Abstract: A memory, a data processing system comprising a memory, a method of operating a memory and a memory compiler apparatus and method of memory compilation are provided, which relate to a memory comprising data storage circuitry to store data values at data locations. Addressing circuitry is provided to access the data value at a storage location in dependence on a received address and readout circuitry to provide an output value in dependence on the accessed data value. The memory further comprises scrambling circuitry to select at least one of: a mapping between the address and the storage location; and a mapping between the data value and the output value, in dependence on a received scrambling value. The mapping between the address and the storage location and/or the data value and the output value can thus be easily and rapidly changed.

Abstract: An implementation of this disclosure provides a system comprising memory to store a plurality of layers and a processing device coupled to that memory to set up the layers and to mount them into an overlay. The layers comprise an upper and one or more lower layers. The overlay provides access to a plurality files stored in the overlay filesystem. A request from an application to access a file in the mounted overlay is received. An access policy for the mounter that mounted the layers is identified in view of the mounter's credentials. The processing device checks, in view of the access policy, whether a security context label for the file provides access to the application and to the mounter of the overlay in at least one lower layer comprising the file. An instruction to provide the application with access to the file is issued in view of the check.

Abstract: Systems, methods, and computer-readable media for managing credentials are provided. In one example embodiment, an electronic device may include a secure element with a security domain element stored on the secure element. The electronic device may also include a processor component that may be configured to, inter alia, permanently terminate the functionality of the security domain element, after the functionality has been permanently terminated, communicatively couple the electronic device to a trusted service manager, and transmit data to the communicatively coupled trusted service manager that may be usable by the trusted service manager to determine that the functionality has been permanently terminated. Additional embodiments are also provided.

Abstract: According to non-limiting embodiments disclosed herein, the functionality of an object cache in a server can be extended to monitor and track web traffic, and in particular to perform rate accounting on selected web traffic. As the server communicates with clients (e.g., receiving HTTP requests and responding to those requests), the server can use its existing object cache storage and existing object cache services to monitor web traffic by recording how often a client makes a particular request in the object cache and/or other data about the requests. Preferably, the object cache is still used for conventional caching of objects, the object cache thus providing a dual role by storing both web objects and rate accounting data.

Abstract: A device may receive policy information associated with a first application group and a second application group. The device may receive network topology information associated with a network. The device may generate a first policy based on the policy information and the network topology information, and generate a second policy based on the policy information and the network topology information. The device may provide, to the virtual network device, information associated with the first policy to permit the virtual network device to implement the first policy in association with network traffic transferred between the first application group and the second application group. The device may provide, to the physical network device, information associated with the second policy to permit the physical network device to implement the second policy in association with network traffic transferred between the first application group and the second application group.

Abstract: A method for verifying a proximity of a user device to a beacon, including broadcasting a frame comprising an encrypted payload, receiving the frame, extracting information from the frame, and verifying the proximity of the user device to the beacon based on the extracted information.

Abstract: Techniques to facilitate securing web services from unauthorized access are disclosed herein. In at least one implementation, user interactions with a web service are monitored, and sets of the user interactions are generated per originator based on origination information associated with the user interactions. The sets of the user interactions are processed to identify credentials used to access the web service per originator. The credentials used to access the web service per originator are compared with compromised credentials stored in a database to identify one or more user accounts of the web service associated with an originator that used the compromised credentials found in the database. Security measures are applied for at least the one or more user accounts of the web service associated with the originator that used the compromised credentials found in the database.

Abstract: A system and methods of computer security are provided wherein a first mobile computing device drives an acoustic transducer to emit an acoustic signal encoding a time-based, one time password (TOTP) code, and a second mobile computing device measures output of a MEMS gyroscope that senses the emitted acoustic signal. The second mobile computing device decodes the TOTP code from the gyroscope output, validates the TOTP code and responsively permits a user to access a secure application.

Abstract: Methods (100, 200, 300) and apparatus (400, 500, 600, 700, 800, 900) are disclosed for establishing a key for direct communication between a User Equipment device, UE, and a device. The methods and apparatus cooperate to form a system for securing direct communication between a UE and a device over an interface. The system comprises a UE (20), a device (30) and a Direct Communication Element (40). The Direct Communication Element (40) is configured to obtain a shared session key and Generic Bootstrapping Architecture Push Information, GPI, to derive a UE delivery key from at least the shared session key, to generate a direct communication key, to encrypt the direct communication key with the UE delivery key, and to send the direct communication key, the encrypted direct communication key and the GPI to the device (30). The device (30) is configured to send the encrypted direct communication key and the GPI to the UE (20).

Abstract: An authentication system for a computing environment uses physically unclonable functions (PUFs) to authenticate requests to perform an action in the environment. The system receives, from an imaging device, an image of a physically unclonable object associated with the electronic request. The system then obtains from a computer server operating within the system via an encrypted communication channel, a challenge associated with the object. The system uses extraction parameters encoded within the challenge to transform a portion of the image and produce authentication data representing a response to the challenge. The system extracts, using the extraction parameters, the authentication data from the image and determines whether the challenge and response match and the request is authenticated.

Abstract: The disclosed computer-implemented method for classifying files as specific types of malware may include (i) identifying an unknown file on a computing device, (ii) performing an analysis of the unknown file by applying, to the unknown file, a machine-learning heuristic that employs at least one decision tree, (iii) classifying the unknown file as malicious based on the analysis, and (iv) after classifying the unknown file as malicious, using the same decision tree employed by the machine-learning heuristic to sub-classify the unknown file by (a) identifying at least one leaf node of the decision tree arrived at by the analysis performed by the machine-learning heuristic on the unknown file, (b) determining that the leaf node of the decision tree is associated with a particular type of malicious file, and (c) sub-classifying the unknown file as the particular type of malicious file. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for providing an authenticated connection between at least two communication partners and to a communication system. The method includes setting up an anonymous signal-conducting connection between the at least two communication partners; checking the authenticity of a signed certificate used by a first communication partner of the at least two communication partners by a second communication partner of the at least two communication partners; reproducing an authentication code by the second communication partner after the check of the authenticity of the signed certificate used by the first communication partner has been carried out; and confirming the authentication code reproduced by the second communication partner by a user by the first communication partner. The method provides a possibility which increases the security of a certificate-based authentication of a communication connection between at least two communication partners.

Abstract: The present disclosure is directed towards systems and methods for detecting anomalous network traffic. Network traffic corresponding to an application executed by a server can be received. Application characteristics of the application can be identified to select an anomaly detection profile. The anomaly detection profile can be selected based on the identified application characteristics. The anomaly detection profile can include a set of detection features for the anomaly and one or more predetermined threshold values of the detection features. One or more feature values of the set of one or more detection features can be determined. An anomaly in the network traffic can be detected responsive to comparing the feature values and the predetermined threshold values of the detection features.

Abstract: A method for detecting patterns using statistical analysis is provided. The method includes receiving a subset of structured data having a plurality of fields. A plurality of value combinations is generated for the plurality of fields using a statistical combination function. Each combination of the generated plurality of value combinations is stored as a separate entry in a results table. The entry in the results table includes a counter associated with the stored combination. A value of the counter is incremented for every occurrence of the stored combination in the generated plurality of value combinations. The results table is sorted based on the counters' values and based on a number of fields in each combination. One or more entries having highest counter values are identified in the results table.

Abstract: A shielding is provided to prevent attacks on network architecture or reduce the impact thereof. The system reconfigures the network differently for each user, operating system, and host and the configuration changes as time passes. The system can use dynamic redirection to create a reconfigurable network, and include intermediary nodes to dynamically reconfigure the network infrastructure for all traffic.

Abstract: The disclosed computer-implemented method for performing human-verification procedures may include (1) detecting, at a computing device, an attempt to access a computing resource that is to be protected from being accessed by automated bots, (2) in response to detecting the attempt to access the computing resource, presenting, on the computing device, an audiovisual display that is configured to produce at least one expected reaction from human users, the expected reaction being characterized by an expected facial expression, (3) while the audiovisual display is being presented, monitoring facial expressions of any user that is currently using the computing device, and (4) determining whether the attempt to access the computing resource was performed by a human user or an automated bot based at least in part on a comparison between the monitored facial expressions and the expected facial expression. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Examples described herein relate to systems, apparatuses, and methods for using tokens between two entities comprising a client device and a server, including receiving, by the server, a token from the client device, wherein the token is unique to a transaction, deriving, by the server, a server-derived token from the original data based on a transaction count, wherein the transaction count corresponds to a number of times that the original data is involved in transactions, comparing, by the server, the received token with the server-derived token, and responsive to determining that the received token and the server-derived token are same, sending, by the server, a verification message.

Abstract: A new cybersecurity incident is registered at a security incident response platform. At a playbook generation system, details are received of the new cybersecurity incident from the security incident response platform. At least some of the details correspond to a set of features of the new cybersecurity incident. A set or subset of nearest neighbors of the new cybersecurity incident is localized in a feature space. The nearest neighbors of the new cybersecurity incident are other cybersecurity incidents having a distance from the new cybersecurity incident within the feature space that is defined by differences in features of the nearest neighbors with respect to the set of features of the new cybersecurity incident. A custom playbook is created for responding to the new cybersecurity incident having prescriptive procedures based on occurrences of prescriptive procedures previously employed in response to the nearest neighbor cybersecurity incidents.

Abstract: A system for managing attacker incidents, including a mobile device manager (MDM) receiving instructions to deploy deceptions on a mobile device used by an employee of an organization in conjunction with a network of the organization and, in response to the instructions, running a dedicated agent on the mobile device, wherein the dedicated agent is configured to register the mobile device and its current deceptions state, and install deceptions in the mobile device, a trap server triggering an incident in response to an attacker attempting to use deceptive data that was installed in the mobile device, and a deception management server sending instructions to the MDM to deploy deceptions on the mobile device, registering the mobile device and its deceptions state, receiving the notification from the trap server that an incident has occurred, and in response thereto instructing the MDM to run forensics on the mobile device.

Abstract: The disclosed computer-implemented method for automated classification of application network activity may include (1) building a lexicon dictionary that comprises lexical keywords, wherein network streams whose headers contain a given lexical keyword represent communications of an activity type that is associated with the given lexical keyword in the lexicon dictionary, (2) identifying, at a network vantage point, a network stream that represents a communication between an application and a server, (3) extracting, through a lexical analysis that utilizes the lexicon dictionary, a set of keywords from one or more header fields of the network stream, and (4) classifying the network stream based on activity types associated with each keyword in the set of keywords that were extracted from the header fields of the network stream. Various other methods, systems, and computer-readable media are also disclosed.