Abstract: Systems and methods for autonomous device procurement are disclosed. A system can obtain point-of-sale (POS) terminal demand data and execute a machine-learning model to generate a forecasted inventory demand for POS terminal devices. The system can allocate the forecasted demand among devices based on ratios, simulate demand instances, calculate losses, and modify the allocated demand based on the losses. The system can generate a procurement plan based on the modified demand. The system may autonomously procure devices according to the plan. The forecasted demand may comprise a probabilistic distribution for multiple future time periods. The system may calculate a conditional value at risk (CVaR) based on the losses and generate the plan based on the CVaR.

Abstract: Embodiments relate to providing granular level document security with role-based access. A technique includes determining, by a first artificial intelligence (AI) model, segments of a document and generating, by a second AI model, tags for the segments of the document, the tags being unique identifiers for the segments. The technique includes defining permissions for the tags in an access control table based on a plurality of identifications, an identification being in the plurality of identifications. The technique includes, in response to receiving the identification with a request to access the document, extracting the tags permitted for the identification from the access control table, and filtering the document according to the segments for the tags permitted for the identification. The technique includes, in response to the request to access the document, causing the document that is filtered to be rendered with the segments for the tags permitted for the identification.

Abstract: This document discloses aspects of enforcing compliance of data use policies. In aspects, a network function receives, from an application, a message that includes data to upload from a device. In response, the network function executes a compliance function associated with a type of the data in the message. The compliance function can assert a data use policy based on a state (e.g., populated) of a field of the data and determine whether a user of the device has accepted the data use policy asserted for the data in the message. The compliance function can allow the upload of the data from the device based on compliance with the data use policy or blocks the upload of the data based on a lack of compliance with the data use policy. By so doing, the compliance function can ensure that data uploaded from the device complies with user-accepted data use policies.

Abstract: An information processing system, apparatus, and method are disclosed each of which: receives a request for using an application from an electronic device via a network; determines whether the requested application is applicable to the electronic device and is currently useable by the electronic device; determines whether a number of devices currently using the requested application has reached an upper limit number that is previously set, when the determining determines that the requested application is applicable to the electronic device but is not currently useable by the electronic device; and allows the electronic device to use the requested application, when the determining determines that a number of devices using the requested application has not reached the upper limit number.

Abstract: A rootkit detection system and method analyzes memory dumps to determine connections between intercepted system driver operations requested by unknown files and changes in system memory before and after those operations. Memory dump differences and I/O buffers are analyzed with machine learning models to identify clustered features associated with rootkits.

Abstract: A system and method for the synchronized release of electronic data are disclosed. A staging package comprising an encrypted payload and a verification hash is distributed to a plurality of listening nodes at a first time (T1). The listening nodes stage the payload in an inert state. At a second time (T2), a decryption key is broadcast, enabling the nodes to locally transform the encrypted payload into transformed data and verify its integrity via a bit-level match against the verification hash. In certain embodiments, a listening node apparatus comprises a secure processing environment configured to generate hardware-attested proofs of staging as a prerequisite for transformation. A distribution authority may further utilize a global state engine to programmatically gate access or transactions based on the compliance status of individual nodes, ensuring that the local transformation occurs contemporaneously across the network and according to a coordinated release schedule.

Abstract: A method for securing data access by containerized applications includes intercepting, by a first container executing on a first computing device and associated with a containerized application in a second container executing on the first computing device, a first Internet Protocol (IP) request from the containerized application. The first container determines that the IP request is addressed to a second computing device executing a resource that the containerized application is authorized to access. The first container encrypts a payload portion of the IP request and transmits, to the resource, a second IP request with the encrypted payload portion. The first container receives, from the resource, a response. The first container requests, from a third computing device, a cryptographic key for decrypting the response. The first container decrypts, with the cryptographic key, a payload portion of the response and transmits, to the containerized application, the decrypted payload portion of the response.

Abstract: An apparatus and method for autonomously operating a service environment. The apparatus includes a processor configured to receive a service request from a user interface, process the service request by indexing data extracted from the service request using a rule-based algorithm to classify the extracted data to a plurality of data structures, generate a digital access token as a function of the service request using a token generation module, and initiate a service protocol as a function of the digital access token, wherein initiating the service protocol includes transmitting the digital access token to a access control system, and authenticating the digital access token using the access control system.

Abstract: Techniques are described for providing session management functionalities using an access token (e.g., an Open Authorization (OAuth) access token). Upon successful user authentication, a session (e.g., a single sign-on session) is created for the user along with a user identity token that includes information identifying the session. The user identity token is presentable in an access token request sent to an access token issuer authority (e.g., an OAuth server). Upon receiving the access token request, the user identity token is parsed to identify and validate the session against information stored for the session. The validation can include various session management-related checks. If the validation is successful, the token issuer authority generates the access token. In this manner, the access token that is generated is linked to the session. The access token can then be used by an application to gain access to a protected resource.

Abstract: Various embodiments include systems and methods of implementing automated assessment scheduling. A particular automated assessment may be automatically performed based at least in part on an assessment configuration and scan engine resource(s) of an organization. Based at least in part on performance of the particular automated assessment, a scan engine utilization assessment may be performed to determine a scan engine utilization value that represents utilization of the scan engine resource(s) with respect to resource requirements that are based at least in part on the set of attributes of the assessment configuration. Based at least in part on the scan engine utilization assessment, a particular resource utilization recommendation may be generated. The particular resource utilization recommendation may correspond to a first resource utilization recommendation to allocate additional scan engine resources or a second resource utilization recommendation to allocate fewer scan engine resources.

Abstract: A method for protecting data transmission in an ad hoc network including nodes, each node including a private key, a public key and a certificate of the public key signed by a certification authority, the method including transmitting by the first node to the second node: a first message signed with the private key of the first node; a third message containing a first set of initialization data including: a first certificate including the public key of the first node, signed by the certification authority; a second data set including the IP address of the first node; and the first certificate associated with the IP address of the first node, wherein the second data set is signed with the private key of the first node.

Abstract: Systems and techniques for database threat detection are described. First login data for a first database that includes a first aggregation key may be received. A first counter that tracks first events associated with the first database may be determined. A first value of the first counter associated with at least the first aggregation key may be determined. A first feature value associated with the first aggregation key may be determined using the first value. An aggregated anomaly detection score may be determined by combining the first anomaly detection score and a plurality of other anomaly detection scores. A determination may be made that the first login data represents anomalous database activity for the first database by comparing the aggregated anomaly detection score to a threshold anomaly detection score. First output data indicating that the first login data represents anomalous database activity for the first database may be generated.

Abstract: A method may include receiving configuration data associated with an application used for secure data transfers. The method may include accessing certificate data indicating a certificate chain from a certificate service. The method may include generating a configuration script based at least in part on the configuration data and including at least a portion of the certificate data in the certificate data. The method may include generating a script hash based on at least a portion of the configuration script. The method may include receiving a validation signature for the configuration script from the certificate service. The method may include providing the configuration script, the script hash, and the validation signature to a user device may include the application used for secure data transfers such that the application is modified using the configuration script.

Abstract: Methods and system implement solutions for integrating encryption and emulation into native database formats and/or architectures. “Native” database is used to describe a database that has not been designed for end to end encryption, an off the shelf database deployment, and/or a commercially available database. According to some embodiments, various encryption systems and methods employ emulation operations to enable a native database and native database functions to leverage full encryption primitives. Various aspects integrate emulation operations into standard database implementations, where the emulation enables native database functions to operate on entirely encrypted data.

Abstract: The present technology provides a versatile content management system that can also support bi-directional synchronization of an organization account. The organization account is maintained as a plurality of root directories that can be mounted under an organization directory top-level folder. The organization directory top-level folder can appear in a user account's view of the organization account, by does not actually exist as a directory in the content management system. The organization directory top-level folder can be a folder created on a client device in which root directories of an organization account are mounted, but the organization directory top-level folder is not a synchronized directory. The organization directory top-level folder gives the appearance of a single directory structure for an organization even though the organization content is actually organized into the plurality of root directories.

Abstract: A method includes receiving, by a first device that is included in a first network and a second network, a request from a second device to join the first network. The method also includes making, by the first device, determinations of whether to transmit the second device a first credential corresponding to the first network and whether to transmit the second device a second credential corresponding to the second network. The method also includes using the determinations as a basis to select, as content for a message, the first credential, the second credential, or an indication that the second device is not allowed on the first network and not allowed on the second network. The method also includes transmitting the message that includes the content to the second device.

Abstract: A system for protecting source code from unauthorized access is disclosed. The system is configured to scan the source code and identify code segments, including function code. The system may perform code obfuscation, code separation, and code encryption. The system may extract a first set of code features from the function code. The first set of code features indicates a first task associated with the function code. The system accesses a training dataset comprising a sample code that is associated with a second task and a template code. The system compares the first task with the second task. In response to determining that the first task corresponds to the second task, the system obfuscates the function code with the template code. In response, the system updates the source code to include the obfuscated function code.

Abstract: The present disclosure generally relates to predicting and remediating fraudulent activity associated with a roaming SIM card. Systems described herein involve detecting potential fraud signals associated with a roaming SIM card and applying one or more machine learning models to those signals to generate a fraud prediction. In one or more examples, the potential fraud signals are detected in connection with one or more core network components of a 5G telecommunication network and provide unique insight into the network activities of a user equipment where the roaming SIM card is installed. As such, the systems described herein generate fraud predictions that take into account signals that are not necessarily indicative of fraud by themselves. Once fraud is predicted, the systems described herein execute various remediation actions to correct the fraudulent activities.

Abstract: A method, computer program product, and computer system for receiving, by a computing device, an indication that a software component is to be released for delivery to a customer. A predefined and non-modifiable industry-standard security profile may be selected defining one or more security scans to be executed in accordance with at least one of an application-security framework and a secure-development standard. The one or more security scans may be executed against the software component using the predefined and non-modifiable industry-standard security profile to identify one or more vulnerabilities. It may be determined that the one or more vulnerabilities that exceeds a remediation threshold has been remediated.

Abstract: Embodiments herein include generating a safe copy of a first control block for an operating system, recording the safe copy in memory, initiating a test of an authorized service associated with the operating system, identifying a vulnerability for the authorized service that includes comparing a state of the first control block after the test of the authorized service with the safe copy recorded in memory, and initiating an action to alleviate the identified vulnerability.