Abstract: An apparatus comprises a memory communicatively coupled to a processor. The processor may be configured to detect an attempt to exchange an electronic data stream between a transmitting device and a receiving device, train an artificial neural network based on historical data associated with one or more words formed by the text characters in the electronic data stream and multiple data exchange operations expected to be performed by the receiving device, determine, using the trained artificial neural network, that the text characters is logically positioned in the at least one image, determine, using the trained artificial neural network, that the text characters is contextually related to the data exchange operations expected to be performed by the receiving device, tag the at least one image as comprising an anomaly, and block additional electronic data streams between the transmitting device and the receiving device.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed. In one example, an apparatus includes at least one memory, instructions, and processor circuitry. The processor circuitry at least executes or instantiates the instructions to receive a group of indicators from a campaign attack, then query an indicator database with an indicator from the group of indicators, and then predict an identification of the campaign attack in response to the indicator having a current deterministic indicator and confidence scoring (DISC) score in the indicator database, wherein the DISC score represents at least one of a lethality component, a determinism component, or a confidence component of the indicator.

Abstract: Aspects of the disclosure relate to identity-based DNS-traffic routing and monitoring. A computing platform may establish, using an encrypted DNS process, a secure DNS session by executing an encrypted session handshake with a client device, which may include receiving a security certificate for the encrypted DNS process that identifies a user of the client device. The computing platform may receive an encrypted DNS query request comprising a request for an IP address for a specified domain name. The computing platform may determine, based on the security certificate, an identity of the user. The computing platform may determine, based on the identity of the user, a security policy indicating domain matching criteria and corresponding actions to take on matching domain names. The computing platform may determine a first action corresponding to the domain name, and may send, based on the first action, an encrypted DNS query response.

Abstract: A model checking system detects violations and conflicts in security and verification policies by running model checking processes. The system detects privilege escalation attacks in misconfigured identification and access management (“IAM”) policies by modeling security policy documents and IAM actions as logical formulas and then running model checking on the model. The system translates non-Boolean variables, such as string variables, into Boolean variables in order to apply an SAT model checker. The model checker also determines whether a policy violation can be achieved in a finite number of steps by elevating privileges of some compromised principal over multiple iterations of the model checking process, or proves absence thereof.

Abstract: A method may include querying, via a processing system, a database comprising a list of cybersecurity threats associated with operational technology (OT) devices within an industrial system. The method may also include identifying OT devices associated with the list of cybersecurity threats, generating scripts configured to confirm that the OT devices are associated with at least one cybersecurity threat of the list of cybersecurity threats, and sending the scripts to the one or more OT devices. The method may then involve determining that the OT devices are associated with the at least one cybersecurity threat based on responses from the OT devices generated based on the scripts, generating instructions for resolving the at least one cybersecurity threat based on a generative artificial intelligence (AI) system, and sending the instructions to one or more devices.

Abstract: A computer-implemented method for enabling multi-factor authentication for incompatible third-party Remote Authentication Dial-In User Service (“RADIUS”) clients includes a proxy server. The proxy server receives an authentication request from a particular RADIUS client. The proxy server then validates the request for compatibility with a RADIUS server and determines whether the request must be modified. Then, the proxy server forwards the validated and modified authentication request to the RADIUS server which triggers a response from the RADIUS server. Subsequently, the RADIUS server response is translated into a compatible format for the particular, third-party RADIUS client and is then forwarded from the RADIUS server back to that particular, third-party RADIUS client. Also disclosed is a system for enabling multi-factor authentication for incompatible third-party RADIUS clients using a proxy server.

Abstract: A user equipment receives a first message for initial Access Stratum (AS) security activation via a higher layer protocol, wherein the first message includes configuration information for security in a lower layer protocol and the first message is included in a second message of the lower layer protocol. In response to receiving the first message, the UE derives an integrity key for the lower layer protocol based on the configuration information, and it performs an integrity check on the second message based on the derived integrity key.

Abstract: The present disclosure relate to systems and methods for providing a network-based application characterization in prior to deploying a network-based application. An application characterization service may obtain, a configured network based application, the configured network based application corresponds to a set of application attributes of one or more network services from a plurality of network services, in response to obtaining the configured network based application, identify inputs, the identified inputs representing attributes of the configured network based application, wherein each attribute of the identified inputs provided via a generative agent comprising a context window and a prompt, truncate the identified inputs, perform context window curation, dynamically update the prompt, and perform risk assessment on the updated prompt.

Abstract: Aspects of the disclosure relate to dynamically controlling access to linked content in electronic communications. A computing platform may receive, from a user computing device, a request for a uniform resource locator associated with an email message and may evaluate the request using one or more isolation criteria. Based on evaluating the request, the computing platform may identify that the request meets at least one isolation condition associated with the one or more isolation criteria. In response to identifying that the request meets the at least one isolation condition associated with the one or more isolation criteria, the computing platform may initiate a browser mirroring session with the user computing device to provide the user computing device with limited access to a resource corresponding to the uniform resource locator associated with the email message.

Abstract: An autonomous pentesting agent may execute multiple autonomous pentests to gain access to network assets and obtain sets of attributes of the network assets and match network assets across the multiple autonomous pentests according to similarities between the sets of attributes. The autonomous pentesting agent may perform a network asset matching procedure to match one or more first network assets of a first set of network assets with one or more second network assets of a second set of network assets, the network asset matching procedure based on similarity scores between respective first sets of attributes of the first set of network assets and respective second sets of attributes of the second set of network assets. The autonomous pentesting agent may output a network assessment report indicating network security information associated with the network based on the network asset matching procedure.

Abstract: Methods, systems, and computer storage media for providing unified device management using a unified device management engine of a device management system are described. Device management refers to administering, controlling, and maintaining various types of computing devices. The unified device management engine provides a unified policy object that supports unified management of a remote client and a local client using a unified policy. A unified policy object for a remote client and a local client is configured. The unified policy object is a combined management configuration that enables enforcement of a unified policy on both the remote client and the local client. The unified policy is communicated to the remote client. Unified device management data associated with the unified policy, the remote client, and the local client is generated. The unified device management data is communicated to cause display of the unified device management data on a device management interface.

Abstract: The disclosed apparatus, systems and methods relate to methods, systems, and devices for the isolation of devices on a LAN network. Route poisoning, ARP poisoning null routing, blackhole and/or firewall blocking are employed to prevent peer-to-peer network communications within the local area network.

Abstract: An event handler implements a state machine or similar construct for processing of complex event chains as incremental events are detected. This approach advantageously limits processing to monitoring for and responding to a next event in a sequence of events, and supports complex event detection in a manner that scales efficiently in time and computation.

Abstract: A system automates user-specific performance customization in software controlled across multiple devices by conducting current user sessions in which programs are run and user interfaces are displayed at least in part controlled by user-specific program-specific configuration files. The system receives user commands across a network connection from user devices. The user commands include runtime instructions for the specific running programs for which actions are performed accordingly. The system automatically updating user-specific historical data according to received user requests and/or received user commands. Upon initiating a subsequent user session of any specific user, performance attributes of that user session are controlled according at least in part to the updated user-specific historical data in the user-specific profile.

Abstract: Examples include techniques for a trusted execution environment (TEE) at a compute server to request a service to be performed by an accelerator that is located at or with a service server. Examples are described of the TEE at the compute server authenticating the remote accelerator to enable establishment of one or more secure communication sessions for the accelerator to decrypt encrypted data, perform a transformation on the decrypted data and then re-encrypt the transformed data. Examples are also described of the TEE at the compute server authenticating a service TEE at the service server as well as the accelerator to enable the service TEE and the accelerator to collaboratively decrypt encrypted data, perform a transformation on the decrypted data and then re-encrypt the transformed data.

Abstract: The method for authenticating a first device, the method including receiving RF signals from the first device, acquiring feature data from the received RF signals, fitting a model for authenticating the first device using the acquired feature data, storing in memory the fitted model in a second device, and, by the second device receiving a new RF signal from a device to authenticate, acquiring feature data from the new RF signal, and determining whether or not the device to authenticate is the first device by transmitting the feature data, acquired from the new RF signal, as input to the fitted model, the feature data acquired from a RF signal includes values of only one of an in-phase component and a quadrature component of the RF signal over time.

Abstract: A system can include one or more memory devices storing instructions executed by one or more processors. The one or more processors can receive a public key of a device of an industrial automation system corresponding to a private key of the device. The one or more processors can receive a request to grant the device a license to enable a feature of the device or access a feature of the industrial automation system. The one or more processors can generate a certificate including the public key of the device and an indication of the license in a non-encrypted format. The one or more processors can transmit the certificate to the device to cause the device to enable the feature of the device or access the feature of the industrial automation system responsive to the device proving possession of the private key corresponding to the public key in the certificate.

Abstract: Systems and methods are described for providing a secure network connection between a serverless instance and an external environment with respect to a serverless execution environment hosting the serverless instance. A secure connection management system may be implemented in a serverless execution environment with at least one host device hosting the one or more function execution environments. The secure connection management system may facilitate establishment and management of a secure network connection between the serverless instance and the external environment in accordance with the connection configuration. The secure connection management system may also be isolated from the function execution environments in a separate execution environment such that the secure connection management system may take action to reduce risk to the external environment against issues with the execution of serverless function code on the serverless instance.

Abstract: A request to access a destination device associated may be received from a user device. The request may comprise a digital certificate. The digital certificate may comprise a public key of the user device. A distributed ledger address of the user device may be determined by applying a deterministic function to the public key of the user device. A distributed ledger entry may be created on a distributed ledger. The distributed ledger entry may comprise the address of the user device. Based on the distributed ledger entry, access to the destination device may be granted to the user device.

Abstract: Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a network entity may receive, from a security service device, a middlebox security policy, wherein the middlebox security policy is associated with a user equipment (UE) and a service device, and wherein the middlebox security policy indicates a set of authorization policies relating to one or more of the UE or the service device. The network entity may receive a communication on a communication link between the UE and the service device. The network entity may transmit the communication in accordance with the middlebox security policy. Numerous other aspects are described.