Abstract: An electronic device, computer program product, and method provide autonomous protection from security threat on peered receiving device(s) during peer-to-peer application streaming.

Abstract: Controlling access to external capabilities exposed by a resource server for artificial intelligence models. An access server receives an authorization request from a resource client for authorization of a resource server. The access server determines a set of capabilities associated with the resource server and enforces access policies to identify permitted capabilities subject to consent being given. After determining that consent has been given, the access server generates an access token that is capable of being used as a credential for the consented capabilities. Subsequent requests from the resource server are validated and routed to the appropriate capabilities, with responses returned accordingly.

Abstract: An intermediary server receives a request for a resource hosted at an origin server. The intermediary server determines whether the request includes a session identifier that can be used to verify an identity of the user agent. If it does not, the intermediary server determines a predicted identity of the user agent. If a policy that is used for controlling access to the internet resource for certain user agents based on condition(s) being satisfied is applicable, the intermediary server sends a response to the user agent that indicates access to the resource is contingent on the condition(s) being satisfied. A subsequent request that includes a session identifier can be received to verify the identity of the user agent. If the identity of the user agent is verified, the intermediary server determines whether the condition(s) have been satisfied. If they are, then the intermediary server allows access to the internet resource.

Abstract: A system is disclosed. The system includes one or more processing resources and a memory device, coupled to the one or more processing resource, having stored therein instructions that when executed by the processing resource cause the processing resources to detect a driver loading for execution, determine whether current baseline flag and callback values match baseline flag and callback values, load a driver image upon a determination that the current baseline values match the baseline values and validate the driver image.

Abstract: A system and method for determining privilege escalation attack pathways by performing a comprehensive cybersecurity threat assessment of software applications based on the totality of vulnerabilities from all levels of the software supply chain to determine attack paths for a privilege escalation attack. The system and method comprising analyzing the code and/or operation of a software application to determine components comprising the software, identifying the source of such components, determining vulnerabilities associated with those components, compiling a list of such components, creating a directed graph of relationships between the components, their sources, and new exploitation pathways, and evaluating the overall threat associated with the software application based its software vulnerabilities.

Abstract: Methods and systems for designing a default-deny network egress control architecture in a virtual private cloud (VPC) environment are described herein. According to an implementation, the system may create a first subnet in a private computer network to perform egress control. The system implements a private network address translation (NAT) gateway, a network access control list (NACL), and a private elastic network interface (ENI) in the first subnet. The first subnet may be referred to a “blackhole subnet” or a “terminating subnet.” Upon receiving a traffic destined to a public computer network, e.g., Internet, the private NAT gateway may determine whether the traffic is authorized to egress based on the NACL. The private NAT gateway forwards the traffic to the private ENI to discard the traffic if the traffic is not authorized to egress and logs the information associated with the traffic.

Abstract: An intermediary server receives a request for a resource hosted at an origin server. The intermediary server determines whether the request includes a signature header that can be used to verify an identity of the user agent. If it does not, the intermediary server determines a predicted identity of the user agent. If a policy that is used for controlling access to the internet resource for certain user agents based on condition(s) being satisfied is applicable, the intermediary server sends a response to the user agent that indicates access to the resource is contingent on the condition(s) being satisfied. A subsequent request that includes a signature header can be received to verify the identity of the user agent. If the identity of the user agent is verified, the intermediary server determines whether the condition(s) have been satisfied. If they are, then the intermediary server allows access to the internet resource.

Abstract: A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost/benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost/benefit indicators. The recommendation engine runs continuously, makes suggestions, and takes adjustably autonomous actions to go further and actuate parts of the system using an orchestration service employing a distributed computational graph and actuation plugins based on generated plans. Actions are validated as required or as prudent from appropriate simulation modeling services.

Abstract: Systems and methods for application security improvements are provided. The systems and methods may receive a banking request, including a request header, from a web browser or mobile application. Thereafter, a session cookie may be extracted from the request header. The session cookie may include one or more of a CSRF token, a MORF token, and a JWT. Thereafter, an outer API may validate the one or more tokens and create a validated banking request object. Upon such validations, a financial institution's APIs may allow a banking request to proceed with a high degree of confidence that the request is free of interference by bad actors and fraud. The validated banking request object may be transmitted to an inner API to accomplish the banking request. Thus, the system and methods described herein provide an improved system for application security, which decreases rates of fraud below that of known systems.

Abstract: A method includes identifying, by a processing device, a third-party service provider of a plurality of third-party service providers that is authorized by a user to access data associated with the user. A data privacy score is generated based on one or more privacy risk factors. The data privacy score is associated with the third-party service provider. The data privacy score is indicative of a level of protection and privacy the third-party service provider maintains with respect to the data. A user interface (UI) displaying at least the data privacy score associated with the third-party service provider is provided for presentation on a client device associated with the user.

Abstract: A system and method are disclosed for policy-constrained symbolic rendering of artificial intelligence outputs using deterministic evidence structures and authenticated display controls. Governed records derived from device, clinical, operational, environmental, or multi modal data are normalized, lineage-tracked, and assembled into deterministic evidence packs whose ranking, augmentation, pruning, and ordering are reproducible and traceable. Governed prompts constructed from these evidence packs are provided to internal or external artificial intelligence models under controlled, deterministic invocation parameters. Candidate model outputs—textual or multimodal—are symbolically interpreted, evaluated by a multi-policy engine, and constrained into compliant renderable forms. A cryptographic render-token architecture binds each constrained output to its governing evidence, policy state, model and tokenizer identity, viewport or session binding, environmental conditions, temporal validity, and decision lineage.

Abstract: A method may include: a third-party receiving a claimed position from a prover; the third-party and the prover exchanging quantum information; the third-party generating a third-party raw key based on the quantum information; the prover generating a prover raw key based on the quantum information; the third-party and the prover performing classical post-processing based on the raw keys; the third-party sending, a position verification request with the claimed position to a first verifier and a second verifier; the first verifier and the second verifier sending classical messages and a quantum system to the prover to arrive at a target time; the prover measuring the quantum system using the classical messages; the prover sending responses to the verifiers; the verifiers validating the responses and confirming that the responses were received within an expected time window; and the first verifier informing the third-party of a result of the validation.

Abstract: A cryptography administration system facilitates secure, user-friendly and auditable cryptography. The system can generate an encrypted data value from raw data values with a user-selected cryptography algorithm. The encrypted data value can comprise a pointer configured to access a location in storage comprising a cryptography key for decrypting the encrypted data value. The system can generate a license comprising one or more permissions of a user to decrypt the encrypted data value. The system can store the license in the location in storage accessible by the pointer of the encrypted data value.

Abstract: A system and method for comprehensive cybersecurity threat assessment of software applications based on the totality of vulnerabilities from all levels of the software supply chain. The system and method comprising analyzing the code and/or operation of a software application to determine components comprising the software, identifying the source of such components, determining vulnerabilities associated with those components, compiling a list of such components, creating a directed graph of relationships between the components and their sources, and evaluating the overall threat associated with the software application based its software supply chain vulnerabilities.

Abstract: A method for defending an LLM against a jailbreaking attack includes receiving an input prompt for generating output from the LLM. The method further includes generating N versions of the input prompt, wherein generating each of the N versions includes perturbing the input prompt to generate N perturbed input prompts. The method further includes providing the N perturbed input prompts as input to the LLM, which generates N responses. The method further includes aggregating the responses by estimating a group effect of the perturbed input prompts on the LLM. The method further includes selecting, as output, one of the N responses corresponding to a perturbed input prompt that causes the LLM to generate a response that agrees with the estimated group effect.

Abstract: A method for monitoring an Integrated Circuit (IC). The method includes decrypting, by the Root-Of-Trust (ROT) module, an identity package that resides in a non-volatile memory of the IC using a secret accessible by the ROT module. The identity package is configured in a decrypted state at the non-volatile memory by use of the secret. The ROT module is configured to discover, based on monitoring data from a sensor that an attack is at least being attempted on a package of the IC. The ROT determines whether a debug package is present in response to the attack. If the debug package is not present, the ROT module is configured to execute a tamper resistance process to prevent the use of the secret by the ROT module and the identity package from being placed or remaining in a decrypted state in the non-volatile memory of the IC.

Abstract: Vulnerable cloud resource dependencies are identified in codebases. A codebase is scanned for references to one or more cloud resources. Untrusted cloud resources are identified by comparing the referenced cloud resources to an inventory of trusted cloud resources. An untrusted cloud resource is detected to be vulnerable to a cyberattack in response to determining that a subdomain of the untrusted cloud resource cannot be resolved to an Internet Protocol (IP) address by a Domain Name System (DNS) server and can be registered with a cloud service provider.

Abstract: An example apparatus includes: accessing, by storage interface circuitry, chip information, the chip information corresponding to a semiconductor chip; removing, by at least one processor circuit, redundant information from the chip information to generate deduplicated chip information; classifying, by the at least one processor circuit, the deduplicated chip information into first classified chip information and second classified chip information, the first classified chip information corresponding to a first access permission, the second classified chip information corresponding to a second access permission; and causing, by the at least one processor circuit, storing (block 808) of the first classified chip information in a first classified file in memory and the second classified chip information in a second classified file in the memory.

Abstract: Systems and methods are provided for sending and receiving encrypted submessages. A method for sending and receiving encrypted submessages includes generating a first submessage comprising a first portion of content stored onto a first computer, wherein the first submessage includes at least two submessage units; generating a second submessage comprising a second portion of the content; encrypting the at least two submessage units to provide at least two encrypted submessage units; transmitting the first submessage, including the at least two encrypted submessage units, to a second computer via a first path; transmitting the second submessage to the second computer via a second path; and transmitting at least two encryption keys to the second computer, wherein each of the at least two encryption keys respectively corresponds to one of each of the at least two encrypted submessage units.

Abstract: Systems and methods govern bedside AI inference output finalization on a clinical device. A permit rail intercepts an inference request or a user-interface finalization request for an inference episode, obtains an attested device-state vector, a clinical context envelope, and a clinician identity token, and evaluates a policy graph to compute a permit outcome as a permit value or a non-permit value. A user-interface finalization gate at a commit boundary prevents finalization unless the permit outcome corresponds to the permit value; in certain embodiments, an override indicator or attestation satisfying policy is received and incorporated into policy evaluation.