Abstract: Aspects related to impersonation detection using an authentication enforcement engine are provided. An authentication enforcement platform may retrieve electronic signatures and device records. The platform may train an authentication enforcement engine, using the electronic signatures and device records, to generate similarity scores for transmissions. The platform may intercept a transmission. The platform may generate a similarity score for the transmission based on extracted information of the transmission. The platform may identify whether the similarity score satisfies a threshold. If the similarity score satisfies a threshold, the platform may update a device record, update the authentication enforcement engine, and route the transmission. If the similarity score fails to satisfy the threshold score, the platform may identify whether manual review is necessary. In some examples, the platform may initiate security actions responsive to the transmission.

Abstract: Aspects related to impersonation detection using an authentication enforcement engine are provided. An authentication enforcement platform may retrieve electronic signatures and device records. The platform may train an authentication enforcement engine, using the electronic signatures and device records, to generate similarity scores for transmissions. The platform may intercept a transmission. The platform may generate a similarity score for the transmission based on extracted information of the transmission. The platform may identify whether the similarity score satisfies a threshold. If the similarity score satisfies a threshold, the platform may update a device record, update the authentication enforcement engine, and route the transmission. If the similarity score fails to satisfy the threshold score, the platform may identify whether manual review is necessary. In some examples, the platform may initiate security actions responsive to the transmission.

Abstract: Enterprise organizations often have thousands or tens of thousands of employees accessing various websites while conducting business. Users may inadvertently reach compromised websites, unsecure websites, and/or websites that include broken links, which may be used by bad actors to redirect users to websites that include malware threats. Accordingly, arrangements described herein provide for real-time detection and notification of non-functioning websites to enable users to avoid potential malicious acts associated with these non-functioning websites.

Abstract: Various aspects of the disclosure relate to automated identification of illicit transfers of cryptocurrency via mixing organizations. A cryptocurrency tracing system is configured to transfer a series of electronic transactions between known digital wallets via a suspect mixing organization. The cryptocurrency tracing system traces each cryptocurrency transaction through a plurality of mixing digital wallets to identify all possible mixing digital wallets being used by the mixing organization. Based on the identified mixing digital wallets, suspect digital wallets are identified and a second series of transactions are initiated between the known digital wallets via the mixing digital wallets. Based on these transfers, suspect digital wallets can be monitored to identify cryptocurrency transfer patterns representative of an attempt to obscure illicit funds transfers. Once identified, the suspect digital wallets may be automatically frozen.

Abstract: Aspects related to impersonation detection using an authentication enforcement engine are provided. An authentication enforcement platform may retrieve electronic signatures and device records. The platform may train an authentication enforcement engine, using the electronic signatures and device records, to generate similarity scores for transmissions. The platform may intercept a transmission. The platform may generate a similarity score for the transmission based on extracted information of the transmission. The platform may identify whether the similarity score satisfies a threshold. If the similarity score satisfies a threshold, the platform may update a device record, update the authentication enforcement engine, and route the transmission. If the similarity score fails to satisfy the threshold score, the platform may identify whether manual review is necessary. In some examples, the platform may initiate security actions responsive to the transmission.

Abstract: A system for identifying and remediating data exfiltration paths is provided. In particular, the system may generate a map of the network environment which identifies all of the possible pathways and the steps of such pathways through which sensitive data may be exfiltrated. The system may then evaluate the potential impact associated with each exfiltration pathway and generate a prioritization scheme which may sort the pathways by their potential impacts. Based on the prioritization scheme, the system may, via a machine learning engine, provide one or more remediation processes that may be executed to reduce the chance of data exfiltration through certain potentially high-impact pathways.

Abstract: A system for identifying and remediating data exfiltration paths is provided. In particular, the system may generate a map of the network environment which identifies all of the possible pathways and the steps of such pathways through which sensitive data may be exfiltrated. The system may then evaluate the potential impact associated with each exfiltration pathway and generate a prioritization scheme which may sort the pathways by their potential impacts. Based on the prioritization scheme, the system may, via a machine learning engine, provide one or more remediation processes that may be executed to reduce the chance of data exfiltration through certain potentially high-impact pathways.

Abstract: Systems, computer program products, and methods are described herein for regulating exposure based secured access is presented. The present invention is configured to receive, from a user computing device, a request to access a network device to execute one or more actions, wherein the user computing device is associated with a payment token; receive information associated with the one or more actions, wherein the information comprises an exposure level; initiate an authorization module associated with the distributed network environment; determine, using the authorization module, a token amount to execute the one or more actions; automatically retrieve, from the user computing device, the token amount from the payment token; authorize the user computing device to access the network device to execute the one or more actions; and access and update a blockchain distributed ledger based on information associated with the request and subsequent authorization to access the network device.

Abstract: Systems, computer program products, and methods are described herein for regulating exposure based secured access is presented. The present invention is configured to receive, from a user computing device, a request to access a network device to execute one or more actions, wherein the user computing device is associated with a payment token; receive information associated with the one or more actions, wherein the information comprises an exposure level; initiate an authorization module associated with the distributed network environment; determine, using the authorization module, a token amount to execute the one or more actions; automatically retrieve, from the user computing device, the token amount from the payment token; authorize the user computing device to access the network device to execute the one or more actions; and access and update a blockchain distributed ledger based on information associated with the request and subsequent authorization to access the network device.

Abstract: Systems and methods for enterprise cybersecurity triaging of emails suspected of malicious content. Triaging may include analyzing threat level of email submitted for cybersecurity review. The systems and methods may deconstruct an email into components scorable for threat type and/or threat level. The systems and methods may include multiple dynamically selectable threat scoring modules. Email threat level may be based on component scores. Evaluated emails and scored components may be stored. Cybersecurity threat analysis may include comparison of the email and/or the scorable components against previously stored evaluated emails and previously stored scored components. Triaging may include identifying enterprise response teams experienced in the threat type and/or threat level of the email and/or of its components. Triaging may include preventing infiltration of an enterprise by malicious emails.

Abstract: Systems and methods for enterprise cybersecurity triaging of emails suspected of malicious content. Triaging may include analyzing threat level of email submitted for cybersecurity review. The systems and methods may deconstruct an email into components scorable for threat type and/or threat level. The systems and methods may include multiple dynamically selectable threat scoring modules. Email threat level may be based on component scores. Evaluated emails and scored components may be stored. Cybersecurity threat analysis may include comparison of the email and/or the scorable components against previously stored evaluated emails and previously stored scored components. Triaging may include identifying enterprise response teams experienced in the threat type and/or threat level of the email and/or of its components. Triaging may include preventing infiltration of an enterprise by malicious emails.