorithms to suit customer traffic trends. The approach herein is also extensible to include any number of future threat detection algorithms.

Abstract: An example method of position information authentication for a location application performed by a UE, the method comprising determining by a position engine, a position estimate of the UE and determining by the position engine, a position report message indicating the position estimate. The method also comprises determining by a security module, a digital signature generated using a first private key known to the UE and the position report message. The method further comprises transmitting the position report message associated with the digital signature to a location application executed by the UE or another device, wherein the location application is configured to provide one or more location-based services to the UE using the position estimate responsive to a successful authentication of the position report message using the digital signature generated based on the first private key.

Abstract: The present invention encompasses systems, computer program products, and methods for machine interpretation of security data. It identifies various data sources providing metrics and parameters, which include system logs, network traffic data, user activity records, and application logs. The system retrieves these metrics and parameters through an application programming interface and transforms them from unstructured to structured data. This structured data is then featured and stored. A dynamic consolidated matrix, known as the Constraint Specification Matrix (CSM), is generated from these features. A machine learning model is trained to discern correlations and patterns within the CSM's features. Lastly, the system transmits instructions to present these correlations and patterns via a user interface on a user device, allowing for user-friendly visualization and interpretation of the analyzed security data.

Abstract: A method of providing access to a blockchain to a third party. The method comprises receiving by a first application a request from the third party to read data from the blockchain, wherein the request identifies an item of data stored in the blockchain; sending by the first application a request to obtain a first encryption key that is operable to decrypt the item of data; receiving the item of data by the first application from a second application; decrypting the item of data by the first application using the first encryption key; identifying a first part and a second part of the item of data by the first application; encrypting the first part of the item of data by the first application using a second encryption key; and sending the encrypted first part of the item of data by the first application to the third party.

Abstract: Systems and methods are provided for automatically generating unique identifiers for text fields and determining the type of information of a specific text field in an online user journey. The method identifies a data type identifier for each text field by training on historical sessions from many user interactions to group text fields, even with randomly generated IDs, and based on the metadata associated with the text fields. The method can predict the data type for new data and can enable the automatic selection and application of a correct keystroke dynamics algorithm for authentication and fraud detection.

Abstract: A method executed by processing circuitry, includes receiving, from a user interface (UI), one or more network assurance policies configured to be used in a CPE; receiving, periodically from a change request (CR) adaptor service, one or more active change requests (CRs) configured to be implemented; storing the one or more active CRs to an active scheduled CR table included in a network assurance policy database (DB); filtering, by an ingestion service of the CPE that screens incoming event streams based on the one or more network assurance policies, further the incoming event streams based on the active CRs within the active scheduled CR table; and discarding each incoming event from the incoming event streams that matches a dependent network element (NE) or a dependent network service (NS) that is within a CR time window where the CR time window is a period where a CR is being implemented.