Abstract: Embodiments relate to an apparatus and method for protecting a memory. The apparatus may include a monitoring unit configured to monitor pieces of status data of an integrated circuit (IC) chip, and a processor configured to analyze the pieces of status data monitored by the monitoring unit to detect a cold boot attack on the IC chip and protect a memory in the IC chip from the cold boot attack according to a detection result.

Abstract: Various embodiments include a system that discovers hidden Application Programming Interfaces (APIs) and detects security vulnerabilities in the hidden APIs. The system accesses Cloud Security Posture Management (CSPM) logs and discovers APIs based on the logs. The system identifies additional APIs that are not present in the CSPM logs. The system initiates API calls using modified addresses for the discovered APIs to discover hidden APIs. The system tests the discovered APIs to determine attack surfaces in the discovered APIs. The system generates a report that identifies the discovered APIs and that indicates the attack surfaces.

Abstract: The technology disclosed herein provides a method including receiving a plurality of input/output (IO) requests at an object store, removing one or more fields from each of the plurality of input/output (IO) requests to generate a plurality of condensed IO requests, transforming one or more fields of each of the plurality of condensed IO requests to generate transformed IO requests, combining a predetermined number of transformed IO requests to generate IO trace temporal sequences, generating machine learning (ML) model input feature vectors by assigning each of the IO trace temporal sequences a ground truth value indicating whether the IO trace temporal sequence represents a ransomware attack, and training an ML model using a plurality of the ML model input feature vectors.

Abstract: A storage device includes: a control unit configured to determine, when a first command to update first data stored at a first address in a first area of a storage unit to second data is received from an external apparatus, whether or not an update from the first data to the second data is within an update restricted range. In a case where the update to the second data is not within the update restricted range, the control unit is configured to verify a signature received from the external apparatus together with the first command. In a case where a verification is success, the control unit is configured to store the second data at the first address. In a case where a verification is failure, the control unit is configured not to store the second data at the first address.

Abstract: Techniques for implementing a differentially private variational autoencoder for data obfuscation are disclosed. In some embodiments, a computer system performs operations comprising: encoding input data into a latent space representation of the input data, the encoding of the input data comprising: inferring latent space parameters of a latent space distribution based on the input data, the latent space parameters comprising a mean and a standard deviation, the inferring of the latent space parameters comprising bounding the mean within a finite space and using a global value for the standard deviation, the global value being independent of the input data; and sampling data from the latent space distribution; and decoding the sampled data of the latent space representation into output data.

Abstract: The present description concerns a method of identification of risks of cyberattacks on a programmable logic controller, the method comprising: the generation of a digital representation of a minimized finite-state transducer based on a specification of a controller logic of the programmable logic controller, the minimized finite-state transducer comprising a set of source states, a set of destination states, and a set of transitions from a source state to a destination state based on an input data value; the generation of a second computer file, based on a first computer file identifying a subset of sensitive states, the second file comprising a list of critical transitions associated with the sensitive states, and for each transition, a list of the input data; and the generation of a fourth computer file indicating input data to be protected which are both associated with critical transitions and with a corruption risk.

Abstract: The present disclosure relates to a user information storage control method, including: standardizing user data, and extracting user information in a preset format; generating a mapping subtable according to desensitized data and a mapping identifier of a sensitive field; dividing non-sensitive fields in the user information into regularized field information and irregularized field information, and mapping and storing the divided regularized field information and irregularized field information to generate a storage mapping table corresponding to the non-sensitive fields; and associating a user unique identity code in the user information with the corresponding mapping subtable and storage mapping table to generate a mapping main table, and storing the mapping subtable, the mapping main table and the storage mapping table in a same storage area or in a plurality of different storage areas respectively. The present disclosure may improve the data storage security and reduce the storage capacity.

Abstract: A method of rotating a set of keys, having a media encryption key (MEK) and a current media encryption key encryption key (MEKEK) encrypted and stored in a self-encrypting drive (SED) having data encrypted with the MEK (MEK(data)), includes decrypting the stored MEK and the current MEKEK. A new MEK (MEK?) and a new MEKEK (MEKEK?) are generated. The MEKEK? is encrypted to replace the current encrypted MEKEK. A concatenation of the MEK and the MEK? is encrypted with MEKEK?. The encrypted data MEK(data) is re-encrypted with MEK?.

Abstract: A key block can be generated from a session key used by a computer-based design tool for a circuit design by encrypting the session key using computer hardware. The key block can be divided, by the computer hardware, into a plurality of sub-blocks. A plurality of enhanced sub-blocks can be generated by the computer hardware by encrypting each sub-block of the plurality of sub-blocks with a different key of a plurality of keys corresponding to a plurality of Intellectual Property (IP) cores of the circuit design. The plurality of enhanced sub-blocks can be stored in a memory.

Abstract: A detection and protection system for fake relay stations in a telecommunication network comprises a core network, which comprises a threat detection device comprising a radio terminal and a processor; and a plurality of signal relay stations, wherein the radio terminal is communicated with the signal relay stations, the threat detection device performs a wireless signal scanning, and the processor identifies the signal relay stations according to a result of the wireless signal scanning and judges whether there are fake relay stations among the signal relay stations; wherein, the processor decodes the information in the result of the wireless signal scanning, compares the identification information of each signal relay station in the information with a white list, so as to identify whether the signal relay stations include fake relay stations which do not belong to the white list, wherein the white list contains the identification information of legitimate relay stations; and wherein in case that the fake re

Abstract: Aspects of the disclosure relate to detecting and preventing transmission of spam messages using modified source numbers. A computing platform may detect that a first message, sent to a recipient device from a sender device, includes suspicious content. Subsequently, the computing platform may receive, from the recipient device, user interaction information indicating that a user of the recipient device has sent a reply message in response to the first message. Then, the computing platform may generate a modified message by modifying a first source number corresponding to the reply message. Next, the computing platform may cause transmission of the modified message with the modified first source number to the sender device. Thereafter, the computing platform may intercept one or more additional messages between the sender device and the modified first source number and redirect the one or more additional messages.

Abstract: In various examples, input queries (e.g. open user queries) are used combination with predefined queries to perform security policy-related actions using a generative machine learning (GML) model or GML models. In one example, an input query relating to a security policy is matched with a predefined query stored in an instruction database. In some examples, the instruction database contains examples of structured configuration data, which in turn can be used by a GML model to configure a predetermined extractor code module to perform a specific policy-related action. In other examples, a security context relating to a security policy is used together with an input query and template query to generate a GML model query. In some examples, the two approaches are combined.

Abstract: Arrangements for detecting unauthorized activity using artificial intelligence (AI)-driven searching are provided. In some aspects, input from a computing device associated with an entity may be received. A monitoring tool may be used to determine that the entity is a human entity. Responsive to determining that the entity is a human entity, one or more data sources may be queried for identity information related to the entity. Using an AI model, data from the received input may be compared with the identity information from the one or more data sources. Based on the comparison, a risk score associated with the entity may be assigned. The risk score may determine a presence of potential unauthorized activity associated with the entity. Feedback data on the risk score assigned by the AI model may be received. The AI model may be automatically and continuously updated based on the feedback data.

Abstract: Data is received that comprises or characterizes an executable and dynamic linked library (DLL). Features are then extracted from the executable and DLL. The extracted features are input into at least one machine learning model to generate a suspiciousness score. The machine learning model can be trained to determine whether the executable file comprises ransomware. An execution chain of trust score for the executable and DLL can later be determined based on the extracted features and the suspiciousness score. This execution chain of trust score for the executable and DLL characterizes one or more associated parent processes. This suspiciousness score and the execution chain of trust score can be used to determine whether or not to initiate one or more ransomware countermeasures. Related apparatus, systems, techniques and articles are also described.

Abstract: A system includes a memory, a processor in communication with the memory, and a first TEE instance. The first TEE instance is configured to maintain an encrypted secret, obtain a cryptographic measurement associated with a second TEE instance, validate the cryptographic measurement, and provision the second TEE instance with the encrypted secret. Additionally, the first TEE instance and the second TEE instance are both configured to service at least a first type of request.

Abstract: Proactive threat detection in a security system includes monitoring user input received for operating the security system over time and establishing a baseline user input for operating the security system that produces a baseline operation of the security system that can monitor for and identify each of a plurality of baseline security events. An anomaly in the user input relative to the baseline user input is detected and a determination is made as to whether the anomaly means the security system is not able to identify one or more of the baseline security events. When the anomaly in the user input causes the security system to not be able to identify one or more of the baseline security events, a proactive threat detection alert is provided that prompts an operator to take action to resolve the anomaly.

Abstract: According to one embodiment, a memory system includes a nonvolatile memory and a controller. The controller is communicable with a host and is configured to control the nonvolatile memory. The controller is configured to when receiving a key generation command from the host, generate an encryption key by an encrypting and decrypting function unit, store the encryption key in the nonvolatile memory, and transmit an identifier of the encryption key to the host.

Abstract: Disclosed herein are systems and methods for detecting cyclic activity in an event stream. In one aspect, an exemplary method comprises, creating a buffer, determining a threshold for indicating a beginning of a cycle, processing each event by filling the buffer with the event, determining a number of unique events in the buffer, when the number reaches a predetermined size of the buffer, replacing one event with another by excluding the earliest event and including the new event, recalculating the number of unique events, comparing the recalculated number with a threshold for a maximum number of unique events for cycle detection, detecting a beginning of a cycle when the number of unique events is less than or equal to the maximum number of unique events for cycle detection, excluding further events from the event stream, and continuing to recalculate the number of unique events after each addition.

Abstract: Systems and methods for redacting malicious URLs and other activatable content from messages are disclosed. A content analysis system may receive a text message or a multimedia message and determine whether a URL is contained in such a message. If so, the content analysis system may determine the maliciousness of the URL using various techniques, redacting the URL from the message before providing it to the user device if the URL is determined to be malicious. The original message may be stored for user access if desired.

Abstract: A method and apparatus for proving the originality of a creative design in a communication system, on the basis of a wearable device, by proving a causal relationship between a creative process of the creative design and a creative output by using a hash code associated with an image for each creative process of the creative design, and generating a piece of final hash information by combining a hash code for an intermediate image and a hash code for a final image during a creative process of a creative design through an arithmetic function, and transmitting an NFT including the final hash information and information about the final image to a blockchain, such that a design creator can claim an association between the intermediate image and the final image during the creative process of the creative design together at the time of disclosure of the design on a blockchain network.