Abstract: An attack defense method, where addresses in a protected network are divided into a plurality of address ranges that include a first address range and a second address range. The first address range is a proper subset of the second address range, or the second address range is a proper subset of the first address range. A protection device or a server coupled to the protection device collect statistics on first traffic that passes through the protection device. When the statistics exceed a first threshold, the protection device performs defense processing on the first traffic. The first traffic is of a target type and has a destination address that is in the first address range. The first address range and the second address range are address ranges of different granularities.

Abstract: Operating an analysis system that includes one or more computing entities by installing a system user interface module on a system to be evaluated, installing a data extraction module on the system to be evaluated and establishing at least one secure data pipeline between the analysis system and the system to be evaluated to service communications between the analysis system and the system user interface module and the analysis system and the data extraction module. The method further includes determining analysis parameters for the system to be evaluated, identifying assets of the system to be evaluated based upon the analysis parameters, receiving data from the data extraction module, via the at least one secure data pipeline and based upon the analysis parameters, the data regarding the assets of the system to be evaluated, and processing the data based upon the analysis parameters to produce one or more evaluation outputs.

Abstract: Systems and methods for capturing consent via mobile device are described herein. A computer system associated with an institution receives a request for a consent session from an agent terminal. Responsive to the request, the computer system initiates a consent session and transmits a consent request notification to a mobile device associated with a customer of the institution. Based on the customer's selection of the notification, the computer system receives authentication information associated with the customer from the mobile device. Upon authenticating the consent session, the computer system receives a consent decision from the mobile device. The computer system stores a record of the consent decision in a consent databases. The computer system transmits a customized visit summary to the mobile device, the customized visit summary comprising the record of the consent decision.

Abstract: The technology described herein is related to a hybrid neural network that divides operations of a neural network layer between a server and a client device. In an aspect, one or more liner operations of a neural network layer are performed on the client, while non-linear operations, such as an activation function, are performed on the server. In an aspect, the technology described herein maintains network security by encrypting portions of the client-side components. The encrypted portions may be learned values, which may also be described as learned parameters. In aspects, homomorphic encryption is used.

Abstract: A computerized method for associating cyberthreat actor groups responsible for different cyberthreats is described. The method involves generating a similarity matrix based on content from received clusters of cybersecurity information. Each received cluster of cybersecurity information is assumed to be associated with a cyberthreat. The similarity matrix is composed via an optimized equation combining separate similarity metrics, where each similarity metric of the plurality of similarity metrics represents a level of correlation between at least two clusters of cybersecurity information, with respect to a particular aspect of operations described in the clusters. The method further involves that, in response to queries directed to the similarity matrix, generating a listing of a subset of the clusters of cybersecurity information having a greater likelihood of being associated with cyberthreats caused by the same cyberthreat actor group.

Abstract: A system that includes a redacted records data server for storing a redacted data record that includes a redacted primary key and a sensitive linking key, a sensitive records data server for storing a sensitive data record that includes a sensitive primary key and a redacted linking key. The system includes a key converter server operable to convert the redacted linking key into the redacted primary key and the sensitive linking key into the sensitive primary key, and a records request server configured to receive authorization to combine the redacted data record with the sensitive data record, and upon receiving authorization, to generate a combined data record and transmit the combined data record to a user device.

Abstract: A computer implemented method for persistent security configuration monitoring of a persistent configuration record defining a configurable software and/or hardware system over a plurality of lifecycle stages of the system. The method includes during a first lifecycle phase of the system, automatically performing a first security task using a first automation engine according to a first configuration of the automation engine, wherein the first configuration defines a target action to be performed by the first automation engine, and an event detectable by the first automation engine that triggers the target action, detecting, using the first automation engine, the event, updating, using the first automation engine, a portion of the persistent configuration record relating to the first lifecycle phase, and triggering, via the first automation engine, at least one security task in response to the detection of the event.

Abstract: A computer-implemented method and a system is provided for protecting at least one device of a target infrastructure against a cyber incident, whereby an infrastructure database contains device-specific information for its devices, by providing a security playbook for the given cyber incident, transforming the security playbook to a transformed playbook, analyzing the respective step of the transformed playbook based on a policy and process database, which shows a rule indicating whether at least a part of the step can be executed without any restriction or only with a restriction or has to be blocked, executing the steps based on the labeled playbook taking the handling label into account and for generating at least one instruction derived from at least one of the steps, and generating a device-specific command based on the instruction and based on a syntax processable by the device.

Abstract: A computer-implemented method of generating shares of private keys, wherein the method is performed by a first participant of a group of participants and comprises: obtaining a first seed share, wherein each other participant has a respective seed share; generating a first master private key share of a shared master private key, wherein the first master private key share is generated based on the first seed share and the respective seed share of each other participant, and wherein each other participant has a respective master private key share; and generating one or more first private key shares based on the first master private key share, wherein each first private key share is a share of a respective shared private key.

Abstract: A system and method for software container remediation. A method includes determining that a vulnerability of a software container resides in a first origin image of the software container at least partially by identifying a plurality of derived container images referencing the origin image which have the vulnerability, wherein a first derived container image of the plurality of derived container images is used to run the software container; and rebuilding the first derived container image using contents of a second origin image, wherein the second origin image avoids the vulnerability.

Abstract: The methods and systems are operable to protect a computing environment from attack. The methods and systems incorporate a preventative ability with similar attributes to an Antivirus/Anti-malware technique suitable for use on home user or similar protected computing environments with no or minimal centralized human administrative resources using natural language.

Abstract: A method and system for optimizing compute runtime and memory footprint of a linear transformation process are provided. The method includes determining a set of optimal rotation parameters, wherein the optimal rotation parameters provide an optimal tradeoff between runtime compute resources and a memory footprint for a runtime execution of the linear transformation process; initializing the linear transformation process to run a boosting technique with the determined set of optimal rotation parameters, wherein the boosting technique, when executed at runtime as part of the linear transformation process, performs at least one iteration that yields rotated ciphertexts, and wherein the at least one iteration is based on the determined set optimal rotation parameters and at least one key switching key (KSK); and loading the initialized linear transformation process to an internal memory of a hardware accelerator.

Abstract: To dynamically protect read-only fields using interceptors and encryption, application data is received from an application executing on a client computer system connected to a server computer system connected to a computer-readable database. The application data includes multiple read-only values assigned to corresponding multiple read-only data items and stored on the computer-readable database, which stores generated encrypted read-only data collectively representing an encryption of the multiple read-only values by an encryption mechanism. The received multiple read-only values are encrypted using the same encryption mechanism resulting in received encrypted read-only data. The received encrypted read-only data is compared with the generated encrypted read-only data. Based on the comparing, it is determined that the received encrypted read-only data differs from the generated encrypted read-only data.

Abstract: A method includes determining, by an analysis system, a system aspect of a system for a protection evaluation. The method further includes determining, by the analysis system, at least one evaluation perspective for use in performing the protection evaluation on the system aspect. The method further includes determining, by the analysis system, at least one evaluation viewpoint for use in performing the protection analysis on the system aspect. The method further includes obtaining, by the analysis system, protection data regarding the system aspect in accordance with the at least one evaluation perspective and the at least one evaluation viewpoint. The method further includes calculating, by the analysis system, a protection rating as a measure of protection maturity for the system aspect based on the protection data, the at least one evaluation perspective, the at least one evaluation viewpoint, and at least one evaluation rating metric.

Abstract: Embodiments disclosed herein generally related to a system and method for assessing a fraud risk. In one embodiment, a method for assessing a fraud risk is disclosed herein. A web browser extension executing on the computing device identifies an account associated with the computing device. The web browser extension detects that the computing device navigated to a web page hosted by a third party server. The web browser extension determines that the third party server prompted the computing device to opt into two-factor authentication functionality. The web browser extension determines that the computing device did not opt into the two-factor authentication functionality. The web browser extension prompts, via an application programming interface (API), an organization computing system to update a fraud metric associated with the account.

Abstract: A system and method for vulnerability redemption is disclosed. The method comprises extracting vulnerability details from a vulnerability report regarding an affected host, constructing a bot query based on the vulnerability details, receiving a vulnerability resolution script from a bot in response to the bot query, triggering execution of the vulnerability resolution script on the affected host, receiving an indication of successful execution of the vulnerability resolution script on the affected host, and saving the vulnerability resolution script to a remediation database.

Abstract: A method of maintaining a pool of network decoys includes evolving, over a plurality of epochs, the pool of network decoys towards one or more preferences of a network attacker. The method includes modeling preferences of the network attacker based on monitored interactions between the network attacker and the pool of network decoys to generate a preference model of the network attacker. Each epoch includes updating a fitness function based on the preference model and applying the fitness function to each network decoy included in the pool of network decoys to determine a plurality of fitness values, where the fitness values are representative of an attractiveness of a respective network decoy to the network attacker. The pool of network decoys is then updated based on the fitness values.

Abstract: A method and apparatus for mitigating row hammer attacks is provided. A row hammer alert is generated by a component of a memory architecture controlling operation of a memory device. The component may be a memory controller, coherency logic, or data fabric. The component obtains a physical address of an aggressor row that caused the alert and obtains an identifier of an execution context corresponding to the physical address. The component generates an error message for a processing device, the error message including the identifier of the execution context. The processing device retrieves the error message when performing a context switch. The processing device then generates an event received by the operating system. The operating system then takes action to reduce row hammer by the execution context, such as ending, restarting, or throttling the execution context.

Abstract: Mechanisms are provided for increasing the speed of an encoding process. The mechanisms classify operations in the encoding process based on learned associations between patterns of input data and corresponding encoding result types generated from encoding the patterns of input data. The mechanisms identify operations in the encoding process that can be pruned based on the classifications, to thereby generate a set of prune operations. In addition, the mechanisms replace operations in the set of prune operations with replacement operations that retrieve a corresponding previously generated result. Moreover, the mechanisms emit optimized encoding code comprising the replacement operations in replacement of the set of prune operations that are pruned, for execution of the encoding process using the optimized encoding code.

Abstract: An example method includes receiving an identifier associated with a security deficiency, wherein the security deficiency is associated with a computer system; determining, based on the identifier, text data associated with the identifier; determining a text prompt, wherein the text prompt comprises an instruction segment and the text data, and wherein the instruction segment identifies a remediation strategy detection task and an output constraint; providing the text prompt to a generative machine learning model; receiving, from the generative machine learning model, a set of outputs including a first output identifying a first remediation strategy and a second output identifying a second remediation strategy; determining that the first output satisfies the output constraint; determining that the second output fails to satisfy the output constraint; determining, based on the first output, a final output; and providing the final output using an output interface.