Abstract: Systems and methods for detecting data exfiltration using domain name system (DNS) queries include, in various embodiments, performing operations that include parsing a DNS query to determine whether that DNS query is likely to contain hidden data that is being exfiltrated from a system or network. Statistical methods can be used to analyze the DNS query to determine a likelihood whether each of a plurality of segments of the DNS query are indicative of data exfiltration methods. If one or multiple DNS queries are deemed suspicious based on the analysis, a security action on the DNS query can be performed, including sending an alert and/or blocking the DNS query from being forwarded.

Abstract: A method and apparatus provides a communication connection between a user equipment and a network entity including a plurality of radio bearers having security keys. A connection reconfiguration message is received, which identifies bearer specific changes to be made to a subset of radio bearers including less than all of the plurality of radio bearers, that impact the security keys being used by the subset of radio bearers, where the connection reconfiguration message includes a bearer identification field that identifies the radio bearers included in the subset and a chaining counter. The requested changes are applied to the subset of radio bearers associated with the bearer identification field without resetting the communication connection with the communication network.

Abstract: A system includes a first processing circuit, a second processing circuit, and a network interface device. The network interface device includes a first communications interface, a second communications interface, and a filtering engine. The first communications interface is configured to receive first data packets from the first processing circuit and communicate the first data packets for transmission to the second processing circuit via a first network pathway. The second communications interface is configured to receive second data packets from the second processing circuit and communicate the second data packets to the first processing circuit via a second network pathway physically separated from the first network pathway. The filtering engine is configured to determine whether the first data packets satisfy an inspection criteria, and transmit the first data packets to the second processing circuit responsive to determining that the first data packets satisfy the inspection criteria.

Abstract: Example firewalls disclosed herein populate a first dynamic object of a firewall rule with first information to identify a first updateable set of devices that satisfy a first one of a plurality of conditions associated with the firewall rule, the first information based on first data obtained from an appliance that monitors communication traffic in at least a portion of a network. Disclosed example firewalls also populate a second dynamic object of the firewall rule with second information to identify a second updateable set of devices that satisfy a second one of the conditions associated with the firewall rule, the second information based on second data obtained from an external data source. Disclosed example firewalls further determine, based on the first dynamic object and the second dynamic object, whether the firewall rule is to apply to first network traffic associated with a first device in communication with the network.

Abstract: A device receives information identifying a specific host threat to a network, where the information includes a list of network addresses associated with the specific host threat. The device identifies network elements, of the network, associated with the specific host threat to the network, and determines a network control system associated with the identified network elements. The device determines a policy enforcement group of network elements, of the identified network elements, that maps to the list of network addresses associated with the specific host threat, where the network control system is associated with the policy enforcement group of network elements. The device determines a threat policy action to enforce for the specific host threat, and causes, via the network control system, the threat policy action to be enforced by the policy enforcement group of network elements.

Abstract: Security functions for a memory corresponding to a smart security storage may be facilitated or executed through operation of utility application corresponding to a smart device. For example, encryption/decryption of data stored on the memory may be facilitated or executed by a security module under control of an access application corresponding to the smart device. Data securely stored on the memory may be explored and accessed by the smart device or a host computing device under control of the access application.

Abstract: A secure processor-based enclave is used to protect to one or more software defined control functions or elements in a cloud environment, such as a hyperconverged cloud that includes compute nodes. One or more secure enclave(s) are instantiated within the environment. A control plane, such as an NFV-based control plane element, is hosted within the secure enclave, which itself is instantiated within may be virtualized or containerized. The control plane has an associated data plane, whose elements are across one or more of the compute nodes. One or more APIs provide connectivity between the control plane, and the various data plane elements that are located external to the secure enclave. The NFV-based control plane provides configuration information (e.g., a routing table) to the distributed data plane through the APIs. By hosting the control plane securely using in-memory workload protection, the approach insures integrity at load time, and it protects against compromise in real-time, e.g.

Abstract: A communication device of handling data transmission comprises instructions of configuring a first bearer and a second bearer according to at least one bearer configuration received from a network; encrypting a first packet of a first flow into a first encrypted packet according to an encryption key and a first bearer identity of the first bearer; receiving a second packet of the first flow from the network via the second bearer, before transmitting the first encrypted packet to the network successfully; transmitting the first encrypted packet to the network via the first bearer, after receiving the second packet; encrypting a third packet of the first flow into a second encrypted packet according to the encryption key and a second bearer identity of the second bearer in response to the second packet; and transmitting the second encrypted packet to the network via the second bearer.

Abstract: Disclosed are an apparatus and a method for providing security and an apparatus and a method for executing security to protect a common intermediate language. An apparatus for providing security storing an execution package generated by assembling an execution engine library and an intermediate language library generated by compiling a plurality of files includes: an intermediate language extraction unit configured to extract the intermediate language library from the execution package; and an encryption unit configured to provide a secure intermediate language library by encrypting the intermediate language library extracted from the intermediate language extraction unit through a first encryption algorithm and encrypting the encrypted intermediate language library through a second encryption algorithm, thereby protecting the common intermediate language from hacking.

Abstract: An address for a protected resource of a device is randomized at configurable intervals of time as a randomized address. The randomized address is pushed to the Operation System (OS) for mapping the randomized address to an OS identifier for the protected resource. Other devices of a network produce a same randomized address for the protected resource based on a time-based synchronization.

Abstract: Techniques are described for runtime checking of function metadata prior to execution of a function in an environment. An application may include any appropriate number of components at one or more levels in a hierarchical arrangement, and each component may be packaged with metadata that describes the component. A function, or any component, may be packaged with metadata that includes term(s) governing the usage of the function. The term(s) may be checked, at runtime, during execution of the application to determine whether the function is to be executed. A function may also be hashed at runtime for verification of function version. Function(s) may be individually and independently executed as containerized nano functions within the environment.

Abstract: Systems and methods for monitoring compliance with security goals by a network or part thereof are provided. According to one embodiment, a topology of a network segment of a private network is discovered by a network security device associated with the private network. Security policies implemented by one or more network security devices that form part of the network segment are learned by the network security device. Compliance with a security goal associated with the network segment is then determined by the network security device by: (i) analyzing traffic passing through the network segment; (ii) analyzing respective system configurations of the one or more network security devices; and (iii) evaluating performance of the security policies based on the traffic.

Abstract: Systems and methods for securing web-based services of a subscriber include: identifying an access attempt by an agentless endpoint device to access web-based services of a subscriber; transmitting by the remote security service a security prompt to a third-party web browser operating on the agentless endpoint device; activating at the agentless endpoint device a non-agent security application hosted locally on the agentless endpoint device in response to the security prompt; obtaining by the non-agent security application device health data relating to one or more attributes of the agentless endpoint device; computing by the remote computer security service a health state of the agentless endpoint device based on the assessment of the device health data; and enforcing an access policy of the subscriber by denying or enabling access to the web-based services of the subscriber by the agentless endpoint device based on the computed health state.

Abstract: A universal opt-in/opt-out client allows a user to connect to the APIs for various different sites which have the user's data. The universal client orchestrates opting out on any of the site lists provided by default, or sites which the user selects. The universal client enables the user to select total or partial opt-ins or opt-outs with granular control, on one or more web or decentralized sites, where the user may wish to allow some uses of data and access to data but would also like to restrict others. When a user is calibrating their privacy and data settings, a company or site may provide reasons and incentives for the user to allow access to certain data. This allows users to have simultaneous global control over their personal data while enabling the user to receive compensation for the use of their personal data, and allowing companies to have access to better data.

Abstract: A method is disclosed. The method includes receiving, at a computing system, from a user, a request for an access code and one or more constraints on a use of the access code, and identifying a portable device to be associated with the access code. The method also includes obtaining, using the portable device, authorization for one or more potential interactions using the access code. Upon obtaining authorization for the one or more interactions, the method includes generating the access code, which includes an identifier that causes an access request that includes the access code be routed to the computing system. The method also includes receiving, from an access device, an access request comprising the access code in an interaction. Upon determining that the interaction complies with the one or more transaction constraints, the computing system provides an indication to the access device that the interaction is authorized.

Abstract: Systems and methods are described for analysing, sharing and comparing security configurations. According to one embodiment, a security metric for a network segment of a private network is generated based on determination and analysis of network assets, network topology, and one or more defined security criteria representing security features being implemented by one or more network security devices that form part of the network segment, wherein the scoring metric is a quantitative representation of protection level and/or exposure level of the network segment. In an embodiment, the security metric can be shared and compared with security metrics of other network segments.

Abstract: Systems and methods for determining an extent of a vulnerability on a computer and remediating the vulnerability. An installed resource set comprising shared software resources installed on the computer is enumerated. A vulnerable resource is identified in the installed resource set. A vulnerable process set including at least one vulnerable process that uses the vulnerable resource is enumerated. And, the vulnerable process is remediated.

Abstract: A computer-implemented method for detecting replay attack comprises: obtaining at least one candidate transaction for adding to a blockchain; verifying if an identification of the candidate transaction exists in an identification database, the identification database comprising a plurality of identifications within a validation range; and in response to determining that the identification does not exist in the identification database, determining that the candidate transaction is not associated with a replay attack.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for session authentication using quantum line switching. An example system includes encoding circuitry configured to generate, based on a first set of quantum bases, a set of qbits, and transmit the first subset of qbits over a first quantum line. The encoding circuitry is configured not to transmit the first set of quantum bases. The system further includes switching circuitry configured to receive the first subset of qbits over the first quantum line, and transmit it over a second quantum line. The system further includes first decoding circuitry configured to receive the first subset of qbits, and decode, based on a second set of quantum bases, the first subset of qbits to generate a first decoded set of bits. The system further includes first session authentication circuitry configured to generate a session key based on the first decoded set of bits.

Abstract: In general, certain embodiments of the present disclosure provide methods and systems for automatic generation of filter rules based on functional network flows for e-Enabled aviation systems. According to various embodiments, a method is provided comprising capturing network packets corresponding to a functional network flow transmitted within a networked aviation system, and parsing the network packets in order to extract one or more network messages corresponding to the functional network flow. The network message is examined in order to identify and classify a plurality of attributes corresponding to the header and data fields of the network packets. A table corresponding to the network messages is automatically generated, which includes one or more filter rules. In some embodiments, the table may be used to determine which communications are authorized during a particular context of the networked aviation system. The method further comprises validating the one or more filter rules.