Abstract: The present disclosure provides a stability criterion for time-delay of cyber-physical power systems under distributed control, which relates to a field of cyber-physical power systems technologies.

Abstract: Detection of squatting domains is disclosed. A set of new fully qualified domain names (FQDNs) is received. The set of new FQDNs is analyzed to detect domain squatting by identifying a subset of the new FQDNs as candidate squatting domains. The candidate squatting domains are distributed to a security device/service.

Abstract: A system for detecting Denial-of-Service (DoS) attacks on one or more user profiles collects a number of invalid sign-on attempts on the one or more user profiles during every time interval. The system determines a number of invalid sign-on attempts on every user profile since the start of the first time interval. The system detects a first DoS attack on a particular user profile if a first number of invalid sign-on attempts on the particular user profile exceeds a single-user profile. The system detects a second DoS attack on multiple user profiles during the first time interval if the increase in the total number of invalid sign-on attempts since the last time interval exceeds a scan-level threshold number. The system detects a third DoS attack on multiple user profiles if the total number of invalid sign-on attempts detected during combined time intervals exceeds a third threshold number.

Abstract: The present disclosure relates to a machine-learning system, method, and computer program for ranking security alerts from multiple sources. The system self-learns risk levels associated with alerts by calculating risk probabilities for the alerts based on characteristics of the alerts and historical alert data. In response to receiving a security alert from one of a plurality of alert-generation sources, the alert-ranking system evaluates the security alert with respect to a plurality of feature indicators. The system creates a feature vector for the security alert based on the feature indicator values identified for the alert. The system then calculates a probability that the security alert relates to a cybersecurity risk in the computer network based on the created feature vector and historical alert data in the network. The system ranks alerts from a plurality of different sources based on the calculated cybersecurity risk probabilities.

Abstract: A computer-implemented method for provisioning an Internet of Things (IoT) device comprises receiving, at a device provisioning system, an event schema for the IoT device. The method further comprises comparing the one or more event types from the event schema with a plurality of combinations of one or more event types in a device type schema list to identify a match between the one or more event types in the event schema from the IoT device and one of the plurality of combinations of one or more event types in the device type schema list; in response to identifying a match, assigning a device type to the IoT device based on a correlation in the device type schema list for the device type and the matched combination of one or more event types; and provisioning the IoT device with validated credentials based on the assigned device type.

Abstract: Systems and methods include establishing a control channel of a tunnel utilizing a first encryption technique, wherein the tunnel is between a local node including one or more processors and a remote node, and wherein the control channel includes a session identifier; establishing a data channel of the tunnel utilizing a second encryption technique, wherein the data tunnel is bound to the control channel based on the session identifier; performing, over the control channel, device authentication and user authentication of one or more users associated with the remote node, wherein each of the one or more users includes a user identifier; and, subsequent to the device authentication and the user authentication, exchanging data packets over the data channel with each data packet including a corresponding user identifier. The first encryption technique can be one of TLS and SSL, and the second encryption technique can be one of TLS and DTLS.

Abstract: A method of managing access to a network destination. The method includes establishing a first network zone for a user, the first network zone including a plurality of network destinations. The first network zone is monitored and one or more changes in the first network zone are determined. A first network destination in the first network zone is analyzed responsive to determining the one or more changes in the first network zone to determine a first threat. An attempt by the user to access the first network destination is detected, and access by the user to the first network destination is restricted based on the determining the first threat.

Abstract: A valid route origin authorization (ROA) for a specified IP address is published and a distributed denial-of-service (DDoS) attack to a given IP address is detected. A flowspec rule is advertised from a given autonomous system network to one or more neighboring autonomous system networks in response to the detection of the distributed denial-of-service (DDoS) attack. A modified Resource Public Key Infrastructure (RPKI) validation is performed using the published valid route origin authorization (ROA) in response to the advertisement of the flowspec rule. The flowspec rule is implemented to mitigate the distributed denial-of-service (DDoS) attack in response to the validation of the flowspec rule.

Abstract: A security assessment system is configured to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components. The security assessment system includes a duplicated environment design circuitry and a duplicated environment construction circuitry. The duplicated environment design circuitry is configured to select a duplication level based on constraints specified by a user in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design. The duplication level is indicative of any one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system. The duplicated environment construction circuitry is configured to construct the duplicated environment based on the designed result. The duplicated environment includes components which are duplicated by one of the duplication level.

Abstract: Artificial Intelligence (“AI”) apparatus and method are provided that correlate and consolidate operation of discrete vendor tools for detecting cyberthreats on a network. An AI engine may filter false positives and eliminate duplicates within cyberthreats detected by multiple vendor tools. The AI engine provides machine learning solutions to complexities associated with translating vendor-specific cyberthreats to known cyberthreats. The AI engine may ingest data generated by the multiple vendor tools. The AI engine may classify hardware devices or software applications scanned by each vendor tool. The AI engine may decommission vendor tools that provide redundant cyberthreat detection. The AI engine may display operational results on a dashboard directing cyberthreat defense teams to corroborated cyberthreats and away from false positives.

Abstract: A method of monitoring a network is provided. The method includes receiving a packet of network traffic, determining a source IP address of the packet, consulting a database of source IP addresses, each source IP address having an associated probability of threat indicator (PTI) that indicates a probability of threat posed by the source IP address. The packet's source IP address' PTI is assigned to the packet as the packet's PTI, and one or more inspection checks are selected to be performed on the packet, wherein the selection of the inspection checks is a function of the packet's source IP address PTI. The method further includes performing the selected inspection checks, assigning treatment of the packet based on a result of the inspection checks performed, and adjusting the packet's source IP address' PTI or the packet's PTI based on the result of the one or more inspection checks performed.

Abstract: A DDoS handling device configured to handle communication directed to a target of a DDoS attack flowing in from an adjacent autonomous system in an autonomous system provided with a plurality of mitigating locations includes: a load distribution determination unit configured to determine whether or not to execute load distribution processing on the basis of an amount of available resources at mitigating locations corresponding to a gateway device into which the communication directed to the target flows and an amount of the communication directed to the target in a case in which at least one attack has been detected; a load distribution processing unit configured to decide mitigating locations to be used to handle the communication directed to the target from among the plurality of mitigating locations to solve shortage of resources at the mitigating locations for each attack, in a case in which the load distribution determination unit determines to execute the load distribution processing; and an attack hand

Abstract: Techniques are disclosed relating to dynamically routing network traffic between defense layers. For example, in various embodiments, a server system may implement a traffic distribution module that is operable to distribute a particular type of network traffic across multiple different defense layers. The traffic distribution module may receive a first set of requests that have been identified as being indicative of that particular type of network traffic and then route this first set of requests across the different defense layers based on a set of distribution weightage values. In various embodiments, the disclosed techniques include determining an updated set of distribution weightage values based on an effectiveness of the defense layers in mitigating the particular type of network traffic. In such embodiments, the traffic distribution module may then use this updated set of distribution weightage values to route a second set of network traffic across the various defense layers.

Abstract: An illustrative injection detection system receives a text statement that includes a set of text elements and implements instructions for performing an operation with respect to a data structure. The system identifies a target risk element count equal to a number of risk elements preapproved to occur within the set of text elements of the text statement. The system also determines a detected risk element count equal to a number of risk elements that occur within the set of text elements of the text statement. If the system detects a violation of a predetermined rule defining an acceptable relationship between the target and detected risk element counts for the text statement, the system triggers an exception condition indicating a risk that the text statement corresponds to an injection attack on the data structure. Corresponding methods and systems are also disclosed.

Abstract: The disclosure provides a method for detecting and defending a Distributed Denial of Service attack in an SDN environment. The method includes: building data messages acquired as feature messages by a proxy module; sending the feature messages to a pre-built detection model to obtain a detection result; making a decision instruction based on the detection result; and performing control operations by the proxy module based on the decision instruction.

Abstract: This document relates to a process for autopilot re-enrollment of managed devices in a network following a reset of the managed devices. Upon determining that the managed devices lack a hardware authenticator, a one-time password can be issued to the managed devices that may be stored in a persistent memory, and upon reset of the managed devices, the one-time password can be returned for validation and the managed devices can be automatically re-enrolled in the network upon validation of the one-time password.

Abstract: A security assessment system is configured to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components. The security assessment system includes a duplicated environment design circuitry and a duplicated environment construction circuitry. The duplicated environment design circuitry is configured to select a duplication level based on constraints specified by a user and effects associated with the physical components in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design. The duplication level is indicative of any one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system. The duplicated environment construction circuitry is configured to construct the duplicated environment based on the designed result.

Abstract: A method of automated filtering includes receiving a network traffic snapshot having packets with data stored in respective fields, generating a statistical data structure storing each potential unique combination of data stored in respective fields with an associated counter that is incremented for each occurrence that the combination matches one of the packets of the network traffic snapshot and one or more observation timestamps. Determining an observed vector from the statistical data structure, wherein the observed vector has associated attribute/value pairs and counters that satisfy a predetermined criterion. The observed vector's attribute/value pairs are compared to known attribute/value pairs associated with known DDoS attack vectors of an attack vector database.

Abstract: A method and system for securing an operating domain that spans one or more distributed information technology networks is disclosed. In the present invention, a state machine reference monitor, comprising a monitor port operatively connected to one or more network traffic capture devices positioned across a distributed network of an operating domain, with each traffic capture interception network device in communication with a central server. Each interception network device along with the central server having a processor and a memory comprising instructions, which when executed by each device processor perform the method of extracting logic state data and deducting ancillary logic state data across the distributed operating domain.

Abstract: A method for mitigating network abuse includes obtaining a first set of network traffic messages of network traffic currently received by a network service and determining, via a first model, whether network abuse is occurring based on the first set of network traffic messages. When the network abuse is occurring, the method includes obtaining a second set of current network traffic messages. The method also includes, for each network traffic message in the second set of network traffic messages, labeling, via a second model, the network traffic message as an abusing network traffic message or a non-abusing network traffic message. The method also includes generating, via a third model, at least one network traffic rule. Each network traffic rule, when implemented, reduces an effect of the abusing network traffic messages.