Abstract: Malicious processes may be tracked by obtaining process history information of a computing device and obtaining an identification of a malicious software on the computing device. An associated process of the malicious software and actions of the associated process may be identified based on the process history information. Related processes of the associated process and actions of the related processes may be iteratively identified based on the process history information. Tracking information for the malicious software may be generated based on the associated process, the actions of the associated process, the related processes, and the actions of the related processes.

Abstract: Examples perform asynchronous encrypted live migration of virtual machines (VM) from a source host to a destination host. The encryption of the memory blocks of the VM is performed optionally before a request for live migration is received or after said request. The more resource intensive decryption of the memory blocks of the VM is performed by the destination host in a resource efficient manner, reducing the downtime apparent to users. Some examples contemplate decrypting memory blocks of the transmitted VM on-demand and opportunistically, according to a pre-determined rate, or in accordance with parameters established by a user.

Abstract: Systems and methods are provided for protecting identity in an authenticated data transmission. For example, a contactless transaction between a portable user device and an access device may be conducted without exposing the portable user device's public key in cleartext. In one embodiment, an access device may send an access device public key to a portable user device. The user device may return a blinded user device public key and encrypted user device data. The access device may determine a shared secret using the blinded user device public key and an access device private key. The access device may then decrypt the encrypted user device data using the shared secret.

Abstract: A first set of code, for example source code, and a second code, for example binary code, are compared to find corresponding functions. A comparison of features can be used to find correspondences of functions. The comparison of functions can be iterated and can be refined and can be further used to carry out a further, stricter comparison of functions found to correspond to reduce the chance of falsely finding a function in the second code to be accountable in the first code.

Abstract: A method for analyzing a document may include obtaining a runtime model for an application used to process the document, extracting, from the document, code blocks each including statements, and generating, using the runtime model, a result including a series of abstract states for each statement of a code block. Each abstract state may include a series of abstract values each corresponding to concrete values. The method may further include determining, using the result and the runtime model, whether the document includes potentially malicious code.

Abstract: A self-authenticating chip includes first and second memory regions storing, respectively, first and second authentication codes. The second memory region is adapted to be unreadable and unmodifiable by the chip or a chip reader. The chip also includes a comparator for providing an indicator of whether given input matches the second authentication code. The chip also includes an authentication circuit that is operable to read the first authentication code from the first memory region, present the first authentication code to the comparator, and in response to receiving an indicator from the comparator indicating that the first and second authentication codes match, unlock at least one of (i) a communication interface of the chip to allow data to be transmitted therethrough to a chip reader and (ii) a third memory region of the chip to allow data to be read therefrom.

Abstract: A method of configuring a network security device includes receiving a changed set of network rules to replace a current set of network rules; using a plurality of network traffic events to perform a first simulation of according to the current set of network rules and a second simulation according to the changed set of network rules; comparing the results of the first and second simulation to identify changes in network traffic allowed and denied between the current set and the changed set of network rules; displaying the changes in allowed and denied traffic for review of the changed set of network rules; receiving an instruction to implement the changed set of network rules based on the review; and filtering network traffic according to the changed set of network rules.

Abstract: A system is configured for protecting web applications at a host by analyzing web application behavior to detect malicious client requests. Example embodiments described herein include a proxy configured to handle network traffic between a host and clients. The proxy includes two request classification mechanisms, first a list of known clients, malicious and non-malicious, for identifying known malicious and known non-malicious requests and second a web application firewall for determining a classification for unknown requests (e.g., not originating from a known client). The classification itself may be distributed. The proxy determines whether a request is known non-malicious, known malicious, or unknown. The proxy collects request attributes for the known malicious and known non-malicious requests for the generation of a model based on the attributes of the known requests. The proxy passes the unknown requests to the WAF for determining a classification based on their attributes using the model.

Abstract: A fully homomorphic encrypted ciphertext query method, the method including: acquiring a first plaintext, encrypting the first plaintext using a symmetric-key algorithm or a public-key algorithm to yield a first ciphertext, and storing the first ciphertext as a queried object; receiving a second plaintext which corresponds to a query condition, encrypting the second plaintext using a symmetric-key algorithm or a public-key algorithm to yield a second ciphertext, and storing the second ciphertext as a query object; performing bitwise summation on the queried object and the query object, to acquire a ciphertext query result; and decrypting the ciphertext query result to yield a decrypted plaintext, and comparing the decrypted plaintext with the second plaintext, determining, if the decrypted plaintext is the same as the second plaintext, the ciphertext query result is correct, and the query object exists in the queried object; otherwise, determining the ciphertext query result is incorrect.

Abstract: A method of detecting coordinated attacks on computer and computer networks via the internet. The method includes using a web crawler to crawl the world wide web to identify domains and subdomains and their associated IP addresses, and to identify links between domains and subdomains, and storing the results in a database. When an IP address is identified as malicious or suspicious, the IP address is used as a lookup in the database to identify the associated domain and subdomain, and linked domains and subdomains. Those linked domains and subdomains are then identified as malicious or suspicious.

Abstract: In one example, the cryptlet binary and a cryptlet key pair are provided to an enclave. A cryptlet key pair for the first cryptlet includes a cryptlet private key and a cryptlet public key. A cryptlet binding associated with a first cryptlet includes at least one binding. Each binding includes a mapping between the first cryptlet and at least one of a smart contract or another cryptlet. A binding identification is associated with the cryptlet binding. An output is received from the first cryptlet, such that the output is at least one of encrypted or signed by the cryptlet private key, and such that the output is signed by an enclave private key. A cryptlet identity is generated for the first cryptlet, such that the cryptlet identification includes: the hash of the cryptlet binary, the cryptlet public key, and the binding identification.

Abstract: Apparatus and methods are provided for graphically defining a real-world cybersecurity protocol of an entity. The graphical platform includes searchable, manipulatable, graphs mapping cybersecurity threats. Manipulating nodes and relationships within the graphs translates into real-time modification of a cybersecurity protocol in effect for the entity. An ability to map known cybersecurity threats and analyze them (even according to known frameworks) may streamline and integrate efforts of cybersecurity defense teams. Graphical representation of a security protocol facilitates proactive threat hunting as well as expediting incident response activities by providing evidence-based pathways to inform impact analysis and source event analysis.

Abstract: A method, executable by a switch to automatically onboard end devices connected thereto, comprises detecting that an end device has connected to the switch, and determining a device identity of the connected end device. The determined device identity is used to obtain a configuration template profile associated with the connected end device. The switch is configured using the obtained configuration template profile.

Abstract: Provided is a system and method for providing a certificate by way of a Browser Extension. More specifically, provided is a Server System having at least one processor adapted to provide web pages to Browsers of user devices, the Server System further adapted to include at least one pattern and at least one identifier in at least one web page provided to a user device, the Server System further structured and arranged to receive from a Browser extension upon a user's device that has recognized the pattern and extracted the identifier a certificate request (CSR) and the extracted identifier, and upon verification of the identifier and the CSR, generating a certificate based at least in part on the CSR and returning the certificate to the Browser extension for installation upon the user device. An associated method is also provided.

Abstract: A method and system of identifying technical experts for an identified vulnerability is provided. One or more technical experts for each of one or more categories of the vulnerability are identified. Questions are sent to and answers are received from the one or more identified technical experts for each of the one or more categories of vulnerabilities, via a chatbot module. Answers to parameters that are missing for a Common Vulnerability Scoring System (CVSS) for the identified vulnerability are determined from the received answers to the parameters. The answers to the parameters are validated and a CVSS score is calculated based on the validated determined answers.

Abstract: A method for determining sandbox configurations for malware analysis is described. In one embodiment, the method may include receiving a plurality of files, extracting at least one element from at least one file from the plurality of files, identifying one or more properties associated with an endpoint, determining a correlation between the at least one extracted element and the one or more properties of the endpoint, and determining one or more sandbox configurations based at least in part on the determined correlation. In some cases, the endpoint is related to at least one of the plurality of files.

Abstract: Embodiments of the invention relate to systems and methods for providing an anonymization engine. One embodiment of the present invention relates to a method comprising receiving a message directed at a recipient computer located outside a secure area by a privacy computer located within a secure area. The privacy computer may identify private information using a plurality of privacy rules and anonymize the message according to the plurality of privacy rules. Another embodiment may be directed to a method comprising receiving a request for sensitive data from a requesting computer. An anonymization computer may determine a sensitive data record associated with the request and may anonymize the sensitive data record by performing at least two of: removing unnecessary sensitive data entries from the sensitive data record, masking the sensitive data entries to maintain format, separating the sensitive data entries into associated data groupings, and de-contexting the data.

Abstract: A cybersecurity monitoring device includes an electromagnetic (EM) field sensor for sensing a modulated signal transmitted on an electrical cable which encodes information by varying properties of a periodic waveform. The cybersecurity monitoring device includes a processor and a memory storing a data decoding program including protocol information for identifying a plurality of different communication protocols. The cybersecurity monitoring device is adapted for use without electrical contact in proximity to the cable so that the EM field sensor detects an EM field emanating from the modulated.

Abstract: A network security management system which manages an object node belonging to an intranet, including: an information collecting device, a type determining device and an event management device; the information collecting device being configured to collect domain information, computer name information and account information of each object node which is transmitted when each object node performs a login operation; the type determining device being configured to perform a comparison between the node information received by the information collection device and a node management list to determine a node type belonging to each object node; the event management device being configured to decide whether the object node has an operating privilege, or to give to the object node the operating privilege corresponding to the node type of the object node based on the compared result from the type determining device.

Abstract: Disclosed are various embodiments for providing a honeypot environment in response to incorrect security credentials being provided. An authentication request for an account to log into an application is received from a client. It is determined that the authentication request specifies an incorrect security credential for the account. The client is then provided with access to a honeypot environment in response to the authentication request. The honeypot environment is configured to mimic a successful login to the application via the account.