Abstract: Techniques for determining, by a network security device, a security policy for a data packet with an unknown fingerprint using protocol-aware edit distance, are described. The network security device intercepts a data packet from a source and determines a fingerprint of the source from the data packet. The network security device compares the fingerprint to a plurality of fingerprints in a fingerprint database and determines whether the fingerprint corresponds to an individual fingerprint of the plurality of fingerprints. Based at least in part on determining that the fingerprint does not correspond to an individual fingerprint of the plurality of fingerprints, the network security device determine a protocol-aware edit distance is within a predetermined threshold protocol-aware edit distance of an individual fingerprint of the plurality of fingerprints and applies a security policy associated with the individual fingerprint to the data packet.

Abstract: Devices and methods relate to managing encrypted communication protocols for network security. A network device may include a security logic. The security logic may receive a domain name system (DNS) response including a first Encrypted Client Hello (ECH) configuration key. Based on receiving the DNS response including the first ECH configuration key, the security logic may replace the first ECH configuration key in the DNS response with a second ECH configuration key. A decryption corresponding to the second ECH configuration key may be supported at the network device. The security logic may transmit the DNS response with the second ECH configuration key. By providing the second ECH configuration key that is known to the security logic to a client device, the security logic gains visibility into one or more encrypted portions of an ECH message from the client device that follows the DNS response.

Abstract: Techniques for detecting malware process injection on a host device. The techniques may include receiving endpoint metadata associated with an event, the endpoint metadata including information associated with a process that made a network connection from a host device. The techniques may also include receiving network metadata associated with the event, the network metadata including a network protocol fingerprint used to make the network connection. The techniques may further include determining that the network protocol fingerprint is indicative of a presence of malware process injection via the process running on the host device. Based on detecting the process of the malware process injection, an indication may be reported to a monitoring system and one or more remedial actions may be taken.

Abstract: Techniques for detecting malware process injection on a host device. The techniques may include receiving endpoint metadata associated with an event, the endpoint metadata including information associated with a process that made a network connection from a host device. The techniques may also include receiving network metadata associated with the event, the network metadata including a network protocol fingerprint used to make the network connection. The techniques may further include determining that the network protocol fingerprint is indicative of a presence of malware process injection via the process running on the host device. Based on detecting the process of the malware process injection, an indication may be reported to a monitoring system and one or more remedial actions may be taken.

Abstract: Techniques and mechanisms for identifying unmanaged cloud resources with endpoint and network logs and attributing the identified cloud resources to an entity of an enterprise that owns the cloud resources. The process collects data from sources, e.g., endpoint and network logs, with respect to traffic in a computer network and based at least in part on the data, extracts relationships related to the traffic. The process applies rules to the relationships to extract destinations in the computer network that provide cloud resources in a cloud environment, wherein the cloud resources are owned by an enterprise. One or more users or business entities of the enterprise are identified as accessing the cloud resources.

Abstract: Techniques for detecting malware process injection on a host device. The techniques may include receiving endpoint metadata associated with an event, the endpoint metadata including information associated with a process that made a network connection from a host device. The techniques may also include receiving network metadata associated with the event, the network metadata including a network protocol fingerprint used to make the network connection. The techniques may further include determining that the network protocol fingerprint is indicative of a presence of malware process injection via the process running on the host device. Based on detecting the process of the malware process injection, an indication may be reported to a monitoring system and one or more remedial actions may be taken.

Abstract: The present disclosure relates to modified immunocytokine compositions comprising antibodies or antigen binding fragments specific for immune cell antigens and IL-18 polypeptides. Also provided herein are methods of treatment with and methods of manufacture of immunocytokine compositions.

Abstract: Techniques and mechanisms for identifying unmanaged cloud resources with endpoint and network logs and attributing the identified cloud resources to an entity of an enterprise that owns the cloud resources. The process collects data from sources, e.g., endpoint and network logs, with respect to traffic in a computer network and based at least in part on the data, extracts relationships related to the traffic. The process applies rules to the relationships to extract destinations in the computer network that provide cloud resources in a cloud environment, wherein the cloud resources are owned by an enterprise. One or more users or business entities of the enterprise are identified as accessing the cloud resources.

Abstract: Techniques and mechanisms for identifying unmanaged cloud resources with endpoint and network logs and attributing the identified cloud resources to an entity of an enterprise that owns the cloud resources. The process collects data from sources, e.g., endpoint and network logs, with respect to traffic in a computer network and based at least in part on the data, extracts relationships related to the traffic. The process applies rules to the relationships to extract destinations in the computer network that provide cloud resources in a cloud environment, wherein the cloud resources are owned by an enterprise. One or more users or business entities of the enterprise are identified as accessing the cloud resources.

Abstract: Techniques and mechanisms for identifying unmanaged cloud resources with endpoint and network logs and attributing the identified cloud resources to an entity of an enterprise that owns the cloud resources. The process collects data from sources, e.g., endpoint and network logs, with respect to traffic in a computer network and based at least in part on the data, extracts relationships related to the traffic. The process applies rules to the relationships to extract destinations in the computer network that provide cloud resources in a cloud environment, wherein the cloud resources are owned by an enterprise. One or more users or business entities of the enterprise are identified as accessing the cloud resources.

Abstract: The present invention relates to methods for treatment of lung cancers, in particular non-small cell lung cancer (NSCLC), wherein lung cancers have both a KRAS G12C mutation and an STK11 mutation, with adagrasib (MRTX849).

Abstract: The present disclosure relates a modified interleukin 18 (IL-18) polypeptide, methods of making the same, and methods of using the modified IL-18 polypeptides for treatment of diseases including cancer. The modified IL-18 polypeptide can exhibit an ability to induce interferon gamma (IFN?) production when in contact with a cell, exhibit a diminished ability to be inhibited by IL-18 binding protein (IL-18BP) compared to wild type IL-18 (WT IL-18), and exhibit a ratio of half-maximal inhibitory concentration (IC50) by IL-18BP to half-maximal effective concentration (EC50) to induce IFN? production which is greater than that of WT IL-18.

Abstract: The present disclosure relates to modified immunocytokine compositions comprising antibodies or antigen binding fragments specific for immune cell antigens and IL-18 polypeptides. Also provided herein are methods of treatment with and methods of manufacture of immunocytokine compositions.

Abstract: Techniques and mechanisms for identifying unmanaged cloud resources with endpoint and network logs and attributing the identified cloud resources to an entity of an enterprise that owns the cloud resources. The process collects data from sources, e.g., endpoint and network logs, with respect to traffic in a computer network and based at least in part on the data, extracts relationships related to the traffic. The process applies rules to the relationships to extract destinations in the computer network that provide cloud resources in a cloud environment, wherein the cloud resources are owned by an enterprise. One or more users or business entities of the enterprise are identified as accessing the cloud resources.

Abstract: In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

Abstract: In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

Abstract: In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

Abstract: In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

Abstract: In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

Abstract: A system uses a digital photographic camera attached to a radiation therapy device to create an overlay of radiation beam information comprising data identifying treated patient anatomical region data and supporting determination of cumulative radiation treatment information from multiple treatment overlays. A system records a treatment beam landing area on the anatomical body surface of a patient for use in radiation or other therapy. The system includes an input processor for receiving data representing an image of the surface of a portion of the anatomy of a patient. A data processor provides beam landing position data relative to the image by calculating a position of a treatment beam landing area relative to the image using received input data indicating projection characteristics of a treatment beam used in treating the portion of the anatomy of the patient. A storage processor stores the beam landing position data in a record associated with the patient.