Abstract: A method, system and product for identifying spoofed maritime signals based on receiving reception stations. The method comprises obtaining one or more location-reporting signals of a maritime vessel, wherein the one or more location-reporting signals comprise one or more respective sets of geographical coordinates, each of which having a timestamp. The method further comprises determining that the one or more location-reporting signals are at least partially fabricated. The determination comprises: identifying a station that received the one or more location-reporting signals, wherein the station having a reception polygon; and determining that at least one set of geographical coordinates indicated by the one or more location-reporting signals is fabricated based on the reception polygon of the station. The method further comprises performing a responsive action.

Abstract: A method, system and product for dead reckoning-based analysis of fabricated maritime data. The method comprises determining an initial location of the maritime vessel; determining speed and heading information using the location-reporting signals; computing estimated location of the maritime vessel at a specific time, based on the initial location and based on the speed and heading information; comparing the estimated location with a reported location at the time according to location-reporting signals; based on the comparison, determining that the location-reporting signals are at least partially fabricated; and in response to the determination that the location-reporting signals are at least partially fabricated, performing a responsive action.

Abstract: A method, system and product for identifying fabricated maritime signals. The method comprises obtaining one or more location-reporting signals of a maritime vessel, wherein the one or more location-reporting signals comprise one or more respective sets of geographical coordinates, each of which having a timestamp; determining that the one or more location-reporting signals are at least partially fabricated, wherein said determining is based on an identification that a maritime path indicated by the one or more location-reporting signals is unfeasible; and performing a responsive action.

Abstract: Techniques are provided for evaluating anomaly detection algorithms using impersonation data derived from user transaction data. An exemplary method comprises obtaining transaction data of a given enterprise organization comprising transactions of a plurality of users; generating impersonation data by modifying one or more features of a subset of the transaction data of the given enterprise organization; classifying (i) at least a portion of the transaction data of the given enterprise organization, and (ii) at least a portion of the impersonation data using the anomaly detection algorithm of the given enterprise organization, wherein records of the impersonation data comprise a known classification; and evaluating a performance of the anomaly detection algorithm of the given enterprise organization by comparing the classification of records of the impersonation data by the anomaly detection algorithm with the known classification.

Abstract: Techniques of risk-based authentication involve adjusting a risk engine used by a recipient entity based on feedback acquired from multiple entities. Along these lines, both a recipient risk engine and one or more donor risk engines perform risk-based authentication for which respective feedback is generated. The feedback indicates whether certain transaction requests predicted to be fraudulent are confirmed to be fraudulent. The recipient risk engine is then adjusted based on the feedback created for itself, the feedback created for any of the donor risk engines, or some combination thereof.

Abstract: Techniques are provided for smoothing discretized values used, for example, for authentication or identity assurance. An illustrative method comprises obtaining at least one probability of transitioning between at least two discretized values of a given feature; computing a smoothed feature score for the given feature for a transition from a first one of the discretized values to a second one of the discretized values based on the probability of the transition from the first discrete value to the second discrete value; and performing one or more of authenticating a user and verifying an identity of a user based at least in part on the smoothed feature score. The probabilities of transitioning between the discretized values are optionally stored in a transition matrix. Feature scores for first and second discretized values are optionally weighted based on the probability of the transition from the first discrete value to the second discrete value.

Abstract: Techniques are provided for determining anomaly scores for transactions based on adaptive clustering of the location of a given user over multiple transactions.

Abstract: There is disclosed in one embodiment a method comprising the step of determining, access rights granted to a first user that enables access to a computerized resource. The method also comprises the step of comparing the access rights granted to the first user against access rights granted to a second user associated with the first user. The method further comprises the step of providing a warning when the comparison indicates that the first user has excessive access rights over the second user.

Abstract: Methods and apparatus are provided for identifying suspicious domains using common user clustering. An exemplary method comprises obtaining network event data comprising a plurality of network connections; identifying users and domains associated with the network connections in the network event data; creating a connection between each user/domain pair that communicate with one another in the identified users and the identified domains to generate a graph; connecting domains in the graph using inter-domain edges that share common users to obtain a graph of interconnected domains; identifying bi-connected components in the graph of interconnected domains, wherein the bi-connected components comprise node pairs having at least two paths in the graph of interconnected domains between them; and processing the bi-connected components to identify a plurality of suspicious domains that are likely to participate in a computer security attack.

Abstract: Techniques of performing authentication involve comparing current user authentication factors with previous authentication factors selected from multiple users during a single authentication session. Along these lines, suppose that an authentication server receives current browser characteristics from a user computer during a current authentication session. Based on the current browser characteristics, the authentication server selects previous browser characteristics received from devices used by multiple users during previous authentication sessions. For example, the authentication server may select previous browser characteristics based on the whether any of the results of a modified, locally sensitive hashing (LSH) of the previous browser characteristics match any of the results of a modified LSH of the current browser characteristics.