Abstract: The present disclosure provides a challenge-response testing systems for distinguishing between human users and bots. When a user requests to access an electronic resource on a computing device, the computing device identifies a challenge-response test for the user to complete. As part of the test, the computing device renders a first view of a 3D environment on a digital display. The computing device notifies the user of a test condition to complete. To satisfy the test condition, the user has to provide input that will effect a specified change to the view of the 3D environment seen on the display. Once the user provides electronic input, the computing device updates the viewing perspective of the 3D environment and renders an updated view on the digital display. When the user submits an indication that the test has been completed, the computing device verifies whether the test condition has been satisfied.

Abstract: Aspects of the present disclosure involve systems, methods, computer program products, and the like, for utilizing an access log of a proxy server device of a content delivery network (CDN) to detect and mitigate a denial of service (DOS) on a web or content server hosted by the CDN. Through an analysis of the content requests received at the proxy server listed in the access logs, one or more IP addresses may be identified as involved in a potential DOS attack or other suspicious behavior. Once identified, the suspicious activities of the one or more IP addresses may be tracked and aggregated over a particular period of time, with each detected suspicious request to the content server being counted. The count of suspicious requests to the content server may then be compared to one or more threshold values and a remediation action may occur when the thresholds are met or exceeded.

Abstract: A posture assessment system is provided that uses an application programming interface (“API”), integrated into a computing device operating system, to assess the posture of the computing device. The API provides temporarily heightened access to the operating system, and executes code provided by the posture assessment system. The code may cause performance of various operations on the computing device, such as generating encoded representations of operating system components, performing computationally-expensive functions to verify execution of the code, and the like. The output of these operations can be sent to the posture assessment system for verification.

Abstract: A system, method, and device are presented for assessing a target network's vulnerability to a real cyberthreat based on determining policy-based synthetic tests configured to model the behavior of the cyberthreat. Real-time feedback from the target network (e.g., servers, desktops, and network/monitoring hardware and/or software equipment) are received, analyzed, and used to determine whether any modifications to the same or a new synthesized test is preferred. The technology includes self-healing processes that, using the feedback mechanisms, can attempt to find patches for known vulnerabilities, test for unknown vulnerabilities, and configure the target network's resources in accordance with predefined service-level agreements.

Abstract: The present document relates to transcoding of metadata, and in particular to a method and system for transcoding metadata with reduced computational complexity. A transcoder configured to transcode an inbound bitstream comprising an inbound content frame and an associated inbound metadata frame into an outbound bitstream comprising an outbound content frame and an associated outbound metadata frame is described. The inbound content frame is indicative of a signal encoded according to a first codec system and the outbound content frame is indicative of the signal encoded according to a second codec system. The transcoder is configured to identify an inbound block of metadata from the inbound metadata frame, the inbound block of metadata associated with an inbound descriptor indicative of one or more properties of metadata comprised within the inbound block of metadata, and to generate the outbound metadata frame from the inbound metadata frame based on the inbound descriptor.

Abstract: For presenting a data instance based on data rules, a processor retrieves a data unique identifier from a data instance. The processor further identifies each person associated with the data instance. The processor presents the data instance based on presentation rules for each person. The presentation rules are a function of one or more of a personal jurisdiction of each person, a jurisdiction of the presentation of the data instance, and a current time. No presentation rules for each person are violated.

Abstract: A computer-implemented method for automatically blocking Web Proxy Auto-Discovery Protocol (WPAD) attacks may include (i) automatically detecting, by a computing device, a WPAD request for a configuration file, (ii) identifying, by the computing device, a server attempting to fulfill the WPAD request for the configuration file, (iii) determining, by the computing device, that the server is not included in a whitelist of WPAD servers for the configuration file, and (iv) automatically performing, by the computing device and based on the determination that the server is not included in the whitelist, a security action to secure the WPAD request for the configuration file. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Embodiments of the disclosure provide a method of incorporating multiple authentication systems and protocols. The types of authentication systems and protocols can vary based on desired assurance levels. A Centralized Authentication System together with an authentication policy dictates acceptable authentication systems. Authorization data for each authorization system are captured and packaged into a single Object Data Structure. The authorization data can be compared to data stored in an identity store for authentication. The authorization data can also be used for user and device registration and for transferring an authentication or registration token from a previously authenticated and registered device to a new device.

Abstract: In some variations, first and second rule sets may be received by a network protection device. The first and second rule sets may be preprocessed. The network protection device may be configured to process packets in accordance with the first rule set. Packets may be received by the network protection device. A first portion of the packets may be processed in accordance with the first rule set. The network protection device may be reconfigured to process packets in accordance with the second rule set. A second portion of the packets may be processed in accordance with the second rule set.

Abstract: A system and method for single authentication to a multi-tenancy single-page application hosted in a plurality of different datacenters. The method comprises: receiving, from a client device, a login request to access the single-page application; receiving an access token in response to an authentication of a user of the client device, wherein the access token designates at least tenant identification data; determining a datacenter of the plurality of different datacenters executing an instance of the single-page application supporting a tenant of the authenticated user; retrieving, from the determined datacenter, a single web page of the single-page application, wherein the retrieved signal web page includes at least references to resources pointing to a location of the determined datacenter; and serving the web single page to the client device.

Abstract: A method comprises a portable device obtaining a graphical encoded information item which is displayed on a display of a computing apparatus, decoding the encoded information from the encoded information item, and transmitting a first message to first server apparatus, the first message including the decoded information and a first identifier identifying the device or a user of the device, wherein the decoded information includes an apparatus identification information item for allowing identification of the computing apparatus, and the first server apparatus receiving the first message from the device, establishing the identity of the user of the device, wherein establishing the identity of the user comprises using the first identifier to determine if the user is registered with the first server apparatus in response to establishing the identity of the user, authorising the user to access a service, and providing the service to the user via the computing apparatus using the apparatus identification informati

Abstract: A system and method are provided for authenticating a user using a client side server within a computer network, the computer network operating in conformance with an open source initiative (OSI) model of structuring protocol data unit messages, the method comprising: generating a connection request at a client side server, the connection request including (i) a client side network layer protocol address information for use in a network layer (L3) protocol data unit (PDU), and (ii) a client side transport layer protocol address information for use in a transport layer (L4) PDU; transmitting the connection request from the client side server using both the network layer and the transport layer; receiving at the client side server an authentication call message on both the network and transport layers using the client side network layer protocol address information and client side transport layer protocol address information; transmitting user authentication information in response to the received authenticatio

Abstract: A security management system may be remotely deployed (e.g., using a cloud-based architecture) to add security to an enterprise network. For example, the security management system may scan assets within the enterprise network for vulnerabilities and may receive data chunks from these scans. The security management system may also receive data chunks from other sources, and, as a result, the system may handle data chunks having many different formats and attributes. When the security management system tries to associate data chunks to assets, there may not be a globally unique identifier that is applicable for all received data chunks. Provided in the present disclosure are exemplary techniques for tracking assets across a network using an asset correlation engine that can flexibly match data chunks to assets based on the attribute or attributes that are available within the data chunks.

Abstract: Computer log entries are processed to determine a plurality of baseline rank values associated with a ranking dimension. An overall baseline rank indicator is computed using the determined baseline rank values. For each log data component value combination included in a group of log data component value combinations, a comparison rank value associated with the ranking dimension is determined. Each of the comparison rank values is compared with the overall baseline rank indicator. Based at least in part on the comparisons, one or more log data component value combinations included in the group of log data component value combinations are identified as more anomalous than other log data component value combinations included in the group of log data component value combinations.

Abstract: Systems and methods for determining trust levels for components of a computing application including a development framework, a trust matrix, a trust level calculation module, a visual design subsystem, and a deployment subsystem, where trust levels are associated with components, combinations of components, graphs, and blueprints, where trust levels relate to categories of use.

Abstract: In some variations, first and second rule sets may be received by a network protection device. The first and second rule sets may be preprocessed. The network protection device may be configured to process packets in accordance with the first rule set. Packets may be received by the network protection device. A first portion of the packets may be processed in accordance with the first rule set. The network protection device may be reconfigured to process packets in accordance with the second rule set. A second portion of the packets may be processed in accordance with the second rule set.

Abstract: A scalable cloud-based endpoint security system facilitates a security policy on a plurality of endpoints. Configuration data or commands for implementing a security policy are entered via a web browser of an administrative client device and received at a cloud server. An API server generates a message to a queue of a publication/subscription server that publishes the messages from the queue to one or more subscribing communication servers. A communication server sends the message to an endpoint targeted by the message via a persistent connection that the communication server maintains with the endpoint. In response to the message, the endpoint establishes a connection to the API server. The API server then distributes the configuration data or commands to the endpoint.

Abstract: The described technology provides a capability to perform in-session updates to entitlements associated with a user's access to content served by a web application. The content may be from one or more external servers. The technology provides for automatically detecting changes to entitlements, and without requiring a user of an active session to initiate a new session, updating entitlement data in a memory such that subsequent requests for data made by the client in the same active session are serviced using the updated entitlements.

Abstract: A captive portal system includes a login database, a web server, and a name server. The name server receives a DNS request from a user device, queries the login database to determine whether the user device is logged in, and responds to the DNS request with the IP address of the web server as a resolved IP address of the specified domain name when the user device is not logged in. The web server accepts a connection request from the user device to the IP address of the web server, receives an HTTP request specifying a non-local target URL from the user device, queries the login database to determine whether the user device is logged in according to the source address of the user device, and acts as a transparent proxy between the user device and the non-local target URL when the user device is logged in.

Abstract: According to some embodiments, a system may include a communication port to exchange information with a client device associated with an industrial control system. A network security server coupled to the communication port may include a computer processor adapted to provide a network security service for the client device. The computer processor may further be adapted to record security information about the client device via a blockchain verification process (e.g., by registering a validation result within a distributed ledger). The network security service might comprise, for example, an integrity attestation service providing software verification for the client device.