Abstract: The invention enables detecting and handling threats or malicious activity in network-based communications and/or transactions. In an embodiment of the invention, a data message is received from a remote entity, wherein said first data message includes a first originating internet protocol (IP) address. A data message record having a second originating IP address that matches the first originating IP address, is identified from among a stored set of data message records. The identified data message record is parsed to extract data that identifies the second originating IP address as legitimate or anomalous. Responsive to determining that the second originating IP address is anomalous, a processor implemented instance of a threat handling process flow may be implemented. The determination that the second originating IP address is anomalous may be performed based on a combination of outputs from a variational autoencoder and a graph neural network.

Abstract: Identifier acquisition methods and apparatuses, devices and media are provided. When an identity token carried in an identity authentication request from a master application client is authenticated, an application management terminal transmits a first user identifier registered in the master application client by a target user corresponding to user information carried in the identity authentication request to the master application client. The master application client transmits the first user identifier and the identity token to a micro application client, so that the micro application client transmits an identifier acquisition request carrying the first user identifier and the identity token to the application management terminal.

Abstract: A system and method for cyber exploitation path analysis and task plan optimization to minimize network exposure and maximize network resilience. The system and method involve gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Lastly, network attack path analysis and automated task planning for minimizing network exposure and maximizing resiliency is performed with machine learning, generative adversarial networks, hierarchical task networks, and Monte Carlo search trees.

Abstract: A method, system, and computer-readable storage media for data ingestion are disclosed. Input messages directed to a user are received. Further, it is determined whether one or more of the input messages are spam messages. Upon determining the one or more of the input messages as the spam messages, the spam messages are filtered from the input messages. Further, it is determined whether remaining input messages pose a security risk based upon a risk score of each of the remaining input messages that meets a specific threshold condition. When the remaining input messages pose a low security risk, personal identifiable information is identified in the remaining input messages. Data corresponding to the personal identifiable information is masked to remove and/or hide the personal identifiable information from display of the remaining input messages. Upon masking the data, the remaining input messages are transmitted to a storage device.

Abstract: Embodiments of this specification provide a log-structured secure data storage method and apparatus, to securely store data in a hard disk in a trusted execution environment (TEE). Such a data operation is performed based on the following three logical data structures: a data block on which an operation such as write/read/retrieval can be performed, a secure index, and a security log. The data block is appended to the hard disk in a ciphertext form. The secure index is an index that is created based on a log-structured merge tree for each index entry generated for each ciphertext data block. The security log is used to record, in the append manner, operation information of writing the data block or the index entry to the hard disk. Such a data storage architecture can reduce, on the basis of data confidentiality, write amplification of storing data in the hard disk in the TEE.

Abstract: A system and method for the privilege assurance of enterprise computer network environments using attack path detection and prediction. The system uses local session monitors to monitor logon sessions within a network, track session details, and log session and network host details. Cyber-physical graphs are produced and used to identify paths within the network based on the logged information, and to apply risk weighting to the identified paths and determine likely attack paths an attacker may use.

Abstract: Techniques for switches to establish trust with connected network interface cards (NICs) without the need of authorization servers. When an unauthorized NIC of a server is connected to a port of a switch, the switch provides port security such that hosts running on the server are unable to gain unauthorized access to resources. The switch may apply a default ACL to unauthorized NICs that allows limited communications, such as only communications to foundation services. The switch may establish trust with NICs using Public Key Infrastructure (PKI) vended identities. The unauthorized NIC may perform an attestation handshake with a PKI service to receive an identity certificate. A root certificate of a PKI service is stored on the switch which is used by the switch to verify the identity certificate of the NIC. Once authorized, the switch may construct ACLs that permit the NIC to communicate with other resources.

Abstract: A system and method for providing time-series geospatial data and a world-scale simulation platform used to generate simulated-world environments by rendering data-dense geographical regions corresponding to heterogenous sourced data and formats for highly scalable parallel simulations, and comprised of a multi-dimensional time-series database used for enabling query support across multiple simulations via individual simulation and entity swimlanes for cyber, physical and cyber-physical entities and regions.

Abstract: A system and method for enforcing a no-harm directive in artificial intelligence systems using a unified training-and-runtime control framework. A harm functional assigns quantitative harm scores to candidate actions in a given state or context, and a policy model is trained via constrained optimization to maximize a primary utility subject to harm constraints, including probability-of-harm limits, tail-risk limits, and optionally cumulative harm budgets. A runtime safety enforcement module mediates deployment by evaluating proposed actions using a harm predictor and constraint policy, and by performing interception, substitution with safe alternatives, or abstention when constraints are predicted to be violated or confidence is insufficient. A monitoring and audit pipeline records decisions and outcomes and may generate triggers for recalibration, rollback, or retraining.

Abstract: One or more capabilities of the client device are determined at the client device. A request for a security profile is transmitted from a client device to a remote server. The request includes information related to the one or more capabilities of the client device. The security profile, defining a set of communication parameters based on at least some of the one or more capabilities, is received at the client device from the remote server. The received security profile is interpreted by the client device to obtain instructions for establishing the secure communication channel. The secure communication channel with a second server is then established by the client device based on the instructions from the security profile.

Abstract: An open-source intelligence (OSINT) monitoring engine operating as an AI-driven system for monitoring incoming content received from an OSINT source to detect emerging cyber threats is described. The OSINT monitoring engine features a source evaluation module, a content processing engine, and a content classification engine. The source evaluation module determines a confidence level associated with a source of the incoming content and refrains from providing textual information associated with the incoming content unless the confidence level associated with the source is equal to or exceeds a prescribed threshold. The content processing engine identifies salient information from the textual information for use in identifying an emerging cyber threat.

Abstract: Provided is a method for post-quantum resistant authentication of a service provider device to a user device, using a legacy certificate of said service provider device and a quantum safe cryptography (QSC) certificate of said service provider device. The method includes verifying by a trusted third party device, using said identifier of the legacy certificate comprised in the QSC certificate, a binding of said QSC certificate to the legacy certificate of the service provider device, and verifying a validity of said QSC certificate by said trusted third party device. The binding and validity have been successfully verified by the trusted third party device, authentication of the service provider device to said user device, using said legacy certificate of the service provider device from which can be obtained said identifier comprised in the QSC certificate whose validity has been verified.

Abstract: In an image forming apparatus, personal identification information for identifying a user is associated with the user and as such registered. If a request for deletion of a registered user is received, whether to forbid reuse of the personal identification information, which is associated with the registered user for which the request for deletion is received, is determined. A request for registration of a user which a piece of personal identification information is associated with is refused in accordance with a determination to forbid reuse of the piece of personal identification information.

Abstract: Systems and methods for privileged remote access to Operational Technology (OT)/Internet of Things (IOT)/Industrial IOT (IIOT)/Industrial Control System (ICS) infrastructure, implemented in a cloud-based system. The method includes steps of, responsive to determining a user can access an application associated with the OT/IOT/IIOT/ICS infrastructure, determining the users security and access policies and creating a session for the user; establishing a secure connection to the application via a lightweight connector connected to the application; and brokering a connection between the users device and the application through the lightweight connector, enabling the user to interact with the application for the OT/IOT/IIOT/ICS infrastructure, based on the user's security and access policies.

Abstract: Aspects of the present disclosure enable a system to perform automated risk analysis of source code of applications. The system may include a machine learning model to analyze the source code. The machine learning model may output an application risk value. Further, the application risk value may be used to determine a remedial action. The remedial action may address a risk associated with the application risk value, or allow for publication of the application.

Abstract: Systems and methods include, responsive to security research identifying a zero-day Common Vulnerabilities and Exposure (CVE), receiving the associated signatures of the zero-day CVE, responsive to determining a user can access an application via a cloud-based system, obtaining an inspection profile for the user with the inspection profile including a plurality of rules, performing inspection of transactions after the access using the plurality of rules and responsive to results of any of the plurality of rules, performing an action to the access via the cloud-based system.

Abstract: A method includes generating pattern data including common chip design data and one or more bit spaces or place holders reserved for non-common chip design data or information related to the non-common chip design data. The method includes introducing the non-common chip design data or information related to the non-common chip design data into the one or more bit spaces or place holders of the pattern data before streaming the pattern data to the maskless pattern writer. The common chip design data defines a common design layout part of an electronic device to be created on a wafer using the maskless pattern writer. The non-common chip design data defines a non-common design layout part of the electronic device to be created on the wafer using the maskless pattern writer, the non-common design layout part being different from other electronic devices created on the wafer.

Abstract: Systems and techniques are provided for establishing a connection. For instance, a first chiplet root of trust (C-RoT) of a first chiplet of a plurality of chiplets can receive a request for a cryptographic key. The first C-RoT can generate the cryptographic key and wrap the cryptographic key using a wrapping key to generate a wrapped cryptographic key. The first C-RoT can output the wrapped cryptographic key and a second C-RoT of a second chiplet of the plurality of chiplets can receive the wrapped cryptographic key. The second C-RoT can unwrap the wrapped cryptographic key using the wrapping key and can perform an operation based on the cryptographic key.

Abstract: An end-to-end mechanism is disclosed herein for transporting encrypted messages over hypertext transport protocol (HTTP) sent to a group of recipients. In particular, the disclosed mechanism receives a message (e.g., as an input from a user) and encrypts that message using an encryption mechanism with a key unique to a particular user and to the message (e.g., different messages are encrypted using different keys). The encrypted message is then stored in a generated object along with other metadata needed for message processing. Once the object is generated, it is signed and encoded into a binary representation that is then sent to a server. The server system receives the binary representation and decodes it back into the object. The metadata of the object is then used to route the message to the correct recipient applications for decryption.

Abstract: In a general aspect, a cryptography system includes a multiple-key pair root certificate authority. In some aspects, a plurality of distinct cryptographic pairs of public keys and private keys of a root certificate authority are generated. A plurality of distinct self-signed root certificates of the root certificate authority are generated. The plurality of distinct self-signed root certificates are each based on and correspond to a respective one of plurality of distinct cryptographic key pairs. A cryptographically authenticated database is generated that includes the plurality of distinct self-signed root certificates and represents the root certificate authority. The cryptographically authenticated database includes validity information of each of the plurality of self-signed root certificates. The cryptographically authenticated database is distributed to entities in a public key infrastructure.