Abstract: Clustering is provided of computer security attacks by the threat actor based on features of the attacks. Attack data is obtained for a given attack and a plurality of features of the given attack are extracted from a plurality of attack attributes. A feature-based score is computed for the given attack based on the extracted features relative to each of a plurality of attack clusters. Each attack cluster is comprised of a plurality of attacks performed by a particular attacker. The given computer security attack is assigned to a particular attack cluster if the feature-based score for the particular attack satisfies a predefined score criteria.

Abstract: A method includes selectively implementing, via a component resident and executing on a point of sale system, one or more of a set of proactive operations to counter an information theft attack against the point of sale system. The set of proactive operations comprises: generating false information that appears to be actual information and creating at least one process executable in the point of sale system that comprises the false information; injecting false information that appears to be actual information into at least one process executing in the point of sale system; replacing actual information with false information that appears to be actual information; and blocking at least one process in the point of sale system to prevent actual information from being taken from the point of sale system.

Abstract: A method comprises obtaining data characterizing web browsing activity of a group of users of an enterprise, processing the data characterizing the web browsing activity to identify one or more patterns of web browsing activity of the group of users, selecting, based on the patterns of web browsing activity, at least one website to check for evidence of a watering hole attack threat to the enterprise, analyzing elements of said at least one website to identify executable code evidencing the watering hole attack threat to the enterprise, and modifying access by one or more client devices of the enterprise to said at least one website responsive to identifying executable code of said at least one website evidencing the watering hole attack threat to the enterprise.

Abstract: A technique for detecting fraudulent activity in a compromised device involves downloading a software application from a processor that controls access to a resource to an electronic device requesting access to the resource. The software application includes instructions that gather selected information from the electronic device such as mouse coordinates and active windows at a selected time and transmitting the information to the processor for analysis. The analysis includes determining whether more than a single input operation is occurring simultaneously. Simultaneous input operations are an improbable combination of processes for a single electronic device, and suggest a potential fraudulent activity. The technique may include sending a message to a security location for further analysis of the potential fraudulent activity, or the user may be contacted while the transaction attempt is delayed, or the attempted transaction operation may be terminated until enhanced security procedures are implemented.