Abstract: Systems and methods are disclosed for securely communicating sensitive such as an identifier. A user device may receive a first message comprising a terminal type indicator. For certain values of the terminal type indicator, the user device may be configured to transmit a request message comprising a first identifier and an encrypted identifier. For other values of the terminal type indicator, the user device may be configured to generating an obfuscated identifier based at least in part on a first portion of a second identifier and a second portion of the encrypted identifier. The user device may then transmit a request message that includes the obfuscated identifier and the encrypted identifier.

Abstract: A computer-implemented to control access to data on an off-premises storage system. The method includes defining an access policy for a plurality of files in a file system stored in an on-premises storage system. The method further includes registering the access policy with a first off-premises storage system. The method also includes creating a resource-based cloud access policy based on an on-premise access policy. The method includes determining a set of files from the plurality of files to migrate to the off-premises storage. The method also includes obtaining, for the set of files, an access policy as access metadata. The method further includes migrating the set of files and the access metadata to the off-premises storage.

Abstract: Various embodiments for sending a cryptogram to a point of sale terminal while disconnected from a network. In some embodiments, for example, a computing device that is configured to display a prompt for a selection of a transaction account. An encrypted session key is retrieved through a network in response to determining a number of session keys associated with the transaction account is below a threshold. The computing device is also configured to generate a session key based at least in part on decrypting the encrypted session key using an encryption key and establish a wireless connection with a point of sale terminal for a purchase. A cryptogram is generated from the session key based at least in part on the user device being disconnected from the network. The cryptogram is sent to the point of sale terminal.

Abstract: A cyber-threat defense system for a network including its email domain protects this network from cyber threats. Modules utilize machine learning models as well communicate with a cyber threat module. Modules analyze the wide range of metadata from the observed email communications. The cyber threat module analyzes with the machine learning models trained on a normal behavior of email activity and user activity associated with the network and in its email domain in order to determine when a deviation from the normal behavior of email activity and user activity is occurring. A mass email association detector determines a similarity between highly similar emails being i) sent from or ii) received by a collection of two or more individual users in the email domain in a substantially simultaneous time frame. Mathematical models can be used to determine similarity weighing in order to derive a similarity score between compared emails.

Abstract: Apparatuses and methods are disclosed for protection of data servers configured for data replication of a database. As an example, one apparatus includes at least one processing circuit configured to receive records indicating respective modifications performed on a first version of the database stored in a first data server of the plurality of data servers. The at least one processing circuit is configured to delay replication of the modification in one or more additional servers in the plurality of data servers for a respective length of time specified for the servers in security profile data. While delaying replication of the modification, the processing circuit determines a probability that the modification is malicious based on a first set of factors indicated in a security profile. If the probability is greater than a threshold specified in the security profile data, the processing circuit prevents the modification from being performed.

Abstract: Techniques for applying context-based security over interfaces in O-RAN environments in mobile networks are disclosed. In some embodiments, a system/process/computer program product for applying context-based security over interfaces in O-RAN environments in mobile networks includes monitoring network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session; extracting a plurality of parameters from the GTP-U tunnel session setup message and from F1AP traffic to extract contextual information at the security platform; and enforcing a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between O-RAN Distributed Unit (O-DU) and O-RAN Centralized Unit Control Plane (O-CU-CP) nodes in an O-RAN environment in the mobile network.

Abstract: Aspects of the disclosure relate to spear phishing simulation using machine learning. A computing platform may send, to an enterprise user device, a spear phishing message. The computing platform may receive initial user interaction information indicating how a user of the enterprise user device interacted with the spear phishing message. Based on the initial user interaction information and using a series of branching message templates, the computing platform may generate additional spear phishing messages. The computing platform may receive additional user interaction information indicating how the user interacted with the additional spear phishing messages. Based on the initial user interaction information and the additional user interaction information, the computing platform may compute spear phishing scores.

Abstract: Example systems and methods are disclosed for protection of data servers configured for data replication of a database. An example system includes a processing circuit configured to receive records indicating respective modifications performed on a first version of the database stored in a first data server of the plurality of data servers. The processing circuit determines a risk level of a modification indicated by a record based on a set of factors indicated in a security profile, the set of factors being indicative of anomalous data access activity. The processing circuit performs the modification in a second data server, in response to the risk level being less than a threshold level indicated in the security profile. The processing circuit prevents the modification indicated by the record from being performed in the second data server in response to the risk level being greater than or equal to the threshold level.

Abstract: A method includes receiving, at a first server from a second server, a first file attribute associated with a file. The method includes making a determination, at the first server based on the first file attribute, of availability of a classification for the file from a cache of the first server. The method includes, in response to the determination indicating that the classification is not available from the cache, sending a notification to the second server indicating that the classification for the file is not available. The method also includes receiving a first classification for the file from the second server at the first server. The first classification is generated by the second server responsive to the notification.

Abstract: A computer-implemented method for configuring a blockchain network, a computer program product for integrating device identity into a permissioning framework of a blockchain network, and a blockchain network. One embodiment may comprise registering a device at a delineate node of a blockchain network, creating, by a processor of the delineate node based on the registering, a profile for the device; an performing, by the processor of the delineate node, a pass-through service for the device. The registering may include receiving, by a network interface, an immutable device identity from the device.

Abstract: A semantic parser can process natural language of a traditional contract to generate variables and rules which can be implemented in a smart contract. The smart contract can be provided to a distributed ledger, such as a blockchain network, to execute the smart contract. Execution of the smart contract can be documented in the distributed ledger and in association with the smart contract.

Abstract: A system configured to detect a threat activity on a network. The system including a digital device configured to detect a first order indicator of compromise on a network, detect a second order indicator of compromise on the network, generate a risk score based on correlating said first order indicator of compromise on the network with the second order indicator of compromise on said network, and generate at least one incident alert based on comparing the risk score to a threshold.

Abstract: Disclosed herein are systems and methods for indexing and searching an encrypted archive. In one exemplary aspect, a method comprises generating, by a hardware processor, an encrypted data archive based on a user backup performed using a backup plan with an encryption flag enabled and a user key; generating, by the hardware processor, an index key for the encrypted data archive; encrypting, by the hardware processor, the index key using the user key; storing, by the hardware processor, the index key in a secure data storage; creating and mounting, by the hardware processor, an encrypted file system folder for the encrypted data archive using the index key; decrypting, by the hardware processor, data in the encrypted data archive using the user key; and indexing, by the hardware processor, the decrypted data.

Abstract: A method implemented in a monitoring station is described. The monitoring station is configurable to monitor a communication between a first wireless device and a second wireless device. The method includes receiving a packet from the first wireless device, the packet being addressed to the second wireless device and determining whether the received packet meets at least one criterion of one packet that is to be blocked. The method further includes transmitting a blocking signal when the received packet meets the at least one criterion of the one packet that is to be blocked. The blocking signal causes an interference with a reception, at the second wireless device, of at least one field of the received packet.

Abstract: Systems, apparatuses, and methods to establish ground truth for an intrusion detection system using machine learning models to identify an electronic control unit transmitting a message on a communication bus, such as an in-vehicle network bus, are provided. Voltage signatures for overlapping message identification (MID) numbers are collapsed and trained on a single ECU label.

Abstract: Various embodiments disclose a computer-implemented method for sending a message associated with an outage event, comprising, at a first node in a network, receiving a key from a second node in the network, wherein the second node is adjacent to the first node; storing the key in a first memory, wherein the first memory is capable of operating in a low power mode; detecting an outage event; in response to detecting the outage event, operating a first processor in the low power mode; and via the first processor operating in the low power mode: generating a message, securing the message using the key, and sending the message to the second node.

Abstract: Methods are provided for decentralized key negotiation. One method includes initiating, by a first Internet Key Exchange (IKE) node from among a plurality of IKE nodes, a rekeying process for an Internet Protocol Security (IPSec) communication session established with a client device and serviced by a second IKE node from among the plurality of IKE nodes, and in which a first encryption key is used to encrypt traffic. The method further includes obtaining, by the first IKE node from a key value store, information about the IPSec communication session and performing, by the first IKE node, at least a part of the rekeying process in which the first encryption key is replaced with a second encryption key for the IPSec communication session.

Abstract: Some embodiments provide a novel method for performing services on a host computer that executes several data compute nodes (DCNs). The method receives, at a module executing on the host, a data message associated with a DCN executing on the host. The method supplies the data message to a service virtual machine (SVM) that executes on the host and on which several service containers execute. One or more of the service containers then perform a set of one or more services on the data message. The method then receives an indication from the SVM that the set of services has been performed on the data message.

Abstract: An example method facilitates authenticating a client-side program, such as a spreadsheet, for access to and use of protected server-side data and/or functionality provided via a web service, such as a REpresentational State Transfer (REST) service or Application Programming Interface (API). The example method uses an add-in or plugin to the spreadsheet (which may run on a mobile device, desktop computer, other client system) to interrogate, negotiate with, or otherwise test or poll the web service to be accessed, so as to determine an authentication method used by the web service when authenticating clients; and to implement an authentication flow in accordance with the authentication method, thereby facilitating authentication of the spreadsheet for interaction with the web service in accordance with permissions associated with the authenticated client software, i.e., spreadsheet.

Abstract: Some embodiments are directed to a computation device configured for batch-wise multiparty verification of a computation which has been performed multiple times. The computations being multiparty computations that are cryptographically shared between the computation device and multiple other computation devices. The computation device is configured to perform the computation a further time to obtain a randomizing computation on a randomizing set of values.