Abstract: A method of cyber protection of a machine based on acquiring acoustic signals from a vicinity of the machine, while the machine is operative. The method includes analyzing the acquired acoustic signals to determine whether the machine or a controller of the machine is operating suspiciously and initiating a cyber measure on the controller of the machine, responsive to a determination based on the acquired acoustic signals that the machine or the controller is operating suspiciously.

Abstract: An authentication packet including a user identifier is received. The user identifier identifies a user of a second computing device being monitored by the first computing device. Authentication data is parsed from the authentication packet. A peer group identifier is determined that identifies a peer group to which the user is assigned. Members of the peer group are identified based on an expected network activity behavior. The authentication data and the peer group identifier are buffered into a first event block object and into a second event block object. The first event block object is sent to a first source window of an event stream processing engine (ESPE) that processes a netflow packet. The second event block object is sent to a second source window of the ESPE that processes the authentication packet. The first source window and the second source window are different source windows of the ESPE.

Abstract: Systems and methods for dynamic filtering of content posted to a social network are disclosed. In aspects, a method of the system includes generating, by a computing device, a user profile list for a user of a social network, the user profile list including data regarding the user's preferences with respect to undesirable content; monitoring, by the computing device, a content post on the social network to determine if the content post includes the undesirable content, the content post being displayed to the user through a social network interface; determining, by the computing device, that the content post includes the undesirable content; and effecting a change in the display of the content post in accordance with one or more predetermined display rules based on the determining that the content post includes the undesirable content.

Abstract: First information about regions of storage space in a storage environment available for a volume is provided to a service provider, with the storage environment being external to the service provider. The service provider is notified that information usable to locate a storage destination of a portion of the volume is unavailable. Second information that includes the storage destination in the storage environment is obtained from the service provider. A data operation is performed at the storage destination, with the storage destination determined based at least in part from the second information.

Abstract: Systems and methods for detecting security threats using application execution and connection lineage tracing with embodiments of the invention are disclosed. In one embodiment, detecting suspicious activity in a network includes receiving at a collector server a first activity data including a first set of attributes, combining a first set of context information with the first activity data to generate a first activity record, comparing the first activity record to a set of baseline signatures, incrementing a count of a first matching baseline signature when the first activity record has the same values for all attributes, receiving a second activity data including a third set of attributes, combining a second set of context information with the second activity data to generate a second activity record, and generating an alert when the attributes of the second activity record differ from all baseline signatures.

Abstract: Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines, each host computer in these embodiments executes a context engine and one or more attribute-based service engines. Through the GI agents of a host's machines, the context engine of that host in some embodiments collects contextual attributes associated with network and/or process events on the machines, and provides the contextual attributes to the service engines to use to identify service rules for processing.

Abstract: Described herein is a system transmits and combines local models, that individually include a set of local parameters computed via stochastic gradient descent (SGD), into a global model that includes a set of global model parameters. The local models are computed in parallel at different geographic locations (e.g., different instances of computing infrastructure) along with symbolic representations. Network transmission of the local models and the symbolic representations, rather than transmission of the large training data subsets processed to compute the local models and symbolic representations, conserves resources and decreases latency. The global model can then be used as a model to determine a likelihood that at least a portion of current and/or recently received data traffic is illegitimate data traffic that is associated with a cyber attack. In some instances, the system can implement a remedial action to mitigate the effects of the cyber attack on computing infrastructure.

Abstract: In general, techniques are described for provided result reporting via authentication, authorization and accounting (AAA) protocols. An authorization server comprising a control unit may be configured to perform the techniques. The control unit may authorize a network access server to allow an endpoint device to access one or more services in accordance with a network access protocol. The control unit may also request, in accordance with the network access protocol, a result from the network access server as to whether the one or more authorized services are presently provided for use by the endpoint device.

Abstract: Systems and methods for phishing and brand protection of websites via copycat detection are disclosed herein. An example apparatus includes at least one processor, a display, and memory including instructions that, when executed, cause the at least one processor to determine a first hash of a first image in a webpage and a second hash of a second image in the webpage, the second image different from the first image, the first hash different from the second hash, generate a temporary page profile associated with the webpage based on the first hash and the second hash, fuzzy match the temporary page profile to a baseline page profile, and in response to a determination that the temporary page profile does not match the baseline page profile, generate an alert to be displayed via the display to indicate that fraud has been detected for the webpage.

Abstract: Localized and global detection and mitigation of network attacks in a distributed platform are provided. The localized detection identifies attacks occurring at individual nodes of the distributed platform based on packet analysis conducted by each individual node. The global detection identifies attacks occurring across the distributed platform based on packet analysis conducted on traffic aggregated from across the distributed platform. Either detection involves inspecting headers of the sampled packets. Each header property is scored based on an amount of deviation from threshold values. The sum of scores identifies the header properties that form an attack signature. Attack protections are implemented against subsequently arriving packets with header properties matching the attack signature.

Abstract: A method includes receiving, by a server, a request to revoke the access rights of a user device to a lock; transmitting, by the server, a revocation command to the user device to remove an access credential from the user device; identifying, by the server, one or more trusted devices that have access rights to the lock in response to unsuccessfully transmitting the revocation command to the user device; transmitting, by the server, a key change command to the one or more trusted devices including an updated key to replace a key on the lock; transmitting, by a first one of the one or more trusted devices to encounter the lock, the key change command to the lock; and replacing, by the lock, the key with the updated key such that the user device is unable to access the lock using the access credential.

Abstract: A method for biometry based signing of documents. In an embodiment, the method includes receiving, on a terminal, a signature request associated to a document from a requester, and displaying the document to the user on the user terminal. The process also includes requesting at least once a biometric identification of the user to create at least one signing receipt, associating the signing receipt to the document, and transmitting the document and/or the signing receipt from the user terminal to the requester.

Abstract: The present invention discloses a software security verification method, a device, and a system, and relates to the communications field, so as to resolve a problem in the prior art that security verification on a VNF packet increases a VNF instantiation delay and reduces VNF instantiation performance. In a specific solution, after a first device receives an instantiation request of a VNF, the first device performs security verification on a stored VNF packet of the VNF when or after starting to instantiate the VNF according to the instantiation request of the VNF, and the first device sends first result information to a second device when security verification on the VNF packet of the VNF succeeds. The first result information includes information that security verification on the VNF packet of the VNF succeeds. The present invention is applied to software security verification.

Abstract: A security service of a computing resource service provider provides security scores for application program interfaces (APIs) and other security information to an API marketplace or other endpoints. The security score may be based at least in part on component information associated with computing resources implementing the API. The security service may obtain access to the computing resources and collect various components from the computing resources. The components may then be used to determine a security score of an API offered from consumption on the API marketplace. The security service may then publish the security score to the API marketplace or other endpoint.

Abstract: A method and system for modeling cyber-security events are provided. The method includes receiving a plurality of cyber-security events, wherein each of the plurality of the cyber-security events defines at least one entity; for each of the plurality of received cyber-security events, processing a received cyber-security event to identify at least one key-value; mapping the at least one identified key-value to at least one data field; modeling the received cyber-security event to a security model, wherein the security model defines a specific activity related to the at least one entity, wherein the modeling is based on at least one modeling rule and the at least one identified key-value; and generating a graph based on the security model.

Abstract: A system for enforcing a security policy on an application stored at a mobile device has an application at the device provided with software code for issuing a request for authenticating a user, and a security enforcement unit; an authentication agent at the device, which is separate from the application, and which is configured with an authentication data collecting unit for collecting authentication data upon receipt of the request for user authentication from the application, and for conveying the collected authentication data to an authentication-authorization server; and an authentication-authorization server for receiving the collected authentication data, evaluating the same, and issuing an enforcement level signal which is conveyed to the security enforcement unit. Upon receipt of the enforcement level signal, the security enforcement unit accordingly applies a security level at the application.

Abstract: Making a determination of originality of content is disclosed. At least one originality factor related to the content is analyzed, wherein the originality factor is independent of a time when the content is detected. Based on the analysis of the at least one originality factor, automatically the determination is automatically made. The determination is outputted.

Abstract: Systems, methods, and computer-readable media are provided for generating a unique ID for a sensor in a network. Once the sensor is installed on a component of the network, the sensor can send attributes of the sensor to a control server of the network. The attributes of the sensor can include at least one unique identifier of the sensor or the host component of the sensor. The control server can determine a hash value using a one-way hash function and a secret key, send the hash value to the sensor, and designate the hash value as a sensor ID of the sensor. In response to receiving the sensor ID, the sensor can incorporate the sensor ID in subsequent communication messages. Other components of the network can verify the validity of the sensor using a hash of the at least one unique identifier of the sensor and the secret key.

Abstract: Methods and apparatus for encrypting and decrypting data for wearable devices that are not based on authentication techniques, such as login/password or handshaking, are provided. A computing device receives a message. The message includes encrypted data and a cryptographic reference. The encrypted data includes physiological data of a wearer of the wearable device. The cryptographic reference includes a reference to a first cryptographic technique. The computing device determines the first cryptographic technique based on the reference to the first cryptographic technique. The computing device determines a cryptographic key. The computing device decrypts the encrypted data using the first cryptographic technique and the cryptographic key to obtain decrypted data. The computing device stores the decrypted data.

Abstract: The disclosure relates to posting auditable, immutable data to a blockchain. The method includes receiving a blockchain comprised of a plurality of blocks, each block having at least a block header and one or more transaction values, where each transaction value includes at least a transaction hash, and receiving a data file associated with a specific transaction hash included in a block in the blockchain, where the data file includes one or more variables. The method includes modifying at least one of the one or more variables included in the data file, generating a new hash value via application of one or more hashing algorithms to the modified data file, and generating a new transaction value based on at least the generated new hash value and the specific transaction hash. The method includes digitally signing the generated new transaction value, and electronically transmitting the signed new transaction value.