Abstract: This disclosure relates to, among other things, scalable data processing, storage, and/or management systems and methods. Certain embodiments disclosed herein provide for a multi-dimensional data storage structure that may facilitate parallel processing of data during both data ingestion and data retrieval and/or access processes involving one or more storage layers In various embodiments, sequence number schemes associated with ingested data records may allow for improved management of data stored in one or more layers (e.g., hot and/or cold data storage layers).

Abstract: A system includes a first application programming interface (API), a second API, and a third API. The first API is configured to receive an input to configure a data sharing permission for a data sharing service. The second API is configured to gather data of a user and receive, from a plurality of experience providers, an API response containing data of the user, and aggregate the data of the user. The third API is configured to classify the aggregated data according to a classification scheme where the classification scheme comprises rules for multiple levels of granularity such that the data of the user is classified for a plurality of overlapping data categories, generate a user data corpus comprising the classified aggregated data of the user, and provide the user with selectable data categories based on the user data corpus.

Abstract: Techniques are disclosed relating to selection of miners/validators in a decentralized cryptographic network. In some embodiments, a request to add a transaction to a blockchain includes a cryptographic signature associated with provision of a second transfer fee, in addition to a first transfer fee, to miners/validators who meet a set of one or more criteria. Disclosed techniques may advantageously allow steering of blockchain requests to a desired subset of miners/validators.

Abstract: A system includes reception of a database query, determination of result set output columns associated with the database query, and determination, for each of the determined result set output columns, of one or more data sources associated with the result set output column. Sensitivity information is determined for each of the one or more data sources based on metadata, and result set sensitivity information is determined based on the determined sensitivity information. A result set is determined based on the database query, and the result set and the result set sensitivity information are transmitted.

Abstract: A secure communication tunnel between user space software and a client device can be established. A private session key can be communicated from the user space software to a network communication device in at least one User Datagram Protocol datagram. Outbound session backets can be communicated from the user space software to the network communication device.

Abstract: Systems, methods and computer readable products are provided for enabling dynamic loading of one or more digital image branding functions associated with one or more distribution rules. A distribution rule is used to target a group of end users that are selected from a dataset mapping a plurality of end-users according to one or more distribution rules. Instructions are forwarded to present an indication the digital image branding function to each member of the end users group.

Abstract: [Problem] To ensure security in document management in small-scale organizations without using expensive servers by establishing peer-to-peer connection of a plurality of PCs, and to enable mutual non-tampering certification among connected organizations. [Solution] Provided is a document management system in which is formed a PC group in which a plurality of small electronic computers for creating, recording, and viewing a document are connected via a communication channel, said system comprising i) an in-PC cluster document synchronization means which causes a document recorded on one PC to be incorporated in recordings of other PCs belonging to a cluster, (ii) a document hash value generation means which generates a hash value of the document, and (iii) a blockchain generation means which assembles a plurality of the generated hash values and forms a block, connects the block to the existing blocks and forms a blockchain, and synchronizes and records same on the PCs within the PC cluster.

Abstract: Enterprise cybersecurity systems and methods related to receiving or accessing a real-time cybersecurity request, automatically transmitting a live mode request to a first cybersecurity microservice to generate cybersecurity risk-scoring information, receiving a response to the live mode request, calculating a cybersecurity score, automatically populating cybersecurity response data based on the calculated cybersecurity score, and automatically transmitting the cybersecurity response data to the enterprise client electronic device. The enterprise cybersecurity system and method also includes, after the cybersecurity response data has been transmitted to the enterprise client electronic device, automatically transmitting a test mode request to at least one test mode cybersecurity microservice, wherein the test mode request includes real-time data extracted from the real-time cybersecurity request.

Abstract: The disclosed embodiments include computer-implemented processes that predict a credit score for a customer in real-time based on an application of a trained machine-learning or artificial-intelligence process to encrypted event data at a third-party computing cluster. For example, an apparatus may transmit encrypted event data to a third-party computing system. The third-party computing system may apply a trained artificial intelligence process to encrypted feature data that includes the encrypted event data, and the apparatus may receive, from the third-party computing system, encrypted output data representative of a predicted credit score during at least one temporal interval. The apparatus may decrypt the encrypted output data using a homomorphic decryption key, and transmit a notification that includes the decrypted output data to a device. An application program executed at the device may present a graphical representation of at least a portion of the decrypted output data within a digital interface.

Abstract: Embodiments described herein are generally directed to integration of multiple services across multiple clouds within a unified IAM control plane. According to an example, an MSP provides (i) a user interface through which users of multiple tenants are able to configure permissions for and access multiple resources of a set of services associated with a hybrid cloud; and (i) a unified IAM control plane across the set of services, each of which potentially uses a different IAM protocol or scheme. A centralized IAM service is maintained by the MSP containing information regarding the permissions for the resources. Multiple service integrations for the set of services are supported by the MSP, including providing a first set of APIs that facilitate a direct integration with the unified IAM control plane in which the centralized IAM service maintains access control information for resources associated with a first service of the set of services.

Abstract: Techniques are described herein that are capable of detecting an algorithmic attack against a hosted artificial intelligence (AI) system based on inputs (e.g., queries) and outputs of the hosted AI system. In a first example, a feature-based classifier model is used to generate a classification score based on features that are derived from numerical representations of the queries and the outputs, and an algorithmic attack is detected based on the classification score being greater than or equal to a score threshold. In a second example, a transformer-based model is used to generate a vector by providing a multivariate time series, which is based on attribute(s) of the inputs and attribute(s) of the outputs, as an input to the transformer-based model, and an algorithmic attack is detected based on a distance between the vector and a point corresponding to a reference vector being less than or equal to a distance threshold.

Abstract: Systems, methods, and software described herein provide for validating security actions before they are implemented in a computing network. In one example, a computing network may include a plurality of computing assets that provide a variety of different operations. During the operations of the network, administration systems may generate and provide security actions to prevent or mitigate the effect of a security threat on the network. However, prior to implementing the security actions within the network, computing assets may exchange security parameters with the administration systems to verify that the security actions are authentic.

Abstract: Various arrangements relate to a method performed by a processor of a computing system. An example method includes hashing a first salted value to generate a first hashed salted value. The first salted value includes a first salt value and a value. A first tuple is generated. The first tuple includes the first hashed salted value and a first token. The first token is associated with the value. A first BAT message is generated. The first BAT message includes the first salt value. The first BAT message is associated with the first tuple. A second salted value is hashed to generate a second hashed salted value. The second salted value includes a second salt value and a value. A second tuple is generated. The second tuple includes the second hashed salted value and a second token. The second token is associated with the value. A second BAT message is generated.

Abstract: A system and method for securing a portion of a communication includes receiving a request to mark a portion of a communication as sensitive, where the communication includes a sensitive portion and an unsensitive portion. Upon receiving the request, a data property of the sensitive portion is set to a sensitive content property. After setting the data property, the method includes, securing the sensitive portion by initiating security calls for handling the sensitive portion, and transmitting the communication to a recipient. After the communication is transmitted to the recipient, access to the unsensitive portion is provided to the recipient, while the sensitive portion is redacted until the recipient is authenticated for receiving access to the sensitive portion.

Abstract: A method and apparatus for establishing a software root of trust (RoT) ensures that the state of an untrusted computer system contains all and only content chosen by an external verifier and the system code begins execution in that state, or that the verifier discovers the existence of unaccounted for content. The method enables program booting into computer system states that are free of persistent malware such that an adversary cannot retain undetected control of an untrusted system.

Abstract: Provided are a group service implementation method and device, an equipment and a storage medium. The specific solution is described below. A service transaction request is acquired. In response to the service transaction request including to-be-authenticated data and a threshold signature, a signature group corresponding to the threshold signature is determined. Group information of the signature group is acquired by querying a blockchain, where the signature group includes at least two members, the at least two members of the signature group are used for authenticating the to-be-authenticated data by adopting secure multi-party computation and generating the threshold signature for the to-be-authenticated data by adopting a signature private key, and the group information includes at least a verification public key of the threshold signature. The threshold signature is verified by adopting the verification public key in the group information.

Abstract: Disclosed herein is a technique for managing permissions associated with the control of a host device that are provided to a group of wireless devices. The host device is configured to pair with a first wireless device. In response to pairing with the first wireless device, the host device grants a first level of permissions for controlling the host device to the first wireless device. Subsequently, the host device can receive a second request from a second wireless device to pair with the host device. In response to pairing with the second wireless device, the host device can grant a second level of permissions for controlling the host device to second wireless device, where the second level of permissions is distinct from the first level of permissions.

Abstract: Protecting a mobile device from visual hacking comprises analyzing a displayed window/page containing data fields and parsing the fields to identify when sensitive information is displayed. Data from a gyroscope of the mobile device is used to detect roll and pitch viewing angles of the mobile device, data from a proximity sensor is used to detect a distance between the mobile device and the user, and a camera is used to take an image of the user and detect a number of faces visible in the image. The sensitive information is obscured when any predefined conditions are not met, including: determining that the roll and pitch viewing angles are not within pitch and roll threshold values, or that the detected distance is not within distance threshold values, or that more than a single face is detected in the image.

Abstract: A method for generating training data for endoscopic applications, in which stored image data comprising individual images or video data from endoscopic procedures/examinations are prepared as training data for machine learning applications. Wherein the method includes: (a) subjecting the image data to an image recognition algorithm for determining: (i) whether the stored image data was captured inside or outside a body, and (ii) whether text information and faces are contained in the stored image data, and (b) subjecting the image data to an image processing algorithm, with which the image data, depending on the result in (a): (i) are anonymized by obscuring or removing text information and faces when the stored image data is determined to have been captured outside of a body, and (ii) are anonymized by obscuring or removing text information when the stored image data is determined to have been captured inside of a body.

Abstract: Various embodiments of the present invention provide methods, apparatus, systems, computing devices, computing entities, and/or the like for performing predictive data analysis operations. Certain embodiments of the present invention utilize systems, methods, and computer program products that perform predictive data analysis operations by generating a hybrid class for a multi-party communication transcript data object associated with a predictive entity utilizing a hybrid space classification machine learning model, generating a machine learning-based risk score utilizing a hybrid-class-based risk scoring machine learning model, and generating a hierarchical-workflow risk score using a hierarchical risk score adjustment workflow.

Abstract: The disclosed technology includes systems and methods of identifying and managing sensitive information. The method can include detecting data entered into a form on a user interface, and generating, by a natural language understanding model, comprehension data based on the data entered into the form. The method can include determining, by a machine learning model, a risk score of the data and determining whether the risk score is greater than or equal to a threshold risk score. In response to determining that the risk score is greater than or equal to the threshold risk score, the method can include outputting a message to the user interface to alert a user that the data likely comprises sensitive information. The method can include receiving an input from the user interface indicative of whether the data comprises sensitive information and storing the data, the risk score, and the input in a database.

Abstract: Described herein are improved systems and methods for provisioning of private computer networks and application software as well as providing private SaaS.

Abstract: A license authentication device for a semiconductor manufacturing apparatus that provides a licensed function includes: an acquiring unit that acquires first information and second information from the semiconductor manufacturing apparatus; a first authentication information generating unit that generates first authentication information based on the first information and the second information acquired by the acquiring unit; and a usage authority determining unit that, when the first authentication information generated by the first authentication information generating unit and the first authentication information stored in advance in the license authentication device are not identical to each other, restricts use of the licensed function in the semiconductor manufacturing apparatus.

Abstract: A method of investigating a host computer uses an investigation system remote to the host computer. The investigation system includes at least one computer system. The method includes establishing a connection with the remote host computer, and sending at least one investigative module to the host computer. The at least one investigative module is configured to run on the host computer to perform at least one investigative function on the host computer. The at least one investigative module includes an agentless computer program configured to run on the host computer to perform at least one investigative function on the host computer to investigate the host computer to ascertain if the host computer has any data or process (hereinafter collectively referred to as data forms) with suspicious attributes.

Abstract: A system is provided for protecting services, such as cloud services, running on one or more server computers in a server rack. The system includes one or more rack processors. The one or more rack processors may receive sensor signals from one or more sensors of the server rack, the sensor signals capturing a physical environment of the server rack in a datacenter. The one or more rack processors may determine, based on the sensor signals, a security status of the server rack. The one or more rack processors may send the security status to the services on the one or more server computers within the server rack.

Abstract: A method is described of monitoring a service performed at a computing node. The computing node is one of a plurality of computing nodes in a distributed computing system. Each computing node is adapted to perform at least one service for clients. A monitoring process is adapted to monitor a service process performing the process. In the method, the monitoring process monitors the service process on performance of the service. The monitoring service then provides monitoring information to a monitoring process for another service process. A suitable computing node for performing the service is described, as is a coordinated monitoring service for supporting multiple monitoring services.

Abstract: Disclosed are an information processing method and a terminal device. The method comprises: acquiring first information, wherein the first information is information to be processed by a terminal device; calling an operation instruction in a calculation apparatus to calculate the first information so as to obtain second information; and outputting the second information. By means of the examples in the present disclosure, a calculation apparatus of a terminal device can be used to call an operation instruction to process first information, so as to output second information of a target desired by a user, thereby improving the information processing efficiency. The present technical solution has advantages of a fast computation speed and high efficiency.

Abstract: Artificial-intelligence computer-implemented processes and machines predict whether personal data may be present in structured software based on metadata field(s) contained therein. Natural language processing preprocesses input strings corresponding to the metadata field(s) into normalized input sequence(s). Individual characters in the sequence(s) are embedded into fixed-dimension vectors of real numbers. Bidirectional LSTM(s) or other machine-learning algorithm(s) are utilized to generate forward and backward contextualization(s). Neural network output(s) are provided based on element-wise averaging or feed forwarding based on the contextualization(s) in order to predict whether one or more value fields corresponding to the metadata field(s) may contain personal data.

Abstract: Embodiments prevent a reverse engineering attack on a machine learning (“ML”) model. Embodiments receive a first set of requests from a plurality of users to the ML model. Based on the first set of requests, embodiments identify a first user attempting to attack the ML model and, in response to the identifying, generate a shadow model that is similar to the ML model. Embodiments receive a second set of requests from the first user to the ML model and, in response to the second set of requests, generate an ML model set of responses and a shadow model set of responses. Embodiments compare the ML model set of responses with the shadow model set of responses and, based on the comparison, determine whether the first user is attempting the reverse engineering attack on the ML model.

Abstract: An exemplary system, method, and computer-accessible medium for denying a financial transaction(s) initiated by a customer(s) can include receiving information related to the financial transaction(s), determining a transaction impairment(s) associated with the customer(s), and denying the financial transaction(s) based on the transaction limitation. The transaction impairment(s) can be a particular time period, and the computer arrangement can be configured to deny the transaction(s) if the transaction(s) is initiated within the particular time period. The particular time period can be received from the user(s). The transaction impairment(s) can be an impairment of the customer(s). The transaction impairment(s) can include a cognitive impairment.

Abstract: In a method for changing a user's bank account information in merchant account databases a server receives a login request including a user identification and first user authentication information. The server further receives a request to change bank account information from a first bank account to a second bank account for merchant accounts of the user and network login information for the first bank account. The server accesses an account information database for the first bank account and downloads transaction information for merchant transactions involving the first bank account. The server identifies a set of merchant user accounts involved in the merchant transactions and receives account login information for a data site associated with a selected account. The server accesses the data site and changes a bank account identification stored therein from the first bank account to the second bank account.

Abstract: Embodiments described herein are generally directed to a transparent and adaptable mechanism for performing secure application communications through sidecars. In an example, a set of security features is discovered by a first sidecar of a first microservice of multiple microservices of an application. The set of security features are associated with a device of multiple devices of a set of one or more host systems on which the first microservice is running. Information regarding the set of discovered security features is made available to the other microservices by the first sidecar by sharing the information with a discovery service accessible to all of the microservices. A configuration of a communication channel through which a message is to be transmitted from a second microservice to the first microservice is determined by a second sidecar of the second microservice by issuing a request to the discovery service regarding the first microservice.

Abstract: The present disclosure involves systems, software, and computer implemented methods for read-only security protection. One example method includes receiving, from a client device, an on-change request to change an editable leading field from a first editable leading field value to a second editable leading field value. The editable leading field is referenced in an on-change rule. The on-change request includes a first security key and the client device is not allowed to modify the read-only target field. The on-change rule is executed to change the read-only target field from a first read-only target field value to a second read-only target field value based on the second editable leading field value. A second security key is generated based on at least the second read-only target field value and provided to the client device in response to the on-change request.

Abstract: A method and arrangement for providing data from an industrial automation arrangement to an external application operated in a data cloud and arranged outside a first data network, where an industrial Edge device processes raw data from the data source and makes the processed data available to the external application, the external application transmits a work order to the gateway component, the work order is checked by the gateway component, the raw data are captured and processed according to the work order, and the processed, abstracted and/or anonymized data are provided to the external application or a destination defined in the work order, such that an external user can automatically control access and hence use the data without accessing the underlying raw data because the level of data access is automatically negotiated and produced between the components involved (data source, gateway component) while taking into account requirements and rules.

Abstract: A system and method for intelligently detecting a duplicate address attack is described. The system and method comprise transferring a first address conflict check message; receiving a first address conflict check response message; performing intelligent Duplicate Address Detection (DAD) to determine if the duplicate address attack is valid; and if the duplicate address attack is valid, then reporting the duplicate address attack to a monitoring server. An intelligent switch that detects the DAD attack blocks further address conflict check response messages from the attacker's MAC address.

Abstract: Example methods and computer programs for performing drag and drop (DND) operations are disclosed. The method includes detecting, at an adapter component of a DND library, commencement of a DND operation on a selected draggable entity in a web browser, and communicating, by the adapter component, a message to a core component of the DND library indicating the commencement of the DND operation and including information about the selected draggable entity. The method further includes activating, by the core component, API event listeners to detect API events fired by a native DND API of the web browser, detecting the API events, and computing drop targets in the web browser for the selected draggable entity. The method further includes firing, by the core component, core events, detecting, by the adapter component, the core events, and performing operations by the adapter component, in response to the core events.

Abstract: In some aspects, a computing system can obfuscate sensitive data based on data aggregation. A sensitive database containing sensitive data records can be joined with a grouping database containing a group identifier. The joining can be performed through a linking key that links a sensitive data record with a grouping data record in the grouping database. A grouping identifier can thus be obtained for each of the sensitive data record. The sensitive data records can be aggregated into aggregation groups based on their respective values of the group identifier. Statistics are calculated for the sensitive attributes of the sensitive data records in each aggregation group and are included in the aggregated data as the obfuscated version of the sensitive data. The aggregated data can be utilized to serve data queries from entities authorized or unauthorized to access the sensitive data.

Abstract: Embodiments of the invention are directed to a system, method, or computer program product for an approach to securing information stored in a distributed network. The system allows for generating distributed identifiers for information entries, wherein the distributed identifiers mask the information entries using a hash function and the distributed identifiers are dispersed across distributed ledgers. The system also allows for originating nodes to access the information entries within the distributed identifiers, while permitting other nodes and domains to reference the distributed identifiers themselves instead of referencing the information entries.

Abstract: The present technology relates to an information processing device, an information processing method, and a program capable of allowing a user viewing a video of a remote location to be aware of presence of a person who is outside of an angle of field of a video in more appropriate form. An information processing device according to the present technology includes a processing unit, wherein, when, between a first space where a first imaging device and a first display device are installed and a second space where a second imaging device and a second display device are installed, a captured image captured by the imaging device in one of the spaces is displayed by the display device in the other space in real time, the processing unit performs processing to notify first users in the first space that second users are outside of an angle of field of the second imaging device when the second users who are at positions outside of the angle of field of the second imaging device is detected.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for managing operations of data processing systems to prevent implementation of malicious configurations. An example method includes constructing, by a data processing system, a validated change log and reconstructing known good configurations by replaying the validated configuration changes from the validated change log. The example method further includes making a determination, by the data processing system, regarding whether the source of a configuration change request has enough privilege to make the configuration request, and validating the request should the source have enough privilege.

Abstract: In one example embodiment, a server that is in communication with a network that includes a plurality of network elements obtains, from the network, a service request record that includes sensitive information related to at least one of the plurality of network elements. The server parses the service request record to determine that the service request record includes a sequence of characters that is repeated in the service request record, and tags the sequence of characters as a particular sensitive information type. Based on the tagging, the server identically replaces the sequence of characters so as to preserve an internal consistency of the service request record. After identically replacing the sequence of characters, the server publishes the service request record for analysis without revealing the sequence of characters.

Abstract: A privacy system includes a computing device configured to obtain user transactional data characterizing at least one transaction of a user on an ecommerce marketplace and to determine a privacy vulnerability score of the user by comparing the transactional data to a user vulnerability distribution. The computing device is also configured to send the privacy vulnerability score to a personalization engine.

Abstract: The disclosed method is concerned with a computer implemented method generating code for protecting sensitive data used by the program, by partitioning the program into a plurality of blocks of code, such that each code block in the program is registered using a code index in a code register created for the program. The code index for a given code block reflects current properties including the current location of the code block, at any given time. During execution of the program at runtime by the computing device, each code block of the program is moved from a first code location in a memory to a respective second code location in the memory, such that the code block is accessible from the second code location in the memory henceforth. The code index for the moved code block is updated to indicate updated current properties, such as the new location of the code block, i.e. the second code location, after moving the code block.

Abstract: In some examples, a first user device receives, from a second user device, a provisioning reference and an access token, the provisioning reference and the access token obtained by the second user device as part of a provisioning procedure performed by the second user device with a server. The first user device accesses the server using the provisioning reference and the access token to provision the first user device. The first user device receives, from the server, a network profile in response to the access token. The first user device connects to a network using the network profile.

Abstract: In an example aspect, a method includes receiving a plurality of login attempts from a network address over a length of time, querying log data to determine, for the network address, an average number of login failures of the plurality of login attempts over the length of time, calculating a failure rate metric based on the average number of login failures, determining that, the failure rate metric exceeds a reference number of login failures for the length of time, the reference number of login failures based on a historical average number of login failures for the length of time, and based in part on the determining, adding the network address to a system deny list.

Abstract: Methods and systems are disclosed herein for secure communication between computing devices. A mobile device may communicate with an untrusted device to cause the untrusted device to send information (e.g., encrypted information that the untrusted device is unable to decrypt) to a server using an Internet connection of the untrusted device. The mobile device may have limited or no access to the Internet. To prevent potential security risks associated with using a public or untrusted device, the mobile device may encrypt information stored on the mobile device (e.g., stored in a mobile application associated with the server), send it to the untrusted device (e.g., by displaying a QR code to a camera of the untrusted device), and the untrusted device may send the information to the server via a network connection of the untrusted device.

Abstract: An electronic device is disclosed.

Abstract: Techniques for polluting phishing campaign responses with content that includes fake sensitive information of a type that is being sought in phishing messages. Embodiments disclosed herein identify phishing messages that are designed to fraudulently obtain sensitive information. Rather than simply quarantining these phishing messages from users' accounts to prevent users from providing “real” sensitive information, embodiments disclosed herein analyze these phishing messages to determine what type(s) of information is being sought and then respond to these phishing messages with “fake” sensitive information of these type(s). For example, if a phishing message is seeking sensitive credit card and/or banking account information, some fake information of this type(s) may be generated and sent in response to the phishing message. In various implementations, a natural language processing (NLP) model may be used to analyze the phishing message and/or generate a response thereto.

Abstract: An improved technique for identifying a user's mobile device is discussed. A persistent and unified identifier that bridges mobile app to mobile web and to other web browser-compatible mediums is utilized. Using a unique verification identifier, the unified identifier is consistently verified, revived and distributed across application and browser mediums.

Abstract: Techniques and systems are described for monitoring remote identifiers transmitted by aerial devices and for detecting whether an aerial device is engaging in suspicious activities. A described technique can include determining, based on information collected from one or mom network components associated with a cellular network, that an aerial device is communicating via the cellular network and is operating in a geographical area; determining whether the aerial device corresponds to a remote identifier which is transmitted within the geographical area or reported for the geographical area; and providing an alarm notification based on the aerial device lacking a correspondence to a remote identifier which is transmitted within the geographical area or reported for the geographical area.