Abstract: The disclosed computer-implemented method for managing endpoint security states using passive data integrity attestations may include (i) receiving passively collected network data from an endpoint device of a computing environment, (ii) determining a security state of the endpoint device using the passively collected network data from the endpoint device, (iii) determining that the security state of the endpoint device is below a threshold, and (iv) in response to determining that the security state of the endpoint device is below a threshold, performing a security action to protect the computing environment against malicious actions. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for providing secure memory may include reserving, by a hypervisor stored in a memory device of the computing device, a portion of the memory device as a secure memory during a boot sequence of the computing device and preventing access to the secure memory by an operating system (OS). The method may include receiving a request for secure memory by an application and reserving a portion of the secure memory for the application. The method may include authenticating the application to access the reserved portion of the secure memory, and allowing the authenticated application to access the reserved portion of the secure memory. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Computer-implemented systems, methods, and media are provided for emulating microprocessor instructions. The computer-implemented systems, methods, and media may, for example, identify an instruction of a first software application using a second software application that emulates instructions of a type of microprocessor, add an additional bit to a length of an operation code of the instruction to create an extended operation code, wherein the extended operation code is represented in an operation code table of the second software application, and emulate execution of the instruction using the second software application and the extended operation code.

Abstract: Systems and methods for providing information for use in a runtime environment that restricts access such information. An executable is launched prior to launching the runtime environment or runtime application. The executable retrieves information and makes that information available for use in the runtime, for example, by storing the information in a runtime file system area. The runtime or runtime application can then access the information. For example, the executable may retrieve information from a host operating system and then launch a runtime application that uses the information. An application that executes within a runtime and requires runtime external information can be provided as a bundle that includes an executable and the application itself. When the bundle is launched, the executable executes first to retrieve the information and make it available for the runtime. The runtime is then launched and provides the runtime application which can use the information.

Abstract: Techniques are disclosed for evaluating the effectiveness of a malware signature. A query tool translates a markup language malware signature definition into a database query. The query is then executed against a database of application features to identify software packages that the signature would identify as malware. The results of the query are compared with threat information stored in the database and classified as being true/false positives and true/false negatives.

Abstract: Techniques are disclosed for evaluating the effectiveness of a malware signature. A query tool translates a markup language malware signature definition into a database query. The query is then executed against a database of application features to identify software packages that the signature would identify as malware. The results of the query are compared with threat information stored in the database and classified as being true/false positives and true/false negatives.

Abstract: Systems and methods for providing information for use in a runtime environment that restricts access such information. An executable is launched prior to launching the runtime environment or runtime application. The executable retrieves information and makes that information available for use in the runtime, for example, by storing the information in a runtime file system area. The runtime or runtime application can then access the information. For example, the executable may retrieve information from a host operating system and then launch a runtime application that uses the information. An application that executes within a runtime and requires runtime external information can be provided as a bundle that includes an executable and the application itself. When the bundle is launched, the executable executes first to retrieve the information and make it available for the runtime. The runtime is then launched and provides the runtime application which can use the information.