Abstract: A method for detecting a ransomware-encrypted file includes: acquiring a designated file; extracting bytes from a file header, a file middle portion and a file trailer of the designated file respectively; extracting features from the extracted bytes, where the extracted features include at least a variance of a distribution of a first preset type of characters; inputting the extracted features into more than one first machine learning model to obtain a probability distribution, outputted by each of the more than one first machine learning model, indicating a likelihood that the designated file is ransomware-encrypted; and determining, based on the probability distribution, whether the designated file is ransomware-encrypted. The present disclosure improves efficiency and accuracy of ransomware detection by extracting bytes and features from different portions of the designated file and utilizing a plurality of machine learning models for ransomware detection.

Abstract: A method includes receiving, at an AS layer of a user equipment (UE), a plurality of NAS payloads, wherein a first NAS payload is received from a first NAS sublayer and a subsequent payload is received from a subsequent NAS sublayer, encrypting, by the UE, the first payload with a first encryption generating a first encrypted payload and the subsequent payload with a subsequent encryption generating a subsequent encrypted payload, wherein the first encryption is associated with a first network function and the subsequent encryption is associated with a subsequent network function, generating, by the UE, a first message that includes a first temporary identifier including of routing information for the first network function and a first container, and a subsequent container, wherein the first container includes the first encrypted payload and the subsequent container includes the subsequent encrypted payload, and transmitting the first message to a first apparatus.

Abstract: A method is provided that is performed in a wireless network to detect a rogue wireless device. The method comprises detecting a suspect wireless device in the wireless network based on messages transmitted by the suspect wireless device using a first Media Access Control (MAC) address that is also used by a valid wireless device in the wireless network. When a suspect wireless device is detected, the method next includes sending to the valid wireless device in the wireless network a request configured to cause the valid wireless device to change its MAC address. After the valid wireless device has changed its MAC address, the method involves observing messages transmitted by the suspect wireless device in the wireless network. The method then includes determining that the suspect wireless device is a rogue device when the suspect wireless device continues to transmit messages using the first MAC address.

Abstract: The present invention relates to a Quantum Key Distribution Network comprising a Quantum Key Distribution layer comprising a plurality of pairs of emitters and receivers and a plurality of Core Nodes and Edge Nodes and a Key Management Layer adapted to exclusively receive XORed-keys from the Core Nodes, mix said XORed-keys from the Core Nodes, and send said mixed XORed-keys to the Edge Nodes of the QKD layer, in order to generate a shared key between said Edge Nodes.

Abstract: A UE discovery message protection method, includes: when a first UE is located outside network coverage, monitoring a first announcement message, where the first announcement message includes: a discovery message, which is encrypted on the basis of a discovery key, and an LTK ID, which indicates a LTK; and determining the discovery key on the basis of the LTK corresponding to the LTK ID, where the LTK is received when the first UE is within the network coverage.

Abstract: A Lawful Interception Administration Function device (102) comprising a memory and a processor, the memory containing instructions which when executed on the processor, cause the LI ADMF device (102) to send to a Network Repository Function (110) a discovery request message for discovering at least one NEF device (103) and at least one Application Function, AF, device (107) served by the NEF device; receive a discovery response message comprising information about the NEF device and the AF device; receive from a LEA (101) a first request message for subscribing to a notification of the event provided by the AF device, the application identified by an identifier; send a second request message, to a NEF device comprising an IRI-POI (104) to subscribe to the notification of the event, the NEF device identified based on the information comprised in the discovery response message; and receive a subscribe response message confirming the subscription to the notification of the event.

Abstract: There is provided a method to detect phishing websites so as to protect users from sending their sensitive information to criminal servers. When browsing a web site having an input form asking sensitive information, the input fields are recorded (i.e. username field and password field). Then false credentials are generated and submitted in background. The new control layer then checks the response page content whether it includes an input form and if there is an input, it checks whether the form has the same fields as the first form. If the responded page does not have a form, or it has a form but includes different fields than the initial page's form, then the original site is identified as phishing.

Abstract: A server issues challenge data and transmits the challenge data to a client. The client stores encrypted group data including a plurality of encrypted data encrypted with a server key, and parameter data A, in a memory, receives the challenge data, generates response data using a response key on the client side, and transmits the response data, the encrypted group data, and the parameter data A to the server. The server selects encrypted data to be used from the received encrypted group data, based on the received parameter data A, sets a response key on the server side, based on the selected encrypted data and data decrypted with the server key, verifies the received response data, based on the challenge data and the response key on the server side, and notifies a result of the verification to the client. The client receives the notification.

Abstract: Two-factor authentication code generation devices are described which include accessibility features and/or additional authentication features to ensure an identity of a user.

Abstract: The disclosed technology is generally directed to nefarious code detection using semantic understanding. In one example of the technology, a natural-language output is generated by performing a natural-language translation of code. A machine-learning model is used to generate a confidence score that indicates a confidence that the natural-language output is potentially malicious. Based at least in part on whether the confidence score exceeds a first threshold, whether the natural-language output is potentially malicious is determined. Responsive to determining that the natural-language output potentially malicious, the code is flagged as potentially malicious.

Abstract: Systems, devices, and methods related to wireless battery management system (wBMS) are provided. For example, a wBMS network manager comprises a memory to store a list of hardware identifiers (IDs), wherein each hardware ID in the list is associated with a respective one of a plurality of battery modules; and mapped, based on a predetermined mapping, to a different one of a plurality of source IDs; an interface to receive, from a remote battery module, a packet including a source ID and a hardware ID associated with the remote battery module; and one or more processing units to search, using the source ID in the received packet and the predetermined mapping, for a first hardware ID from the list of hardware IDs; and authenticating the remote battery module based on a comparison of the hardware ID in the received packet to the first hardware ID from the list.

Abstract: A SOC includes a core, peripherals, and a bus for interconnecting the core and peripherals. Some peripherals can be selectively enabled or disabled on-demand. The SoC further includes peripheral enabling/disabling electronics and peripheral enabling/disabling circuitry coupled to the peripherals. The peripheral enabling/disabling electronics are directly connected to the peripheral enabling/disabling circuitry and are configured to store information items related to an enabled/disabled peripheral configuration, indicate the peripherals that are enabled and the peripherals that are disabled according to the enabled/disabled peripheral configuration, and provide the peripheral enabling/disabling circuitry with signals based on the stored information items. The peripheral enabling/disabling circuitry allows operation of the enabled peripherals and prevents operation of the disabled peripherals based on the signals received from the peripheral enabling/disabling electronics.

Abstract: Embodiments of the technology described herein identify and mitigate phishing attempts by analyzing user input using a client-side proxy component and a proxy server. Embodiments disclosed herein provide systems, methods, and computer-storage media for employing proxy server capabilities in conjunction with a snapshot capturing an image or video recording of a target action input by a user into a software application. Certain embodiments disclosed herein employ proxy server capabilities to capture a snapshot and/or screen recording based on a user authorization or approval. For example, the proxy server proactively captures the snapshot or screen recording prior to, during, and after the user performing a target action. From the snapshot, certain embodiments extract snapshot features or determine enriched-contextual event data that is used to perform a mitigation action, generate a security mitigation score, or update an administrator portal activity log for an authorized administrator.

Abstract: Examples provide a server system for dynamic provision of elements features of a software application. The server includes an electronic processor configured to receive, from a client computer, session identifier and access information of a client software session running on the client computer and determine a set of session identity factors at least including licenses, user privileges, compatibilities, and application feature availabilities associated with the client software session. The electronic processor determines, from a set of application features, a first subset of application features to which the client software session is entitled based on an intersection of availability, compatibility, user privilege, and licensing of each respective application feature. The electronic processor delivers the first subset of application features to the client software session, causing each of the first subset of application features to load and render on a user interface of the client computer.

Abstract: A parallel multiplier for the Saber algorithm comprises a coefficient memory, two parallel pre-adding circuits, three parallel multiplication circuits and a post-adding circuit. The coefficient memory, the two parallel pre-adding circuits, the three parallel multiplication circuits and the post-adding circuit adopt a divide-and-conquer strategy, the two parallel pre-adding circuits perform parallel computation, and the three parallel multiplication circuits perform parallel computation, such that the computation time of modulo multiplication is shorted; the modulo operation of non-prime numbers is realized by limiting the bit width, such that the constraint that the modulus is a prime number is avoided; and the Karatsuba algorithm is called once, such that extra circuit area expenditure is reduced.

Abstract: The disclosure relates to improvements in the delivery of cryptographic data to secure memory devices. In some aspects, the techniques described herein relate to a method including: receiving, by a memory device, a command, the command including a public key and a hash of a unique device secret (UDS); generating, by the memory device, a local UDS using the public key and a locally stored private key; generating, by the memory device, a local UDS hash by inputting the local UDS into a hashing algorithm; determining, by the memory device, whether the local UDS hash matches the hash included in the command; writing, by the memory device, the public key to a key storage area if the local UDS hash matches the hash included in the command; and returning, by the memory device, a failure response if the local UDS hash does not match the hash included in the command.

Abstract: An illustrative method includes identifying, based on static workload data associated with a compute environment, one or more attack paths from a network to one or more datasets associated with an entity, accessing runtime workload data associated with the compute environment, and performing, based on the runtime workload data, a risk mitigation operation associated with the one or more attack paths.

Abstract: Embodiments of various systems and methods described herein provide an identity security database analytics system which is configured to provide security alerts to a user. The security alerts can include for personalized metrics related to potential identity theft incidents. The personalized metrics can include user specific information on security breaches of the user's personal information as well as depersonalized statistics generated based on information of other users having one or more similar characteristics of the user.

Abstract: An illustrative method includes accessing data representative of a first role associated with a set of permissions with respect to resources within the compute environment and specifying a group of identities assigned to the first role, determining that a first subgroup of one or more identities included the group of identities only uses a first subset of permissions included in the set of permissions to access the resources within the compute environment without using a second subset of permissions, and performing, based on the determining that the first subgroup of one or more identities only uses the first subset of permissions, an operation to reduce permissions usable by the first subgroup of one or more identities.

Abstract: A method and device for applying a different security policy, per service traffic, to a protocol data unit (PDU) session in a wireless communication system. The method comprises receiving, by a session management function (SMF) managing a session for a user equipment (UE), first configuration information about a first user plane security policy of the UE from a unified data management (UDM) managing subscription information about the UE, receiving, by the SMF, second configuration information about a second user plane security policy to be applied to a specific service data flow from a policy and control function (PCF) managing a policy and charging control (PCC) rule, and determining a user plane security policy to be applied to the UE based on one selected from the first user plane security policy and the second user plane security policy according to priority.