Abstract: The invention relates to a system for protecting IoT devices from malicious code, which comprises: (a) a memory extracting module at each of said IoT devices, for extracting a copy of at least a portion of the memory content from the IoT device, and sending the same to an in-cloud server; and (b) an in-cloud server for receiving said memory content, and performing an integrity check for a possible existance of malicious code within said memory content.

Abstract: Images related to one or more attacks to a service provider system may be analyzed to improve the security of the service provider system. Each of the images may be segmented into multiple segments. Each of the segments is analyzed independently to determine whether the segment includes obfuscated data and if so, which one of the data obfuscation techniques was used to generate the obfuscated data. Additional information regarding the obfuscated data may be derived from other segments that include unobfuscated data and from the metadata of the image. A data restoration algorithm may be configured accordingly to restore the obfuscated data. The restored data, as well as a context derived for the image, may be used to adjust one or more security parameters of the service provider system to improve the security of the service provider system.

Abstract: Embodiments of the present invention provide techniques, systems, and methods for remote, agent-less enterprise computer threat data collection, malicious threat analysis, and identification and reporting of potential and real threats present on an enterprise computer system. Specifically, embodiments are directed to a system that securely collects system information from computers across the enterprise, internally encrypts and analyzes the collected information for indicators of compromise, threatening behavior, and known vulnerabilities, and generates alerts regarding known and potential threats for further analysis and remediation. If potential threats are identified, the system may deploy a memory analysis module that takes a deeper analysis of the potentially compromised computer to obtain more information about the potential threat.

Abstract: Techniques are provided for selectively granting access credentials through the use of a machine learning model. Embodiments include collecting data from one or more sources related to user access of an information technology (IT) infrastructure. Based on the collected data, a machine learning model is created for authenticating a request from a client device to access the computer system within the IT infrastructure based on the collected data, based on the machine learning model. An access credential is generated upon processing the user identifier as an input to the machine learning model, and the access credential is provided to the client device.

Abstract: A computing device detects a trigger or context associated with exchanging, using a body area network (BAN), body area network services with another device. The BAN services can include a discovery service to allow the computing device to connect to a network. Responsive to detecting the trigger or context, one or more body area networks are discovered and the other device is discovered. If the computing device and the other device are new to each other, the computing device is authenticated to the body area network one or more body area network services can be exchanged. If the devices are not new to each other, body area network services can be exchanged using the other device.

Abstract: Methods, computer program products, and systems are presented. The method computer program products, and systems can include, for instance: examining ledger data of a blockchain ledger; examining node data of a plurality of candidate nodes, wherein the examining node data includes examining data of candidate nodal networks associated to respective ones of the plurality of candidate nodes; and transitioning blockchain ledger access in dependence on the examining of the ledger data and in dependence on the examining of the node data, wherein the transitioning blockchain ledger access includes transitioning blockchain ledger access between a first candidate node and a second candidate node of the plurality of candidate nodes.

Abstract: Methods, computer program products, and systems are presented. The method computer program products, and systems can include, for instance: examining ledger data of a blockchain ledger; examining node data of a plurality of candidate nodes, wherein the examining node data includes examining data of candidate nodal networks associated to respective ones of the plurality of candidate nodes; and transitioning blockchain ledger access in dependence on the examining of the ledger data and in dependence on the examining of the node data, wherein the transitioning blockchain ledger access includes transitioning blockchain ledger access between a first candidate node and a second candidate node of the plurality of candidate nodes.

Abstract: Systems and methods are disclosed for authenticating a chunk of data identified in a query received by a data intake and query system. The data intake and query system receives a query that identifies a set of data and manner for processing the set of data, and identifies a chunk of data that is part of the set of data. The system generates a content identifier, such as a hash, of the chunk of data. The system further authenticates the chunk of data based on the generated content identifier and a content identifier stored by a distributed ledger system.

Abstract: Methods, systems, and devices for server-initiated secure sessions are described, A browser application may connect to a portal, where the portal may transmit a command to a server agent to initiate a secure session with an endpoint device. The server agent may be housed in a destination server, and may establish a secure connection with an intermediary server using a secure communication protocol. The secure connection may be made by directing the destination server to open an outbound connection through a firewall of the destination server, A browser session may be redirected to the intermediary server from the browser application, and the intermediary server may route the browser session traffic to the secure connection.

Abstract: An n-tiering security threat inference and correlation apparatus (100) for monitoring and anticipating cyber attacks is disclosed. The apparatus comprises a plurality of groups of inference-correlation systems (106(a, b)-114(a, b)), each group arranged with at least one inference system and at least one associated correlation system configured to monitor at least one network; and an input/output (I/O) system (102) configured to receive security events, and broadcast the received security events to the plurality of groups of inference-correlation systems; wherein the respective groups of inference-correlation systems are configured to process only the broadcasted security events relevant to the respective networks to identify the cyber attacks. A method of operating the apparatus is also disclosed.

Abstract: Detecting malware attacks is described herein. A computer-implemented method may include receiving, via a processor, events from a plurality of activity monitors. The method also include extracting, via the processor, a plurality of behavioral features from the received events. The method may further include detecting, via the processor, a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data using a machine learning technique, wherein the private data includes private enterprise attack findings. The method may also include executing, via the processor, an ad hoc protection improvement based on the detected malware attack.

Abstract: Embodiments of a secure multi-party computation method applicable to any computing node deployed in a distributed network are provided. A plurality of computing nodes are deployed in the distributed network. The plurality of computing nodes jointly participate in a secure multi-party computation based on private data respectively held by the computing nodes. The method includes: generating a computing parameter related to private data held by one computing node based on a secure multi-party computation algorithm; transmitting the computing parameter to other computing nodes participating in the secure multi-party computation for the other computing nodes to perform the secure multi-party computation based on collected computing parameters transmitted by the computing nodes participating in the secure multi-party computation; and creating an audit log corresponding to the computing parameter, the audit log recording description information related to the computing parameter.

Abstract: Methods and apparatus for controlling access to and/or forwarding of communicated information, e.g. traffic, in a wireless communication system are described. The key, e.g., PSK, used to secure data that is transmitted to an access point for communication to a destination device is taken into consideration when deciding whether or not to provide the destination device access to the communicated content. The decision of whether or not to provide the destination device access to a communication may involve deciding whether or not to forward the received data to another device, e.g., another access point, for delivery to the destination device and/or may involve deciding whether or not to transmit the data to the destination device. If the destination device is not associated with, e.g., does not have access to and/or authorization to use, the key used to secure the received data, the data is not communicated to the destination device.

Abstract: Methods, systems, and computer program products for security context escrowing are provided herein. According to one aspect, a method of operation of a network node for a telecommunications network comprises storing security context information associated with a small data, fast path connection between a wireless device and a first gateway that is serving the wireless device, determining a change in the gateway that is serving the wireless device from the first gateway to a second gateway, and, in response to determining the change, providing the stored security context information to the second gateway for use with the wireless device.

Abstract: Embodiments of a multi-party secure computation method applicable to any one computing node deployed in a distributed network are provided. A plurality of computing nodes are deployed in the distributed network, the plurality of computing nodes jointly participate in a secure multi-party computation based on respectively held private data, and the computing node that performs the method is connected to a trusted random source. The method includes: obtaining a trusted random number from the trusted random source; performing an operation on the held private data based on the obtained trusted random number to obtain an operation result; and transmitting a computing parameter comprising at least the trusted random number to other computing nodes participating in secure multi-party computation, so that the other computing nodes perform the secure multi-party computation based on collected computing parameters transmitted by the computing nodes participating in the secure multi-party computation.

Abstract: A method for the secure interaction of a user with a mobile terminal and a further entity includes transmitting a secret or an image of the secret generated by a one-way function and an individual data from the user to a back-end, transmitting the image and the individual data from the back-end to a protected execution environment of a processor of the mobile terminal; notifying the user on a secure user interface of the mobile terminal, wherein the individual data is displayed to the user and wherein the user is authenticated with the secret, the user interacting with a secure element of the mobile terminal having a secure connection with the protected execution environment, via the secure user interface and the protected execution environment; and the secure element interacting with the further entity via a secured connection providing a complete security chain of all entities involved in the interaction.

Abstract: A system includes a network gateway in communication with a plurality of servers, a household behavior model processor which models a household behavior model based at least on expected usage of each of a plurality of network appliances, wherein each one appliance of the plurality of network appliances is associated with one of the plurality of servers, and behavior of users associated with the network gateway, an anomaly detector which determines, on the basis of the household behavior model, if an anomalous control message which has been sent to one of the plurality of network appliances from one of the servers has been received at the network gateway, and a notification server which sends a notification to an application on an administrator's device upon receipt of the anomalous control message at the network gateway. Related systems, apparatus, and methods are also described.

Abstract: Examples described herein include systems and methods for deploying Data Loss Prevention (DLP) policies to user devices. An example method can include receiving a configuration specifying at least one DLP policy applicable to an application, along with an indication of an assignment group specifying users, or user devices, to which the DLP policy should apply. Information regarding the DLP policy and assignment group can be provided to an identity service and then synchronized with a second server that manages the application. The method can further include provisioning the application to a user device and instructing the user device to retrieve the DLP policy from the second server and implement it when executing the provisioned application.

Abstract: In an embodiment, a computer implemented method comprises accessing, from a first data repository, identity information associated with one or more protected computing devices; creating mapped identity information by encrypting and mapping the identity information according to a different identity data format that is compatible with the one or more protected computing devices; updating stored blockchain data using the mapped identity information; storing the mapped identity information from the blockchain data in a second data repository; generating decrypted identity information from the mapped identity information stored in the second data repository; and performing one or more authentication services for a client device on behalf of the one or more protected computing devices by using the mapped identity information in the second data repository; wherein the method is performed by one or more computing devices.

Abstract: A computer-implemented method includes: receiving, by a platform including one or more computing devices, a blockchain authorization information generation request from a client, in which the blockchain authorization information generation request includes a target blockchain identifier and user information; determining, based on the target blockchain identifier, a target blockchain; determining a blockchain parameter of the target blockchain, in which the blockchain parameter indicates one or more requirements for authorization information used to join the target blockchain; generating blockchain authorization information based on the blockchain parameter and the user information, in which the blockchain authorization information conforms to the one or more requirements; and sending the blockchain authorization information to the client.