Abstract: The disclosed computer-implemented method for detecting security incidents may include (i) collecting, by a security server, security information describing security events detected on at least one client device, (ii) generating, based on the collected security information, a mathematical graph that includes a set of nodes designating machine-windows of data and a set of nodes designating detected security events, (iii) executing a random-walk-with-restart algorithm on the generated mathematical graph to sort the set of nodes designating machine-windows of data in terms of relevance to a set of ground truth nodes that indicate confirmed security threats, and (iv) performing a remedial security action to protect a user in response to detecting a candidate security threat based on sorting the set of nodes designating machine-windows of data by executing the random-walk-with-restart algorithm. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for remediating computer reliability issues may include (1) obtaining a computer-generated log line that potentially includes information pertaining to a cause of a reliability issue experienced by a device, (2) determining that a product-specific schema has not been created for a product that generated the computer-generated log line, (3) in response to determining that a product-specific schema has not been created for the product, matching values of the computer-generated log line to fields within one or more established schemas that are not specific to the product, (4) identifying an entry, within the one or more established schemas, that corresponds to the computer-generated log line, and (5) remediating the device based on information associated with the entry within the one or more established schemas. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for anonymizing log entries may include (1) detecting a data pattern in a group of log entries documenting events performed by at least one process executing on at least one device, (2) identifying, in the data pattern, at least one data field in the log entries that contains variable data, (3) evaluating the data field containing variable data to determine whether the data field contains sensitive data, and (4) in response to determining whether the data field contains sensitive data, applying a data-anonymization policy to the data field to anonymize the log entries. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Computer-implemented methods and systems for creating or updating approved-file and trusted-domain databases and verifying the legitimacy of files are disclosed. A method for creating or updating an approved-file database may include intercepting a first file, identifying a source domain associated with the first file, identifying a trusted-domain database, determining whether a database record for the source domain associated with the first file exists within the trusted-domain database, creating a hash value for the first file if a database record for the source domain associated with the first file exists within the trusted-domain database, and storing the hash value for the first file in an approved-file database. Methods and systems for verifying the legitimacy of a file and for creating or updating a trusted-domain database are also disclosed.

Abstract: A method for inferring real world identities is provided. The method includes receiving an authenticated copy of a document, the document having identification information and the document subject to a security check. The method includes providing evidence that an owner of the authenticated copy of the document passed the security check validating the identification information contained in the document. The method includes asserting that a device is associated with a real-world identity corresponding to the identification information listed in the authenticated copy of the document, in response to a determination that the owner of the authenticated document entered the secured area. At least one method operation is executed through a processor.

Abstract: Techniques are disclosed for detecting security incidents based on low confidence security events. A security management server aggregates a collection of security events received from logs from one or more devices. The security management server evaluates the collection of security events based on a confidence score assigned to each distinct type of security event. Each confidence score indicates a likelihood that a security incident has occurred. The security management server determines, based on the confidence scores, at least one threshold for determining when to report an occurrence of a security incident from the collection of security events. Upon determining that at least one security event of the collection has crossed the at least one threshold, the security management server reports the occurrence of the security incident to an analyst.

Abstract: A method, apparatus and system for using login information includes an account where login information is used to access the account, a login information usage data for storing the login information used on the account and a manager application coupled to the accounts through a network. The manager application is configured to access the login information and determine at least one potentially or actually compromised account, determine login information related to the at least one potentially or actually compromised account, determine at least one other account having similar login information and notify a user regarding a potential threat to the at least one other account.

Abstract: The disclosed computer-implemented method for anonymizing log entries may include (1) detecting a data pattern in a group of log entries documenting events performed by at least one process executing on at least one device, (2) identifying, in the data pattern, at least one data field in the log entries that contains variable data, (3) evaluating the data field containing variable data to determine whether the data field contains sensitive data, and (4) in response to determining whether the data field contains sensitive data, applying a data-anonymization policy to the data field to anonymize the log entries. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Techniques are disclosed for detecting security incidents based on low confidence security events. A security management server aggregates a collection of security events received from logs from one or more devices. The security management server evaluates the collection of security events based on a confidence score assigned to each distinct type of security event. Each confidence score indicates a likelihood that a security incident has occurred. The security management server determines, based on the confidence scores, at least one threshold for determining when to report an occurrence of a security incident from the collection of security events. Upon determining that at least one security event of the collection has crossed the at least one threshold, the security management server reports the occurrence of the security incident to an analyst.

Abstract: Techniques for detecting an intranet spoofing attack are disclosed. In one embodiment, the techniques may be realized as a system and method for detecting an intranet spoofing attack. For example, the system may comprise one or more processors communicatively coupled to a network. The one or more processors may be configured to: identify an attempt to access an intranet website at a user device; determine that the intranet website is a spoofed intranet website; and perform an action in response to the determination of the spoofed intranet website to protect user.

Abstract: A computer-implemented method for discouraging polymorphic malware may comprise: 1) receiving a request to register a file in a registration database, 2) applying a registration tax to the file, 3) determining, based on whether the registration tax for the file has been satisfied, whether to register the file in the registration database, and then 4) determining, based at least in part on whether the file has been registered in the registration database, whether to add the file to an approved-file database. A method for determining whether to allow files on a computing device to execute using such an approved-file database is also disclosed. Corresponding systems and computer-readable media are also disclosed.

Abstract: Method for monitoring an online identity of a user on a network is described. In one example, data exchanged between a browser client on a device associated with the user and the network is monitored. Creation or use of an online identity by the user is detected within the data. The online identity is associated with a host site. The host site may be any of a plurality of point of presence sites. A notification of the online identity is generated for presentation to a custodian of the user. The notification may then be sent to the custodian.

Abstract: A method for using virtualization to implement information rights management. The method may include: 1) intercepting, at a virtualization module, a request from an application to access data; 2) querying an information-rights-management database for a virtualization policy associated with the access request; 3) receiving, at the virtualization module, the virtualization policy from the information-rights-management database; and 4) controlling access to the data by applying the virtualization policy to the access request in a manner that is transparent to the application. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method and apparatus for preventing accidental disclosure of confidential information via visual representation objects is described. In one embodiment, the method includes establishing pattern information with respect to confidential information, wherein the confidential information is used to authenticate users, monitoring a visual representation object having an input focus associated with a user interface, wherein the visual representation object receives input data, comparing the input data with the pattern information to identify at least one unobscured portion of the confidential information and producing indicia of detection of the at least one unobscured portion of the confidential information on the visual representation object.

Abstract: Method and apparatus for monitoring identity misrepresentation by a user on a network are described. In one example, validated identity information for the user is received from a trusted source. Data exchanged between a network client on a device associated with the user and the network is monitored. An identity misrepresentation by the user is detected based on the validated identity information. A notification of the identity misrepresentation is sent to the trusted source.

Abstract: Computer-implemented methods, systems, and computer-readable media for using community data to automatically generate rules for distinguishing data files from other file types are disclosed. In one example, an exemplary method for performing such a task may comprise: 1) receiving file metadata from a plurality of computing systems within a community, 2) establishing, based on the file metadata received from the plurality of computing systems within the community, criteria for distinguishing data files from other file types, and then 3) automatically generating a rule that comprises at least one of the criteria for distinguishing data files from other file types. Corresponding methods for identifying data files by applying such rules are also disclosed.

Abstract: A method and apparatus for preventing sensitive data leakage due to input focus misappropriation is described. In one embodiment, a method for restricting a change in an input focus to protect sensitive data comprising identifying a visual representation component used to receive sensitive data, wherein the virtual representation component having an input focus of a computer and preventing a change in the input focus from the visual representation component.

Abstract: A method for managing rights associated with data is described. A request to access encrypted data is intercepted. Credentials associated with the request are verified. The data is decrypted if the credentials are verified. The decrypted data is marked with an identifier. Predetermined operations directed to the decrypted data are monitored.

Abstract: A computer-implemented method for detecting rootkits. The method may include identifying, from a control platform, a first directory listing. The first directory listing may be associated with a file system. The method may include identifying, from a target platform, a second directory listing. The second directory listing may be associated with the file system. The target platform and the control platform may be running concurrently on a computing device. The method may also include detecting a discrepancy between the first directory listing and the second directory listing and determining that the discrepancy is a result of the target platform being infected with a rootkit. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for temporarily adjusting control settings on computing devices. The method may comprise: 1) receiving a set of permissions for adjusting a set of control settings on a computing device, 2) identifying the set of control settings to be adjusted, and then 3) temporarily adjusting, based on the set of permissions, the set of control settings. The method may further comprise saving a base state of the set of control settings and restoring the set of control settings to the base state. Corresponding systems and computer-readable media are also disclosed.