Abstract: The technology described herein identifies and mitigates phishing attempts by analyzing user input received at the operating system level. Initially, a credential, such as a username or password, is registered with the threat detection system. The technology described herein intercepts user input at the operating system level, generates a hash of the input, and compares it with a hash of a credential being monitored. A credential entry is detected when a hash for the character string entered matches a hash for a credential being monitored. The technology described herein will perform a threat assessment when a secret entry is detected. The threat assessment may use the application context and the network context as inputs to the assessment. Various mitigation actions may be taken when a threat is detected.

Abstract: A dynamically configurable list management system that supports list elements of multiple content types is presented. Each list element is associated with an element type via an element type identifier. The element type identifier uniquely identifies the element type to the list management system. Each property associated with each element type is included in the list. Each property is identified by a unique property identifier. When adding a list element of a new element type to an existing list that does not include any elements of the new element type, the list management system identifies every property associated with the new element type. For each property associated with the new element type, the list management system determines which properties are not already included in the list, and adds those properties that are not already including to the list.

Abstract: User-structured data tables can be queried more efficiently by storing a copy of the important data from a user-structured data base table in one or more special indexes. A special index normally comprises Name Value Pairs (NVP) that can be used to efficiently query the important data by using the database indexes. Efficient querying can be accomplished by creating a separate table for a user-structured table, indexing the separate table using NVPs; and creating multiple tables in a collation order in order to search data that is sorted in accordance with user conventions in various locales.

Abstract: Efficient querying across disparate schemas can be implemented by initially limiting the total number of lists and the total number of items queried and by using a mechanism for aligning data during the query. Querying across disparate data (e.g., data that is stored in accordance with disparate schemas) can comprise removing lists that are not applicable, defining a data alignment for the lists being searched, and executing the query.