Abstract: Methods and systems for detecting Denial-of-Service (DoS) attacks on a network. The method includes clustering connection requests received at the network during a first collection time having a first time span based on communication datasets extracted therefrom. For at least one connection cluster, a first DoS attack detection algorithm is executed to determine a first probability that the connection cluster is associated with a DoS attack. The first confidence score is compared with a first threshold to determine whether a mitigation order is to be generated. The connection cluster is adjusted by extracting second communication datasets from connection requests received at the network during a second collection time having a second time span longer than the first time span, and a second DoS attack detection algorithm is executed to determine a second probability that the connection cluster is associated with a DoS attack.

Abstract: Described embodiments provide systems and methods for intelligent load balancing of hosted sessions. A processor can determine a plurality of metrics for each of a plurality of machines configured to connect client devices with hosted sessions. The processor can receive, from a client device, a request to establish a connection with one of the plurality of machines to access a hosted session. The processor can determine a score for each of the plurality of machines based at least on the plurality of metrics for each of the plurality of machines. The processor can select a machine from the plurality of machines as a function of the score and a resource cost of the machine. The processor can cause the client device to connect to the selected machine for the hosted session.

Abstract: Methods, systems, and computer storage media for providing a multi-attribute cluster-identifier that supports identifying malicious activity in computing environments. An instance of an activity having an attribute set can be assessed. The attribute set of the instance of the activity is analyzed to determine whether the instance of the activity is a malicious activity. The attribute set of the instance of the activity is compared to a plurality of multi-attribute cluster-identifiers of previous instances of the activity, such that, a determination that the instance of the activity is a malicious activity is made when the attribute set of the instance of the activity corresponds to an identified multi-attribute cluster-identifier. The identified multi-attribute cluster-identifier has a risk score and an attribute set that indicate a likelihood that the instance of the activity is a malicious activity. A visualization that identifies the instance of the activity as a malicious activity is generated.

Abstract: One example method includes evaluating a set of itemsets, based on the evaluating, computing association rules corresponding to the itemsets, filtering the association rules to identify relevant association rules, sorting the relevant association rules according to their respective metrics of support, confidence, lift, and conviction, and the relevant association rules are sorted from best metrics to worst metrics, storing (1) best itemsets of the set of itemsets, and (2) the association rules with the best metrics, as thresholds, mapping the thresholds to the stored association rules and to feature-value ranges, and identifying the stored association rules and the feature-value ranges as root causes of an anomaly, and explanations of the anomaly, respectively.

Abstract: Aspects described herein may allow keystroke logs to be monitored. A computing device may receive a plurality of keystroke logs and provide, to a machine learning model, the plurality of keystroke logs. The computing device may receive, as output from the machine learning model, a value representing a likelihood that a first keystroke log comprises a first command to change a computing system. The computing device may retrieve, from a database, one or more change orders, each indicating an authorization to change the computing system. The computing device may send, to a second computing device and based on determining that the first command does not match the one or more change orders, an alert indicating the first keystroke log. In this way, unauthorized change to the computing system may be detected.

Abstract: This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.

Abstract: Various embodiments described herein support or provide for alert monitoring of data (e.g., metric data) based on one or more recommended attribute values (e.g. dimension values), which can facilitate generation of alerts for the data based on detected anomalies. In particular, an embodiment can determine one or more recommended attribute values associated with data being analyzed for anomalies (e.g., metric data), select (or facilitate selection of) one or more of the recommended attribute values, configure alert monitoring for the data based on one or more selected attribute values, and enable the alert monitoring. Once enabled, the alert monitoring can trigger an alert in response to detecting one or more anomalies in the metric data associated with the one or more selected attribute values.

Abstract: An apparatus comprises a memory and a processor communicatively coupled to one another. The processor is configured to, in response to receiving an architecture roadmap comprising one or more operational tasks, execute the machine learning algorithm to evaluate the operational tasks associated with the architecture roadmap, determine one or more reviewing guidelines based on the operational tasks, determine a reviewing entity profile of the one or more reviewing entity profiles comprising a reviewing parameter that at least partially match a reviewing guideline of the reviewing guidelines, determine a reviewing entity associated with the reviewing entity profile, and assign the operational tasks to the reviewing entity. The processor is configured generate one or more access commands configured to facilitate access to a one or more resources and transmit the access commands to the reviewing entity. The resources allow the operational tasks to be evaluated by the reviewing entity.

Abstract: An electronic device according to various embodiments comprises: a display; an image sensor disposed under the display configured to receive second information based on first information corresponding to light reflected from a subject being converted by passing through the display; a memory; and a processor operatively coupled to the display, the image sensor, and the memory, wherein the display may include: a light emitting unit including a plurality of light emitting diodes for generating light, a TFT layer on which a plurality of thin film transistors (TFTs) are mounted, and a conductive line electrically connected to the plurality of thin film transistors; the first information may be converted into second information by passing through the light emitting unit, the TFT layer, and the conductive line; and the processor may store the second information in the memory.

Abstract: This disclosure provides systems, methods and apparatuses for intelligent cloud-edge resource management. An end device may provide edge nodes of an edge computing system with network link information, which may enable the edge nodes to schedule and distribute task workloads more effectively, providing greater performance, power, security, and mission-critical network availability. For example, if the end device transmits a processing task request to a first edge node, the first edge node may assign the processing task to a second edge node according to the network link information. Additionally, or alternatively, the end device may transmit an indication of processing task parameters to one or more edge nodes and may receive an indication of an estimated completion time of the processing task from the one or more edge nodes. Accordingly, the end device may assign the processing task to an edge node with the lowest completion time.

Abstract: In an example, first-tier Internet Protocol (IP) address reputation scores, including a first first-tier IP address reputation score associated with a first first-tier IP address group and a second first-tier IP address reputation score associated with a second first-tier IP address group, may be determined based upon a plurality of events. A second-tier IP address reputation score associated with a second-tier IP address group may be determined based upon the plurality of first-tier IP address reputation scores. The second-tier IP address group may include the first first-tier IP address group and the second first-tier IP address group. An IP address reputation profile may be generated based upon the first-tier IP address reputation scores and the second-tier IP address reputation score. Whether or not a request for content associated with a first IP address is fraudulent may be determined based upon the IP address reputation profile and the first IP address.

Abstract: Disclosed herein is a cyberthreat detection system for detecting, in real-time, cyberthreats residing within a memory of a targeted computing device. The cyberthreat detection system features an undocumented structure extractor logic and an undocumented offset extractor logic. The undocumented structure extractor logic is configured to identify known, undocumented, memory structures associated with software operating on the targeted computing device. The undocumented offset extractor logic is configured to identify undocumented and unknown memory structures associated with software installed on the targeted computing device.

Abstract: Aspects of the disclosure relate to identifying potentially malicious messages and generating instream alerts based on real-time message monitoring. A computing platform may monitor a plurality of messages received by a messaging server associated with an operator. Subsequently, the computing platform may detect that a message of the plurality of messages is potentially malicious. In response to detecting that the message of the plurality of messages is potentially malicious, the computing platform may execute one or more protection actions. In executing the one or more protection actions, the computing platform may generate an alert message comprising information indicating that the message of the plurality of messages is potentially malicious. Then, the computing platform may send the alert message to the messaging server, which may cause the messaging server to deliver the alert message to a computing device associated with an intended recipient of the message.

Abstract: A device control method is provided. In the method, a first message is received from a first device of a device messaging group. The first device is associated with a first identifier in the device messaging group. The first message indicates at least one of a state of the first device or detected environment information. A second message is generated based on the first message received from the first device. The second message is sent to a second device of the device messaging group. The second device is associated with a second identifier in the device messaging group.

Abstract: A device, during a first interaction in real time, accesses from optical cells a measurement of optical emissions generated by hardware components inside the device responsive to a data card interacting with the device, generates a first optical emission pattern based on the measurement, determines whether the first optical emission pattern matches a baseline optical emission pattern, upon determining a match, determines whether the data card is associated with prohibited interactions, upon determining the first data card is not associated with prohibited transactions, determines whether the device is connected to a malicious IP address, upon determining the device is not connected to a malicious IP address, approves the first interaction. The device declines the first interaction if the first optical emission pattern does not match the baseline optical emission pattern, the first data card is associated with prohibited interactions, or the device is connected to a malicious IP address.

Abstract: Taking a zero-configuration approach, a domain name discovery system utilizes, in an iterative process, WHOIS data and infrastructure data for a seed domain to automatically discover domain names having registration and/or infrastructure details that match those of the seed domain. Registration information such as a registered email address associated with a domain name discovered through WHOIS data matching or infrastructure data matching is utilized in a reverse lookup for domain names having infrastructure or WHOIS registered information that fully matches the information associated with the domain name discovered through the iterative process. Domain names discovered through WHOIS data matching, infrastructure data matching, and reverse lookup can be presented through a user interface on a client device communicatively connected to the domain name discovery system over a network. The domain name discovery can be performed periodically or in near real time responsive to receiving a new seed domain.

Abstract: A method is provided for protecting a machine learning (ML) model from a side channel attack (SCA). A permutation is performed of weights and biases for a first layer of the ML model. The permutated weights and biases of the first layer are scaled using a scaling factor greater than zero to generate scaled and permutated weights and biases for a first plurality of nodes of the first layer. The weights for a second layer immediately following the first layer are modified to compensate for the permutation and scaling of the weights and biases of the first layer. The modified weights and biases of the first and second layers are substituted for corresponding original weights and biases of the ML model. An inference engine of the ML model is executed using the modified weights and biases of the first and second layers for an inference operation.

Abstract: Apparatus and methods are disclosed for geographic region-based network address translation (NAT) between a public network and a private network. In certain examples, region-based NAT may assist to reduce latency, enhance quality, enhance security, and/or improve efficiency of network communications. In response to a data packet from a first port of a private IP address, of an endpoint in the private network, a region of the private network that includes an endpoint identified by the private IP address is determined. A public IP address is selected that is mapped to the determined region in the database. An available port of the selected public IP address is assigned for NAT. NAT is performed for data communicated between the public and private networks using a mapping of the first port of the first IP address to the second port of the second IP address.

Abstract: Arrangements for providing API stability functions are provided. In some aspects, call logs may be received and analyzed to identify a provider associated with each API call. Based on the provider, the call logs may be split into one or more provider-specific sub-logs. The provider-specific sub-logs may be analyzed to identify failed API calls and the sub-logs having failed API calls may be encrypted using a provider-specific encryption key. The encrypted data may be written to a blockchain where the provider may decrypt the data using the provider-specific key and identify and execute one or more corrective actions. Once a cause of the API call failure has been addressed, an indication of the correction may be received and displayed.

Abstract: An information processing apparatus, which transmits a message to an information-sharing service managing messages on a thread format including a plurality of messages, obtains, in a case where a reply mode is set on the information processing apparatus by a user before a first message is transmitted to the information-sharing service with a scanned document, information on a plurality of threads from the information-sharing service, and extracts first threads relevant to the user from the obtained information on the plurality of threads. The extracted first threads are displayed, and the user specifies a thread from the displayed first threads as a first destination to which the first message is to be transmitted.