Abstract: A typosquatting detection agent (“agent”) detects typosquatting in monitored user traffic at an endpoint device using features generated from metadata of a pull request to a package or container and trustworthiness scores of packages or containers with similar identifiers. The agent, upon detection of the pull request to the package or container, retrieves metadata for the package or container and generates a trustworthiness score for the package or container based on the metadata features. The agent then applies one or more criteria to the generated trustworthiness score and the scores of packages or containers with similar identifiers to identify typosquatting at the endpoint device.

Abstract: A system has been designed that examines details of a security advisory against informal vulnerability records. The system generates a vulnerability match confidence value based on comparison of different details in the security advisory against the informal vulnerability records. Based on the comparisons, the system determines similarity of different details between the security advisory and the informal vulnerability records and cumulatively updates a vulnerability match confidence value with various detail similarity weights according to the determined similarities. Based on the vulnerability match confidence value, the system can classify or designate a security advisory for automatic merging or for manual examination. This reduces the burden on cybersecurity personnel and allows cybersecurity personnel to focus their limited resources on analyzing new vulnerabilities.