Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for reducing the difference in performance of a model across groups and sub-groups within the same group of users with similar characteristics for providing digital components. Methods can include identifying, a loss function that generates a loss representing a measure of performance the model seeks to optimize during training. The loss function is modified by adding an additional term to the loss function. The model is trained using the modified loss function. A request for digital component is received that includes a user group identifier. The model generates one or more user characteristics based on which one or more digital components are selected and transmitted to the client device of the user.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for reducing the difference in performance of a model across groups and sub-groups within the same group of users with similar characteristics for providing digital components. Methods can include identifying, a loss function that generates a loss representing a measure of performance the model seeks to optimize during training. The loss function is modified by adding an additional term to the loss function. The model is trained using the modified loss function. A request for digital component is received that includes a user group identifier. The model generates one or more user characteristics based on which one or more digital components are selected and transmitted to the client device of the user.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for providing digital components to a client device. Methods can include assigning a temporary group identifier to a client device that identifies a particular group, from among a plurality different groups, that includes the client device based on a current period of user activity on the client device. A training set is generated for training a machine learning model that generates user characteristics. A request for digital component is received from the client device that includes the temporary group identifier currently assigned to the client device, a subset of activity features and one or more additional features that are based on the client device. The machine learning model generates one or more user characteristics based on which one or more digital components are selected and transmitted to the client device.

Abstract: A computer-implemented method for securely managing file-attribute information for files in a file system may comprise: 1) identifying at least one file, 2) identifying file-attribute information that identifies at least one file attribute for the file, 3) identifying volatile metadata associated with the file that contains file-attribute information, 4) determining that the file has been modified, and 5) automatically deleting the volatile metadata. Corresponding systems and computer-readable media are also disclosed.

Abstract: An apparatus for loading content items may include a processor that may be configured to identify at least one rule associated with a type associated with a content item. The processor may further be configured to evaluate at least one attribute associated with the content item against the at least one rule. The processor may also be configured to identify a container based at least in part on the at least one rule, and store the content item in the identified container based at least in part on the evaluation of the at least one attribute against the at least one rule. A corresponding method and computer program product may also be provided.

Abstract: A DNS security system collects and uses aggregated DNS information originating from a plurality of client computers to detect anomalous DNS name resolutions. A server DNS security component receives multiple transmissions of DNS information from a plurality of client computers, each transmission of DNS information concerning a specific instance of a resolution of a specific DNS name. The server component aggregates the DNS information from the multiple client computers. The server component compares DNS information received from a specific client computer concerning a specific DNS name to aggregated DNS information received from multiple client computers concerning the same DNS name to identify anomalous DNS name resolutions. Where an anomaly concerning received DNS information is identified, a warning can be transmitted to the specific client computer from which the anomalous DNS information was received.

Abstract: A computer-implemented method for blocking and removing Internet-traversing malware may include: 1) identifying a persistent storage object of an Internet client application, 2) identifying an attempt by an executable object to access the persistent storage object, 3) determining that the executable object is not authorized to access the persistent storage object, and then 4) performing a security action based on the determination. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Incoming network traffic is monitored, and content-based files in the monitored incoming network traffic originating from remote sources are identified. When a specific content-based file originating from a remote source is identified, security information concerning that file is gleaned. This security information comprises at least a security reputation of the remote source from which the file originates. An attempt to open the file is identified, and a security risk rating is determined based on the security information concerning the file. In response to the security risk rating exceeding a given threshold, behavior associated with the attempt to open the file is altered. This altering of behavior can comprise, for example, disabling a scripting engine for the instance of the content processing application attempting to open the file, or altering file system and/or operating system resource access privileges.

Abstract: A financial portfolio management system operable in a network environment can be configured to gather financial information from a plurality of sources over an electronic network and intelligently aggregate the information into a financial portfolio viewable by a client. The client can determine which accounts should be included in the portfolio. The system uses web crawling, parsing, or spidering technology to update the portfolio information. The system provides one platform that conveys financial information from a variety of accounts held at several different financial institutions.

Abstract: A computer-implemented method for individually managing the power usage of software applications may include: 1) identifying at least one software application installed on a computing device, 2) determining the power usage of the software application, 3) identifying a power-management policy for managing the power usage of the software application independent of the overall power usage of the computing device, and then 4) managing the power usage of the software application independent of the overall power usage of the computing device in accordance with the power-management policy. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A DNS security system collects and uses aggregated DNS information originating from a plurality of client computers to detect anomalous DNS name resolutions. A server DNS security component receives multiple transmissions of DNS information from a plurality of client computers, each transmission of DNS information concerning a specific instance of a resolution of a specific DNS name. The server component aggregates the DNS information from the multiple client computers. The server component compares DNS information received from a specific client computer concerning a specific DNS name to aggregated DNS information received from multiple client computers concerning the same DNS name to identify anomalous DNS name resolutions. Where an anomaly concerning received DNS information is identified, a warning can be transmitted to the specific client computer from which the anomalous DNS information was received.

Abstract: A computer system detects and selectively blocks a cookie associated with a website. The system monitors a network traffic stream directed to a client from a website and detects presence of a cookie associated with the website in the network traffic stream. The system detects the cookie in the network traffic stream by analyzing the network stream using a network traffic filtering scheme, such as a deep packet inspection engine. The system further determines a reputation of the website in response to detecting the cookie in the network traffic stream. A reputation of a website represents an assessment of whether the website is trustworthy. Based on the determined reputation of the website, the system selectively blocks the cookie from being stored in the client if the reputation of the website is bad.

Abstract: A computer-implemented method includes identifying a file and calculating a first identifier for the file. The method may also include identifying a first malware identifier that is associated with a first malware program. The method may further include comparing the first file identifier with the first malware identifier to determine whether the file comprises the first malware program. The method may include saving the first file identifier in a manner that allows the first file identifier to be retrieved for comparison with a second malware identifier. The second malware identifier may be associated with a second malware program. Various other methods and systems are also disclosed herein.

Abstract: A financial portfolio management system operable in a network environment can be configured to gather financial information from a plurality of sources over an electronic network and intelligently aggregate the information into a financial portfolio viewable by a client. The client can determine which accounts should be included in the portfolio. The system uses web crawling, parsing, or spidering technology to update the portfolio information. The system provides one platform that conveys financial information from a variety of accounts held at several different financial institutions.

Abstract: A user mode application component invokes the assistance of a kernel mode driver component to detect and/or remediate malicious code on a computer system. The user mode application may include code that detects, for example, spyware and computer viruses, from user mode and when appropriate takes protective action when malicious code is detected. In one aspect, when the user mode application is unable to perform a selected operation in attempting to detect and/or take protective action, the user mode application invokes a kernel mode driver for assistance. The kernel mode driver assists user mode application in detecting malicious code and/or taking protective action by enabling or otherwise performing a selected operation for the user mode application.

Abstract: A financial portfolio management system operable in a network environment can be configured to gather financial information from a plurality of sources over an electronic network and intelligently aggregate the information into a financial portfolio viewable by a client. The client can determine which accounts should be included in the portfolio. The system uses web crawling, parsing, or spidering technology to update the portfolio information. The system provides one platform that conveys financial information from a variety of accounts held at several different financial institutions.

Abstract: A network communication corresponding to a malicious network signature associated with malicious code is detected on a host computer system. A determination is made whether or not the malicious network signature is validated as associated with a non-malicious code process. Upon a determination that the malicious network signature is not validated, the corresponding network communication is blocked, and the associated malicious code is located on the host computer system and removed from the host computer system. In some embodiments, the host computer system is further evaluated for the presence of residual artifacts of the malicious code on the host computer system.

Abstract: A method and apparatus of detecting executable software in alternate data streams to secure operation of a computer comprises processing information regarding a file requested for execution and determining an alternate data stream associated with the file, wherein the alternate data stream comprises executable software.

Abstract: A method for mitigating false-positives as detected by antivirus software comprising accessing an operating system file that has been identified as malware; creating a signature for the operating system file; comparing the created signature to a signature database; and, if the created signature is not found in the signature database, defining the operating system file as malware. An operating system file, as used herein, is any file included as a part of the operating system binary executable file set, as well as any files added from third party vendors that integrate with or plug into the operating system.

Abstract: A DNS security system collects and uses aggregated DNS information originating from a plurality of client computers to detect anomalous DNS name resolutions. A server DNS security component receives multiple transmissions of DNS information from a plurality of client computers, each transmission of DNS information concerning a specific instance of a resolution of a specific DNS name. The server component aggregates the DNS information from the multiple client computers. The server component compares DNS information received from a specific client computer concerning a specific DNS name to aggregated DNS information received from multiple client computers concerning the same DNS name to identify anomalous DNS name resolutions. Where an anomaly concerning received DNS information is identified, a warning can be transmitted to the specific client computer from which the anomalous DNS information was received.