Abstract: A computer-implemented method and a system is provided for protecting at least one device of a target infrastructure against a cyber incident, whereby an infrastructure database contains device-specific information for its devices, by providing a security playbook for the given cyber incident, transforming the security playbook to a transformed playbook, analyzing the respective step of the transformed playbook based on a policy and process database, which shows a rule indicating whether at least a part of the step can be executed without any restriction or only with a restriction or has to be blocked, executing the steps based on the labeled playbook taking the handling label into account and for generating at least one instruction derived from at least one of the steps, and generating a device-specific command based on the instruction and based on a syntax processable by the device.

Abstract: A computer-implemented method of generating shares of private keys, wherein the method is performed by a first participant of a group of participants and comprises: obtaining a first seed share, wherein each other participant has a respective seed share; generating a first master private key share of a shared master private key, wherein the first master private key share is generated based on the first seed share and the respective seed share of each other participant, and wherein each other participant has a respective master private key share; and generating one or more first private key shares based on the first master private key share, wherein each first private key share is a share of a respective shared private key.

Abstract: A system and method for software container remediation. A method includes determining that a vulnerability of a software container resides in a first origin image of the software container at least partially by identifying a plurality of derived container images referencing the origin image which have the vulnerability, wherein a first derived container image of the plurality of derived container images is used to run the software container; and rebuilding the first derived container image using contents of a second origin image, wherein the second origin image avoids the vulnerability.

Abstract: The methods and systems are operable to protect a computing environment from attack. The methods and systems incorporate a preventative ability with similar attributes to an Antivirus/Anti-malware technique suitable for use on home user or similar protected computing environments with no or minimal centralized human administrative resources using natural language.

Abstract: A method and system for optimizing compute runtime and memory footprint of a linear transformation process are provided. The method includes determining a set of optimal rotation parameters, wherein the optimal rotation parameters provide an optimal tradeoff between runtime compute resources and a memory footprint for a runtime execution of the linear transformation process; initializing the linear transformation process to run a boosting technique with the determined set of optimal rotation parameters, wherein the boosting technique, when executed at runtime as part of the linear transformation process, performs at least one iteration that yields rotated ciphertexts, and wherein the at least one iteration is based on the determined set optimal rotation parameters and at least one key switching key (KSK); and loading the initialized linear transformation process to an internal memory of a hardware accelerator.

Abstract: To dynamically protect read-only fields using interceptors and encryption, application data is received from an application executing on a client computer system connected to a server computer system connected to a computer-readable database. The application data includes multiple read-only values assigned to corresponding multiple read-only data items and stored on the computer-readable database, which stores generated encrypted read-only data collectively representing an encryption of the multiple read-only values by an encryption mechanism. The received multiple read-only values are encrypted using the same encryption mechanism resulting in received encrypted read-only data. The received encrypted read-only data is compared with the generated encrypted read-only data. Based on the comparing, it is determined that the received encrypted read-only data differs from the generated encrypted read-only data.

Abstract: A method includes determining, by an analysis system, a system aspect of a system for a protection evaluation. The method further includes determining, by the analysis system, at least one evaluation perspective for use in performing the protection evaluation on the system aspect. The method further includes determining, by the analysis system, at least one evaluation viewpoint for use in performing the protection analysis on the system aspect. The method further includes obtaining, by the analysis system, protection data regarding the system aspect in accordance with the at least one evaluation perspective and the at least one evaluation viewpoint. The method further includes calculating, by the analysis system, a protection rating as a measure of protection maturity for the system aspect based on the protection data, the at least one evaluation perspective, the at least one evaluation viewpoint, and at least one evaluation rating metric.

Abstract: Embodiments disclosed herein generally related to a system and method for assessing a fraud risk. In one embodiment, a method for assessing a fraud risk is disclosed herein. A web browser extension executing on the computing device identifies an account associated with the computing device. The web browser extension detects that the computing device navigated to a web page hosted by a third party server. The web browser extension determines that the third party server prompted the computing device to opt into two-factor authentication functionality. The web browser extension determines that the computing device did not opt into the two-factor authentication functionality. The web browser extension prompts, via an application programming interface (API), an organization computing system to update a fraud metric associated with the account.

Abstract: A system and method for vulnerability redemption is disclosed. The method comprises extracting vulnerability details from a vulnerability report regarding an affected host, constructing a bot query based on the vulnerability details, receiving a vulnerability resolution script from a bot in response to the bot query, triggering execution of the vulnerability resolution script on the affected host, receiving an indication of successful execution of the vulnerability resolution script on the affected host, and saving the vulnerability resolution script to a remediation database.

Abstract: A method of maintaining a pool of network decoys includes evolving, over a plurality of epochs, the pool of network decoys towards one or more preferences of a network attacker. The method includes modeling preferences of the network attacker based on monitored interactions between the network attacker and the pool of network decoys to generate a preference model of the network attacker. Each epoch includes updating a fitness function based on the preference model and applying the fitness function to each network decoy included in the pool of network decoys to determine a plurality of fitness values, where the fitness values are representative of an attractiveness of a respective network decoy to the network attacker. The pool of network decoys is then updated based on the fitness values.

Abstract: A method and apparatus for mitigating row hammer attacks is provided. A row hammer alert is generated by a component of a memory architecture controlling operation of a memory device. The component may be a memory controller, coherency logic, or data fabric. The component obtains a physical address of an aggressor row that caused the alert and obtains an identifier of an execution context corresponding to the physical address. The component generates an error message for a processing device, the error message including the identifier of the execution context. The processing device retrieves the error message when performing a context switch. The processing device then generates an event received by the operating system. The operating system then takes action to reduce row hammer by the execution context, such as ending, restarting, or throttling the execution context.

Abstract: Mechanisms are provided for increasing the speed of an encoding process. The mechanisms classify operations in the encoding process based on learned associations between patterns of input data and corresponding encoding result types generated from encoding the patterns of input data. The mechanisms identify operations in the encoding process that can be pruned based on the classifications, to thereby generate a set of prune operations. In addition, the mechanisms replace operations in the set of prune operations with replacement operations that retrieve a corresponding previously generated result. Moreover, the mechanisms emit optimized encoding code comprising the replacement operations in replacement of the set of prune operations that are pruned, for execution of the encoding process using the optimized encoding code.

Abstract: An example method includes receiving an identifier associated with a security deficiency, wherein the security deficiency is associated with a computer system; determining, based on the identifier, text data associated with the identifier; determining a text prompt, wherein the text prompt comprises an instruction segment and the text data, and wherein the instruction segment identifies a remediation strategy detection task and an output constraint; providing the text prompt to a generative machine learning model; receiving, from the generative machine learning model, a set of outputs including a first output identifying a first remediation strategy and a second output identifying a second remediation strategy; determining that the first output satisfies the output constraint; determining that the second output fails to satisfy the output constraint; determining, based on the first output, a final output; and providing the final output using an output interface.

Abstract: Embodiments of this specification provide methods and apparatuses for data privacy protection. An embodiment of the methods comprises receiving, by a first party from a second party, an encrypted integrated vector, determining an encrypted result vector based on the original matrix and the encrypted integrated vector, determining a data processing result based on the encrypted result vector, and sending the data processing result to the second party for the second party to obtain a multiplication calculation result of the original matrix and the n original vectors based on the data processing result.

Abstract: A method and/or computer software for estimating the probability that a software weakness will be used in an exploit and/or malware and the probability that the developed exploit and/or malware will result in a compromise.

Abstract: A data file encryption transmission/reception system includes a computer with a registration module that encrypts input data files. The registration module includes a string conversion module that configured to convert the data file to be encrypted to string data, a key generation module that configured to generate a common key, and to divide the common key and the string data into first input information and second input information, a common key encryption module is configured to encrypt the first input information with the common key, to thereby generate common key encrypted data, a searchable encryption module that configured to encrypt the second input information in accordance with searchable encryption with a user secret key set in advance, to thereby generate searchable encrypted data and a communication module is configured to register a set of the common key encrypted data and the searchable encrypted data in the data management server.

Abstract: Techniques for managing the implementation of application-code scanning processes are disclosed. A system scans application code by analyzing metadata associated with the application code to identify a set of data needed to scan the application code with a scanning application. Based on the information obtained from the application metadata, the system identifies extraction processes that are needed to obtain the set of data. The system applies a set of one or more application-code scanners by implementing the extraction processes. The system presents in a graphical user interface (GUI) a set of results from scanning operations.

Abstract: A method includes obtaining a plurality of representative vectors associated with face-related data. The method includes determining an encryption key based on a parameter stored in a record, generating an encrypted vector set by, for each respective vector of the plurality of representative vectors, encrypting the respective vector with a homomorphic encryption operation based on the encryption key, where the encrypted vector set includes a first encrypted vector that is linked to a subset of the face-related data associated with the first plurality of face vectors. The method further includes obtaining an encrypted face search vector using the encryption key to perform homomorphic encryption. The method further includes selecting a first encrypted vector based on the encrypted face search vector and retrieving the subset of the face-related data based on the first encrypted vector.

Abstract: Cyber intrusion detection (CID) and data protection (DP) are coordinated within a storage node to enable the capabilities of DP to be automatically and quickly utilized in response to detected threats to help protect data. CID sends an alert message to DP in response to detection of a ransomware attack or other threat. DP responds to the alert message by implementing at least one countermeasure, such as: generating new targetless snapshots of the storage objects under attack, the version data group of which the storage objects are members, or all storage objects maintained by the storage array; securing and/or preserving some of the targetless snapshots that existed before the infection; changing the targetless snapshot generation and retention schedule; and temporarily halting generation of new targetless snapshots.

Abstract: Methods and systems for assessing risk associated with Artificial Intelligence (AI) models are provided. The method includes receiving a risk parameter among a plurality of risk parameters used for assessing an AI model, from a user associated with the AI model. Further, the method includes generating a preset questionnaire including a plurality of questions corresponding to the risk parameter. Furthermore, the method includes receiving user response data and corresponding evidence data against each of the plurality of questions from the user. The user response data is validated by correlating the user response data with the corresponding evidence data. The validated user response data is compared with preset response data corresponding to each of the plurality of questions. Thereafter, the method includes generating a report including a risk score indicating a risk associated with the AI model corresponding to the risk parameter, using a learning model, based on the comparison.