Abstract:
Dynamic binary instrumentation (DBI) or dynamic binary translation (DBT) of an examined process can be postponed until a point of interest is reached. Portions of the examined process can be run in native mode until the point of interest is reached. Upon reaching the point of interest, DBI and/or DBT can be performed.
Abstract:
A password manager injects credentials into a web browser request. A user can browse to a form provided by a server that includes a password field. A plug-in requests a password for the field from a password manager. The actual password is not provided to the plug-in or the browser. The password manager provides a proxy password that is not the actual password for the field. A request interceptor in a separate process from the browser intercepts the completed request as it is sent to the server and replaces the proxy password with the actual password.
Abstract:
Systems and methods authenticate with application extensions. An application extension requests a token from a local application. The local application generates a token and either inserts the token into a protected storage accessible only by the application extension being run by the current user or returns the token back to the application extension after being confirmed by the legitimate user. The application extension uses the token to authenticate itself with the local application.
Abstract:
Systems and methods perform various optimizations of an LLCS algorithm for use in determining if a set of input sequences are similar to a query sequence. The optimizations include filtering out sequence from the set of input sequences where the estimated similarity of the sequence with the query sequence is below a threshold value. The remaining sequences can then be provided to an LLCS algorithm where the output of the LLCS algorithm is used in a similarity function to determine an actual similarity of an input sequence with a query sequence.
Abstract:
Systems and methods for rebooting a UEFI based system, for example from Microsoft Windows, to any UEFI application, include modifying boot configuration data by inserting a boot entry into the UEFI firmware boot manager to cause execution of a non-Windows UEFI application.
Abstract:
Malicious redirects in a redirect chain as a result of loading a web address are detected and blocked. A suspicion score is determined for a subject redirection domain based at least in part on the subject redirection domain's web address, and a rate of occurrence of the subject redirection domain in redirect chains leading to a malicious landing domain is calculated. Loading the subject redirection domain is blocked if the suspicion score exceeds a suspicion threshold or the rate of occurrence of the subject redirection domain exceeds a rate of occurrence threshold.
Abstract:
Systems and methods enable a notification based on determining a particular electronic message is associated with a particular cluster of electronic messages. A plurality of electronic messages from a first plurality of accounts directed to a second plurality of accounts over a network are received. The plurality of electronic messages are compared to determine a plurality of clusters of electronic messages. A particular electronic message is received from a first particular account directed to a second particular account. The particular electronic message is compared to the plurality of clusters of electronic messages to determine that the particular electronic message is associated with a particular cluster of the plurality of clusters of electronic messages. A notification is provided based on the determining that the particular electronic message is associated with the particular cluster of the plurality of clusters of electronic messages.
Abstract:
The behavior of browser extensions when installed and operating in a browser environment is monitored, such as by observing changes to a web page with and without the browser extensions installed. Document Object Model (DOM) changes to the web page, such as scripts that only run when an extension is installed, or other web content that changes as a result of differences in a web page with and without the browser extension installed are observed. These differences may be attributed to the browser extension, and the changed or added elements may be inspected for malicious content or behavior. If malicious behavior is found in the different content, the content and/or the browser extension may be flagged as malicious behavior and a signature used to identify the malicious browser extension in future applications.
Abstract:
A system and method are provided by which an electronic address associated with a user is monitored. Based on the monitoring, an electronic message is detected including a digital document. A cryptographic function is applied to the digital document to generate a hash which is rendered accessible at a network location. An identification of the network location of the hash is transmitted to a first computing system associated with the user.
Abstract:
A data processing method in the form of a data compression method is provided in which a plurality of integers are accessed. Each of the plurality of integers is split to generate a first plurality of numbers respectively paired with a second plurality of numbers. A first tuple is generated based on the first plurality of numbers. A second tuple is generated based on the second plurality of numbers and the first plurality of numbers. The first tuple and the second tuple are stored. A system and computer readable medium enabling the data processing method are further provided.