Abstract: In embodiments, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation.

Abstract: Implementations can provide a method that includes: accessing the source code of a script hosted by a remote server; extracting features from the source code in accordance with a machine-learning model comprising one or more layers of logic; at least based on the machine-learning model, determining, for each of the extracted features, a corresponding probability conditioned on the source code containing ransomware; and at least based on the machine-learning model, determining a combined probability for the extracted features conditioned on the source code containing ransomware when the extracted features are jointly present; comparing the combined probability with a threshold; in response to determining that the combined probability exceeds the threshold, flagging the source code as containing ransomware; and in response to determining that the combined probability does not exceed the threshold, flagging the source code as not containing ransomware.

Abstract: This disclosure describes techniques for device authentication and/or pairing. A display system can comprise a head mountable display, computer memory, and processor(s). In response to receiving a request to authenticate a connection between the display system and a companion device (e.g., controller or other computer device), first data may be determined, the first data based at least partly on audio data spoken by a user. The first data may be sent to an authentication device configured to compare the first data to second data received from the companion device, the second data based at least partly on the audio data. Based at least partly on a correspondence between the first and second data, the authentication device can send a confirmation to the display system to permit communication between the display system and companion device.

Abstract: Methods and apparatuses are described for secure compliant storage of server access data. A server computing device generates one or more access logs based upon data access requests executed on a first compliant data storage container comprising a plurality of files. The server computing device stores the one or more access logs in a non-compliant data storage container and establishes a second compliant data storage container. The server computing device retrieves, from the non-compliant data storage container, the access logs stored therein and stores the access logs in the second compliant data storage container.

Abstract: A privacy proxy device for maintaining privacy on a communication network is provided. The privacy proxy device includes a transceiver, a processor, and a memory. The transceiver communicates with at least one user device and at least one device capable of recording over a communication medium of the communication network. The memory store computer-executable instructions, which, when executed by the processor, cause the privacy proxy device to store a plurality of privacy settings including one or more recording settings. The instructions further cause the privacy proxy device to receive a request to record from a recording device of the at least one device capable of recording. The instructions also cause the privacy proxy device to compare the request to record to the plurality of privacy settings. In addition, the instructions cause the privacy proxy device to generate and transmit a response to the request to record based on the comparison.

Abstract: In various embodiments a plurality of computing devices may perform methods for providing information security services for a communication network, including performing a consensus operation to determine whether a client device is authorized to request a document operation, wherein each computing device is assigned to one of a plurality of trust zones each including a number of computing devices less than or equal to a threshold number of computing devices, and performing the document operation for the client device in response to determining by the plurality of computing devices that consensus exists among the plurality of trust zones that the client device is authorized to request the document operation.

Abstract: A system, method and apparatus to authenticate an endpoint having a secure memory device. For example, a card profile can be selected, configured, and/or stored into the secure memory device based on endpoint identity data representative of a component configuration of the endpoint, including the device identity representative of the memory device and other components. The card profile can be used by the endpoint to emulate a physical smart card and can be viewed a virtual smart card, such as a virtual subscriber identification module (SIM) card for accessing a cellular connection.

Abstract: A control method that, in an information management system including a plurality of servers each having a distributed ledger, is executed by a server from among the plurality of servers, includes: receiving first transaction data that includes identification information and permission or non-permission information, the identification information being associated with user information that is managed in the information management system and relates to a first user, the permission or non-permission information indicating whether provision of the user information to a second user is permitted; and storing the first transaction data received, in the distributed ledger in each of the plurality of servers.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed to determine mutex entropy for malware classification. An example apparatus includes interface circuitry to access a mutex associated with a software application, the mutex to include a mutex identifier string, normalizer circuitry to normalize the mutex identifier string, character probability circuitry to determine character probabilities of characters within the normalized mutex identifier string, the character probabilities based on a historical mutex character distribution, entropy calculator circuitry to calculate an entropy value for the mutex based on the character probabilities, classifier circuitry to classify the mutex as clean or malicious based on the entropy value, and protector circuitry to mitigate malicious attacks based on the classification.

Abstract: Input information acquisition means (101, 201) of an authentication system (S) acquires input information, which accompanies a card possessed by a user, and has been input from a user terminal through use of reading means (33A) or photographing means (36). Identification information acquisition means (102, 202) acquires identification information that enables identification of the card. Registered information acquisition means (105, 203) acquires registered information, which accompanies the card, and has been registered in a server in association with the identification information in advance. Authentication means (103) executes authentication based on the input information and the registered information.

Abstract: Methods and systems for detecting ransomware attacks on an SMB (Server Message Block) file sharing system are disclosed. A user's request for access to the SMB file sharing system is authenticated and an SMB session for the user is initiated. During the SMB session, SMB commands issued by the user are detected and logged. The detected commands are evaluated against a profile of normal file sharing activity by this user. In case a deviation from the user's activity profile is detected, recent SMB commands from the user are evaluated against a library of patterns of SMB commands indicative of ransomware activity. In case the recent SMB commands from the user match a ransomware command pattern, the user's SMB session is immediately terminated, thus mitigating further damage by the ransomware.

Abstract: Systems and methods for performing biometric authentication using a smart ring are disclosed. An exemplary method includes collecting biometric data using sensors of a smart ring while a user is wearing the smart ring, wherein the biometric data includes a heartbeat pattern. The method further includes performing an authentication operation by (i) comparing the collected biometric data to a biometric signature for a known user to determine whether the biometric data matches the biometric signature, and (ii) when the biometric data matches the biometric signature, authenticating the user by updating a record to indicate that the user has been identified and authenticated as the known user. The method also includes, when the record indicates that the user has been identified and authenticated, digitally signing transaction data using a private cryptographic key stored on a memory of the smart ring.

Abstract: A rule generator can automatically generate a machine-learning-powered detection system capable of recognizing a new malicious object or family of malicious objects and deployable as a text-based, pastable detection rule. The text may be quickly distributed and integrated into existing cybersecurity infrastructure, for example, if the cybersecurity infrastructure supports a rules engine. After initial distribution, the identity may be refined, updated, and replaced. This allows for rapid development and distribution of an initial level of protection, and for updating and improvement over time.

Abstract: Systems and methods for implementing a system for analyzing large amounts of event data to determine any potential security threats or anomalies. Event data may be obtained and processed. The processed event data may be analyzed to detect any potential security threats or anomalies.

Abstract: In response to a radio link failure between given user equipment and a source access node of a communication system during a data transfer operation over a control plane, a method is provided for recovering the radio link for the given user equipment through a target access node of the communication system. The radio link recovery is enabled via a mobility management node of the communication system using a non-access stratum security context previously established between the given user equipment and the mobility management node.

Abstract: The present description concerns an electronic system including one or a plurality of first microprocessors, a second microprocessor for securely managing first encryption keys of the first microprocessors, the second microprocessor being configured to communicate with each first microprocessor and including a first non-volatile memory having at least one second key stored therein, and for each first microprocessor, a second non-volatile memory external to the second microprocessor and containing the first keys of the first microprocessor encrypted with the second key.

Abstract: There is provided a technique of clock managing in a packet data network implementing a time-transfer protocol. The technique comprises: modifying, by the timing-server, a timestamp record to enable a controllable access to data informative of the least significant part of clock-informative data (CLSP data), wherein modifying the timestamp record comprises modifying the least significant part of the timestamp record (RLSP) to comprise the CLSP data in an encrypted form or to comprise values substituting, in a predefined manner, the CLSP data; transferring the modified timestamp record to all timing-clients, wherein CLSP data are transferred in a controllable access manner; enabling access to the CLSP data merely to authorized timing-clients among the plurality of timing-clients; and enabling the authorized timing-clients to obtain the CLSP data and synchronize the respective clocks using the CLSP data together with data informative of the most significant part of the clock-informative data.

Abstract: A permissions management system is disclosed for enabling a user to securely authorize a third-party system to access user account data and initiate transactions related to a user account, without disclosing to the third-party system account credentials. The system enables the user to also securely de-authorize the third-party system. For example, records may be automatically generated that securely store account information, including one or more permissions related to the account and/or the third-party. A token associated with a record may be shared with the third-party system, but neither the record itself, nor the user account credentials, may be shared with the third-party. Accordingly, the third-party may request user account data and/or initiate transactions by providing the token, but does not itself know, e.g., the user account credentials. Further, the user may set various permissions related to the token, and may also revoke the token (e.g.

Abstract: A terminal for performing authentication through TLS 1.3 with a server connected via a communication network. The terminal includes a memory and a processor configured to execute transmitting, to the server, a ClientHello message including a first identifier and a first short-term public key, which are needed to generate a shared key for encrypting a message during a handshake in the TLS 1.3, through key exchange with mutual authentication using ID-based encryption; receiving, from the server, a ServerHello message including a second identifier and a second short-term public key, which are needed to generate the shared key; and generating the shared key using the first identifier, the first short-term public key, the second identifier, and the second short-term public key.

Abstract: To provide a terminal registration system and a terminal registration method for improving user convenience in registration of a new terminal to a plurality of service sites. The registered terminal 1 includes an Authenticator 10 including service site list information 110 that associates private keys and URLs for access to service sites with each other. A Registration Manager 100 acquires the service site list information 110 from the Authenticator 10 of the registered terminal 1. Then, the Registration Manager 100 performs FIDO authentication for a registration target service site using a private key of the registered terminal 1, on the basis of the acquired service site list information 110, and performs Registration of a newly generated cryptographic key at the new terminal 2.