摘要:
Securing network devices by forecasting future security incidents for a network based on past security incidents. In one embodiment, a method may include constructing past inside-in security features for a network, constructing past outside-in security features for the network, and employing dynamic time warping to generate a similarity score for each security feature pair in the past inside-in security features, in the past outside-in security features, and between the past inside-in security features and the past outside-in security features. The method may further include generating a Coupled Gaussian Latent Variable (CGLV) model based on the similarity scores, forecasting future inside-in security features for the network using the CGLV model, and performing a security action on one or more network devices of the network based on the forecasted future inside-in security features for the network.
摘要:
A first graph comprises multiple nodes and edges. At least one successive summary graph is created, using the original graph as a predecessor. To create a second graph from a first, nodes of the first graph are grouped into a plurality of subsets, and each subset becomes a super-node. For each super-node, the edges of each corresponding node are replaced with one or more super-edges. Each super-edge represents a relationship between a pair of super-nodes. The nodes of the successor graph comprise the super-nodes and the edges of the successor graph comprise the super-edges. The steps are tracked for restoring each omitted edge of each predecessor graph. Based on a determined quantified value for the restoration of each omitted edge of each predecessor graph, customized summary graphs can be created for and presented to specific parties. Determined values can be, for example, monetary or based on trust levels.
摘要:
The disclosed computer-implemented method for deploying applications included in application containers may include (1) identifying an application container that includes an application and facilitates transferring the application to a deployment environment, (2) performing a reconnaissance analysis on the deployment environment by identifying one or more properties of the deployment environment, (3) determining, based at least in part on the reconnaissance analysis, that the deployment environment meets a predetermined threshold of requirements for securely executing the application, and then (4) transferring the application included in the application container to the deployment environment in response to determining that the deployment environment meets the predetermined threshold. Various other methods, systems, and computer-readable media are also disclosed.
摘要:
The disclosed computer-implemented method for generating user profiles may include (i) analyzing a data set of user profiles for services, (ii) detecting a measurement of obfuscation that was applied to a specific attribute across multiple user profiles for a specific service, (iii) applying the measurement of obfuscation to true data for a new user by fuzzing the true data to create a fuzzed value, and (iv) generating automatically a new user profile for the specific service by populating the specific attribute within the new user profile with the fuzzed value. Various other methods, systems, and computer-readable media are also disclosed.
摘要:
The disclosed computer-implemented method for fingerprinting devices may include (i) detecting that a new device has attempted to connect to a network gateway, (ii) attempting to fingerprint the new device as an instance of a known candidate device type by (a) transmitting to the new device, from a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type and (b) confirming, by the security application based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type, and (iii) performing a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type. Various other methods, systems, and computer-readable media are also disclosed.
摘要:
Securing a network device from a malicious embedded script hosted on a third-party domain. In one embodiment, a method may include detecting an attempt by a browser executing on a network device to load a webpage that embeds a reference to a script hosted on a third-party domain, compiling a list of domains that host webpages that embed references to the script hosted on the third-party domain, identifying reputation scores for the domains in the list of domains, generating a risk score for the script based on the identified reputation scores, determining that the script is malicious based on the generated risk score being above a threshold risk score, and, in response to determining that the script is malicious, performing a security action on the network device that secures the network device from the malicious script.
摘要:
The efficacy of security products and practices is quantified, based on monitored activities and conditions on multiple computers over time. A set of metrics is defined, specifying what criteria concerning computer security systems are to be quantified. Telemetry data concerning the defined metrics are collected from multiple computers, such as the customer base of a security product vendor. Security configuration information such as the deployments and settings of security systems on computing devices is monitored. This monitored information tracks what security products are deployed on which machines, and how these products are configured and used. Collected telemetry is correlated with monitored configuration information, enabling determination of what security product deployments and settings are in place when specific security incidents, operations and other types of actions occur. The determined correlations are amalgamated, amalgamated correlation information is analyzed, and the efficacy of specific security products and configurations is quantified.
摘要:
The disclosed computer-implemented method for identifying privacy leakage information may include (1) identifying, at the computing device, at least one informative word in a digital text and (2) performing a security action that identifies privacy leakage information, where the security action includes (A) determining, for at least one identified informative word, a type of privacy leakage and a respective confidence score indicating a probability the identified informative word causes the type of privacy leakage, (B) determining, using the respective confidence score, a combined confidence score for each respective element within a level of detail to display, and (C) displaying, on a display device, the combined confidence score for each respective element within the level of detail to display. Various other methods, systems, and computer-readable media are also disclosed.
摘要:
User-directed identity verification over a network. In one embodiment, a method may include receiving identity information of a user, storing the identity information, calculating a confidence score for the identity information that indicates a level of confidence that the identity information belongs to the user, receiving a request for the identity information of the user, or for confirmation of possession of the identity information of the user, to be sent to an organization, sending an authorization request for the user to authorize the organization to access the identity information or to receive the confirmation of possession of the identity information, receiving a grant of authorization for the organization to access the identity information or to receive the confirmation of possession of the identity information, sending the identity information, or the confirmation of possession of the identity information, and the confidence score for the identity information.