Abstract: Threat detection is improved by monitoring variations in observable events and correlating these variations to malicious activity. The disclosed techniques can be usefully employed with any attribute or other metric that can be instrumented on an endpoint and tracked over time including observable events such as changes to files, data, software configurations, operating systems, and so forth. Correlations may be based on historical data for a particular machine, or a group of machines such as similarly configured endpoints. Similar inferences of malicious activity can be based on the nature of a variation, including specific patterns of variation known to be associated with malware and any other unexpected patterns that deviate from normal behavior. Embodiments described herein use variations in, e.g., server software updates or URL cache hits on an endpoint, but the techniques are more generally applicable to any endpoint attribute that varies in a manner correlated with malicious activity.

Abstract: An HDCP receiver device that receives frames from an HDCP transmitter device. The receiver device has a frame counter that is updated for each frame that is received from the transmitter device and that includes encrypted content, while the receiver device is in a pre-authorization mode. During the pre-authorization mode, the receiver device does not decrypt any received frame bearing encrypted content. While the receiver device waits to transition from the pre-authorization mode to a post-authorization mode in which the receiver device can begin to decrypt any received frames that include encrypted content, the frame counter is updated for each frame received that includes encrypted content. In the post-authorization mode, the frame counter has a nonzero value if frames including encrypted content were received by the receiver device during the pre-authorization mode.

Abstract: A method, system, and program product for creating network isolation between virtual machines is provided, including receiving, by a security virtual machine (SVM), an outgoing network packet from a virtual machine (VM). The source internet protocol (IP) address and a source media access control (MAC) address is extracted from the outgoing network packet. A zone identifier table is searched for a zone id, whereby the zone identifier table includes the source IP address and the source MAC address. The outgoing network packet is sent to a physical Ethernet adapter connected to an external network switch whereby the external network switch is connected to an external network, based on the zone id not being found in the zone identifier table. The outgoing network packet is sent to a physical Ethernet adapter that is connected to an internal switch, based on the zone id being found in the zone identifier table.

Abstract: Methods and systems for protecting a secured network are presented. For example, one or more packet security gateways may be associated with a security policy management server. At each packet security gateway, a dynamic security policy may be received from the security policy management server, packets associated with a network protected by the packet security gateway may be received, and at least one of multiple packet transformation functions specified by the dynamic security policy may be performed on the packets. Performing the at least one of multiple packet transformation functions specified by the dynamic security policy on the packets may include performing at least one packet transformation function other than forwarding or dropping the packets.

Abstract: A network protection service for providing protective assistance to a subscribing host is presented. The network protection service is configured determine a set of rules for filtering network traffic for a subscribing host. The network protection service is further configured to receive network traffic on behalf of the subscribing host, filter the received network traffic according to the set of rules, and forward a portion of the filtered network traffic to the subscribing host. Still further, the network protection service is configured to analyze the received network traffic via the analysis server, and refine the set of rules for filtering the received network traffic based on the analysis of the received network traffic by the analysis server.

Abstract: Provided are methods and systems for flagging security threats in web service requests. Specifically, a method for flagging security threats in web service requests can include receiving a request addressed to an addressee. The method can further include analyzing the request based on at least one security signature. The method can continue with determining a threat level associated with the request. The determination can be carried out based on the analysis. The method can further include creating a flag corresponding to the threat level. The method can further include inserting the flag into a network packet associated with the request, thereby creating a modified request. The method may further include sending the modified packet to the addressee. An application associated with the addressee can be operable to selectively process the request based on the threat level.

Abstract: The present invention is related to a method, apparatus, and computer program product, in which a password-based digest access authentication procedure is used for performing authentication between a client and a server, wherein the authentication procedure is secured by at least one of modifying a digest-response parameter with a user password and generating a bootstrapped key based on the user password and at least one fresh parameter not used in a previous protocol run between the client and the server.

Abstract: A method, product and computer program product for effecting an Evolutionary Process on malware, the method including the steps of: (a) receiving a malware specimen; (b) generating variants of the malware specimen; (c) evaluating the variants and awarding each the variant a Fitness Score; (d) selecting the variants having at least a predefined the Fitness Score; and (e) using the selected variants as the malware specimens in step (a) from which to generate a new generation of the variants.

Abstract: An access control list lockout prevention system includes a network. A first administrator Information Handling System (IHS) is coupled to the network. A networking device is communicatively connected to the first administrator IHS through the network. The networking device is configured to receive an access control list instruction from the first administrator IHS. The networking device then determines that at least one administrator IHS that is communicatively connected to the networking device will lose access to the networking device in response to execution of the access control list instruction. In response to determining that the at least one administrator IHS will lose access to the networking device in response to execution of the access control list instruction, the networking device provides a warning message for display on the first administrator IHS.

Abstract: An electronic circuit (200) includes one or more programmable control-plane engines (410, 460) operable to process packet header information and form at least one command, one or more programmable data-plane engines (310, 320, 370) selectively operable for at least one of a plurality of cryptographic processes selectable in response to the at least one command, and a programmable host processor (100) coupled to such a data-plane engine (310) and such a control-plane engine (410). Other processors, circuits, devices and systems and processes for their operation and manufacture are disclosed.

Abstract: A discovery bundle component is applied in a virtual image deployed within a virtual environment, wherein the discovery bundle automatically discovers asset information about one or more application bundles applied to the virtual image. The discovery bundle component sends, to a discovery product service, the asset information wrapped with a trusted signed certificate for the discovery product service, wherein the discovery product service is located outside the virtual environment.

Abstract: Techniques comprise identifying and/or classifying malicious activity in a web services platform using machine learning techniques. Systems, methods, and computer readable mediums may cause one or more computing nodes to monitor first network traffic, generate network information based on the monitored first network traffic, train a machine learning algorithm based on at least a first portion of the generated network information, test the machine learning algorithm based on at least a second portion of the generated network information, generate a predictor using the trained and tested machine learning algorithm, and identify second network traffic as one or more of malicious activity and benign activity using the predictor.

Abstract: Methods for authenticating a security device at a local network location for providing a secure access from the local network location to a remote network location are provided. A security device is registered by installing private security software on the security device that generates an asymmetrical encryption key pair including an encryption key and a decryption key. The encryption key is stored only on the security device and the decryption key is stored only on a remote server. Embodiments of the present invention provide increased security by not storing the encryption key on the remote server so that attackers stealing data from the server cannot pretend to a user having the registered security device. A corresponding system for authenticating a security device is also provided.

Abstract: A system comprising a processor adapted to activate multiple security levels for the system and a monitoring device coupled to the processor and employing security rules pertaining to the multiple security levels. The monitoring device restricts usage of the system if the processor activates the security levels in a sequence contrary to the security rules.

Abstract: Provided are a computer program product, system, and method for interacting with a remote server over a network to determine whether to allow data exchange with a resource at the remote server. Detection is made of an attempt to exchange data with the remote resource over the network. At least one computer instruction is executed to perform at least one interaction with the server over the network to request requested server information for each of the at least one interaction. At least one instance of received server information is received. A determination is made whether the at least one instance of the received server information satisfies at least one security requirement. A determination is made of whether to prevent the exchanging of data with the remote resource based on whether the at least one instance of the received server information satisfies the at least one security requirement.

Abstract: A technique for network authentication interoperability involves initiating an authentication procedure on a first network, authenticating on a second network, and allowing access at the first network. The technique can include filtering access to a network, thereby restricting access to users with acceptable credentials. Offering a service that incorporates these techniques can enable incorporation of the techniques into an existing system with minimal impact to network configuration.

Abstract: A gateway device comprising a processor and a memory, the processor is configured to receive a login operation request from an external endpoint, the login operation request including a user identifier and user login credentials of a user. The processor is also configured to construct an authentication request including the user identifier and the user login credentials and transmit the authentication request to an internal directory service. The processor is further configured to receive an authentication response from the internal directory service, the authentication response including an authentication identifier for the user, and store the authentication identifier in the memory, the authentication identifier for use by the processor in pass-through impersonation of the user.

Abstract: Techniques for granting rights for content on a social network to multiple users include determining first data. It is also determined to associate a first user identifier and at least a second user identifier with the first data. It is further determined to grant a right for the first data to a first user identified by the first user identifier and at least a second user identified by the second user identifier.

Abstract: A semiconductor device having a plurality of on-chip processors, a plurality of key RAMs, a plurality of key RAM controllers, a fuse bank, a fuse bank controller and a boot controller is described. The boot controller is arranged to, in a first programming stage, allocate a first array of fuses in the fuse bank in dependence on the size of a first device key for storing the first device key in the fuse bank and, during boot-time, provide the first device key to a first key RAM controller. The fuse bank controller is arranged to program the first array of fuses with the first device key in the first programming stage, provide the first device key to the boot controller during boot-time, and prevent access to the first device key in the fuse bank during run-time. The first key RAM controller is arranged to, during boot-time, store the first device key in the first key RAM, and, during run-time, restrict access to the first device key in the first key RAM to exclusive access by the first on-chip processor.

Abstract: Techniques for sharing data between users in a manner that maintains anonymity of the users. Tokens are generated and provided to users for sharing data. A token comprises information encoding an identifier and an encryption key. A user may use a token to upload data that is to be shared. The data to be shared is encrypted using the encryption key associated with the token and the encrypted data is stored such that it can be accessed using the identifier associated with the token. A user may then use a token to access the shared data. The identifier associated with the token being used to access the shared data is used to access the data and the encryption key associated with the token is used to decrypt the data. Data is shared anonymously without revealing the identity of the users using the tokens.