Abstract: Methods, systems, and computer program products for content management systems. Multiple components are operatively interconnected to carry out operations for establishing a user device trust level. A content management system facilitates interactions between a plurality of user devices and a plurality of shared content objects. The plurality of user devices are network connected to the content management system. One of the user devices issues a request to access a particular one of the content objects. Responsive to the request, a two-step device check is performed before granting access to the particular one of the content objects. A first step of the two-step device check process is based on environmental information, and a second step of the two-step device check process is based at least in part on analysis of the content of the particular one of the content objects. The actual bits of the content object itself are inspected.

Abstract: Methods, systems, and computer program products for content management systems. Multiple components are operatively interconnected to carry out operations for establishing a user device trust level. A content management system facilitates interactions between a plurality of user devices and a plurality of shared content objects. The plurality of user devices are network connected to the content management system. One of the user devices issues a request to access a particular one of the content objects. Responsive to the request, a two-step device check is performed before granting access to the particular one of the content objects. A first step of the two-step device check process is based on login information, and a second step of the two-step device check process is based at least in part on analysis of the content of the particular one of the content objects. The actual bits of the content object itself are inspected.

Abstract: Methods and apparatus are provided for detecting periodic behavior in a communication session using clustering. An exemplary method comprises obtaining a set of differences between timestamps of adjacent events for a given network session; assigning each difference in the set to a cluster using a clustering technique based on a distance between the difference and a mean time difference for each cluster; and providing clusters generated by the clustering technique, wherein each of the differences in each of the clusters correspond to events exhibiting periodic behavior with a period substantially equal to the mean time difference of the assigned cluster. The differences are optionally obtained and processed in real-time. The periodicity of a given cluster is measured, for example, based on a variance of the differences assigned to the given cluster. The clusters are optionally processed to identify suspicious communications associated with a computer security attack.

Abstract: There is disclosed herein techniques for use in detecting risky communications. In one embodiment, the techniques comprise a method including the following steps. The method comprises determining entropy in connection with a communication. The method also comprises performing a comparison based on the entropy and historical communications. The method further comprises determining the similarity between the communication and the historical communications based on the comparison.