SYSTEM AND METHOD FOR PROTECTING DEVICES IN A COMPUTER ENVIRONMENT - Patent application

Abstract

The security system and method continuously monitors for known threats and proactively tracks information regarding emerging or unknown threats on devices and data. The present disclosure relates generally to a security system for a computing environment. More particularly, the disclosure relates to a security system for implementing a threat characterization and mitigation process in a computing environment, as substantially illustrated by and described in connection with at least one of the figures, as more fully described in the claims.

Description

[Background technology]

[0001] As technology becomes more integrated in everyday life, people may tend to rely on their devices and data (e.g., stored on the device and / or accessible online). For example, people may store confidential or personal information on the device and / or transmit, publish, and / or allow third parties access to their data without realizing the potential risks associated with storing such information on the device, which exposes the device and data to various threats. Thus, systems and / or methods for protecting data and devices are desirable. Summary of the Invention

[0002] The present disclosure relates generally to a security system for a computing environment. More particularly, the disclosure relates to a security system for implementing a threat characterization and mitigation process in a computing environment, as substantially illustrated by and described in connection with at least one of the figures, as more fully set forth in the claims.

[0003] These and other features, aspects, and advantages of the present disclosure will become better understood from the following detailed description when taken in conjunction with the accompanying drawings, in which like reference characters represent like parts throughout. [Brief description of the drawings]

[0004] [Figure 1] FIG. 1 is a block diagram of a system for protecting devices and data in a computing environment in accordance with an aspect of the present disclosure. [Figure 2A] 1 illustrates an example malicious attack according to an aspect of the present disclosure. [Figure 2B] 1 illustrates an example malicious attack according to an aspect of the present disclosure. [Figure 2C]1 illustrates an example malicious attack according to an aspect of the present disclosure. [Figure 3A] 1 illustrates an example of a ransomware problem and solution according to an aspect of the present disclosure. [Figure 3B] 1 illustrates an example of a ransomware problem and solution according to an aspect of the present disclosure. [Figure 3C] 1 illustrates an example of a ransomware problem and solution according to an aspect of the present disclosure. [Figure 3D] 1 illustrates an example of a ransomware problem and solution according to an aspect of the present disclosure. [Figure 3E] 1 illustrates an example of a ransomware problem and solution according to an aspect of the present disclosure. [Figure 3F] 1 illustrates an example of a ransomware problem and solution according to an aspect of the present disclosure. [Figure 3G] 1 illustrates an example of a ransomware problem and solution according to an aspect of the present disclosure. [Figure 3H] 1 illustrates an example of a ransomware problem and solution according to an aspect of the present disclosure. [Figure 4] 1 illustrates an example of a secure password storage problem, according to an aspect of the present disclosure. [Figure 5A] 1 illustrates an example of a system that utilizes blockchain and smart contracts in accordance with an aspect of the present disclosure. [Figure 5B] 1 illustrates an example of a system that utilizes blockchain and smart contracts in accordance with an aspect of the present disclosure. [Figure 5C] 1 illustrates an example of a system that utilizes blockchain and smart contracts in accordance with an aspect of the present disclosure. [Figure 5D] 1 illustrates an example of a system that utilizes blockchain and smart contracts in accordance with an aspect of the present disclosure. [Figure 6] 1 illustrates an example of performing security system verification and authentication according to an aspect of the present disclosure. [Figure 7A] 1 illustrates an example malicious attack according to an aspect of the present disclosure. [Figure 7B] 1 illustrates an example malicious attack according to an aspect of the present disclosure. [Figure 8] 1 illustrates an example of a trusted platform in accordance with an aspect of the present disclosure. [Figure 9A] 1 illustrates an exemplary quantum security application according to an aspect of the present disclosure. [Figure 9B] 1 illustrates an exemplary quantum security application according to an aspect of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0005] Disclosed exemplary systems and methods are provided for a security system to implement a threat characteristic recognition process in a computing environment. In particular, the disclosed exemplary security system is configured to monitor data traffic at one or more access points of the computing environment, provide the data as input for analysis to the security system, identify one or more characteristics of the data traffic, compare the one or more characteristics of the data traffic to characteristics stored in one or more databases corresponding to suspicious or malicious behavior, determine whether the characteristics are unauthorized activity or from an unauthorized actor based on the characteristics, and prevent access to the system or transmission of data if the one or more characteristics match the characteristics stored in the one or more databases.

[0006] Referring to FIG. 1, a system 100 for protecting devices and data in a computing environment is shown. The system 100 includes a security system 102, a plurality of client devices 104, and a plurality of data sources 106. The data sources 106 may be or include any device, component, application, etc. capable of delivering, transmitting, or providing data to the client devices 104. The data sources 106 may include cloud-based data sources 106A, server-based data sources 106B, and other client devices 106C. The data sources 106 may be communicatively coupled to the client devices 104 via a network (e.g., a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), a metropolitan area network (MAN), a cellular network (e.g., 4G, 5G, etc.), etc.). The security system 102 may be configured to intercept outbound and inbound data of the client devices 104 via a communication device 108. In some embodiments, the security system 102 may be embodied on a client device 104. In some embodiments, each of the client devices 104 may include a separate security system 102. In yet other embodiments, a group of client devices 104 may be members of a single security system 102. In some examples, the client devices 104 are Internet of Things (IoT) enabled devices.

[0007] A communication device 108 may be any device, component, sensor, antenna, or other element designed or implemented to provide or facilitate communication between two or more devices (such as a data source 106 and a client device 104). In some embodiments, each of the security system 102, the client device 104, and the data source 106 may include a respective communication device 108 such that each of the security system 102, the client device 104, and the data source 106 may be configured to communicate with one another.

[0008] The security system 102 may be embodied as or may include a processing circuit including a processor 110 and a memory 112. The processor 110 may be a general purpose single or multi-chip processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, or any conventional processor, controller, microcontroller, or state machine. The processor 110 may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. In some embodiments, certain processes and methods may be performed by circuitry specific to a given function.

[0009] The memory 112 (e.g., memory, memory unit, storage device) may include one or more devices (e.g., RAM, ROM, EPROM, EEPROM, optical disk storage, magnetic disk storage or other magnetic storage, flash memory, hard disk storage, or any other medium) for storing data and / or computer code for completing or facilitating the various processes, layers, and circuits described in this disclosure. The memory 112 may be or include volatile or non-volatile memory, and may include database components, object code components, script components, or any other type of information structure for supporting the various activities and information structures described in this disclosure. According to an exemplary embodiment, the memory 112 is communicatively coupled to the processor 110 via a processing circuit and includes computer code for executing (e.g., by the processing circuit or the processor 110) the processes described herein.

[0010] System 100 can be deployed in a variety of computing environments for a variety of industries including, for example, healthcare, finance, military or defense, avionics, quantum systems, as a list of non-limiting examples. For example, individuals or entities that traffic data using network devices can benefit from the protection for the data and devices provided by the disclosed security system. Additionally, system 100 can enable users of client devices 104 to operate client devices 104 "business as usual" while protecting the users from known, unknown, and / or potential or emerging threats in a variety of computing environments.

[0011] The memory 112 may store various engines or may be comprised of a system of circuits. The circuits may include hardware, memory, and / or other components configured or implemented to perform various functions. Various operations described herein may be performed on a computer system.

[0012] The memory 112 is shown to include a target engine 116. The target engine 116 may be any device, component, processor, script, or application designed or implemented to identify known or potential risks in a computing environment. The target engine 116 may be a manager of generated targets constructed to represent real users. The target engine 116 may manage a number of generated targets. Each of the generated targets may be created to depict or capture data intrusions, malicious or malicious actors, malware, or other entities / software / programs that may implicate or compromise a user's data, etc. (collectively referred to as "threats"). Each target may forward the threat to a safe diversion or testing environment (e.g., within the target engine 116 or outside the security system 102) to analyze the type of action the threat will perform (e.g., access financial data, offload sensitive files, copy emails or text messages, etc.). The target engine 116 may be designed or implemented to generate a report describing each action of the threat identified and corresponding to the managed target.

[0013] Memory 112 is shown to include an encryption engine 118. Encryption engine 118 may be any device, component, processor, script, or application designed or implemented to encrypt various data. Encryption engine 118 may be configured to encrypt data using various encryption protocols to protect data and / or devices within an environment.

[0014] The encryption engine 118 may be configured to encrypt, encode, or hash addresses associated with the client devices 104. In some embodiments, the encryption engine 118 may be configured to hash Bluetooth mac addresses, IP addresses, or other addresses associated with each of the client devices 104 associated with a registered user. The encryption engine 118 may be configured to assign, modify, or otherwise replace manufacturer information in the generated hash throughout the ownership of the client device 104 (e.g., unless the client device 104 changes ownership or is destroyed). The encryption engine 118 may be configured to detect missing encryption certificates and authentication of missing encryption certificates. Thus, the encryption engine 118 may be configured to monitor for appropriate encryption certificates of data, devices, or other aspects of the system 100 in general.

[0015] The memory 112 is shown to include an artificial intelligence (AI) model engine 120 for building AI or machine learning (ML) models based on the accessed data sets stored in the data sources 106.

[0016] Memory 112 is shown to include an algorithmic scanning engine 122. Algorithmic scanning engine 122 may be any device, component, processor, script, or application designed or implemented to monitor, adjust, modify, identify, or otherwise scan algorithms used by other devices. Algorithmic scanning engine 122 may be configured to scan algorithms as a method of authenticating algorithms, determining algorithm viability or defects, etc. In some embodiments, algorithmic scanning engine 122 may be configured to scan algorithms used to identify characteristics of malicious actors.

[0017] In some examples, the algorithmic scanning engine 122 may be configured to detect whether certain characteristics or markers of a user (e.g., social, physical, behavioral, etc.) are being used by a third party to access a secure network or device that the user has permission to access.

[0018] Memory 112 is shown to include a data manager engine 124. Data manager engine 124 may be any device, component, processor, script, or application designed or implemented to manage rights, access, privileges, or other aspects of data.

[0019] The data manager engine 124 can be configured to monitor, identify, detect, or otherwise check for over-sharing of data from the client device 104 across systems that come into contact with the client device 104. The data manager engine 124 can be configured to create a threat model for each client device 104, data, network, etc. For example, the threat model is specific to each client device, data, incident, entity, and / or user, as each is different, provides different functionality, is subject to different threats, and / or is accessible to different users and / or networks, necessarily presenting different threats to the various systems, devices, data, and / or users.

[0020] Memory 112 is shown to include a scanning engine 126. Scanning engine 126 may be any device, component, processor, script, or application designed or implemented to scan one or more devices, components, elements, etc. that may be communicatively coupled to or otherwise within range of client device 104. Scanning engine 126 may be configured to scan IoT sensors (e.g., sensors in smart cities, electric vehicle charging stations, ultrasonic sensors, sensors used to scan biometrics) for malware, outdated firmware, and software.

[0021] The memory 112 is shown to include a privacy engine 128. The privacy engine 128 may be any device, component, processor, script, or application designed or implemented to manage, handle, or process data access rights or other privacy rights of the client device 104. The privacy engine 128 may be configured to protect against Insecure Direct Object Reference (IDOR) vulnerabilities. IDOR vulnerabilities include a type of security flaw that is easily exploited by allowing an attacker to gain access to another user's account by simply changing the value of a parameter in a request. The privacy engine 128 may be configured to provide (or automatically change) a system-generic password, send the password to the end user, and / or update the user's client device 104 with the password. The privacy engine 128 may be configured to detect reverse engineering and commands by hackers to guess or determine the end user's password.

[0022] In some examples, the security system 102 operates as a quantum-enabled computer, network, and / or device. Aspects of quantum-secure protocols, quantum-enabled security applications, and / or quantum-enabled hardware are disclosed herein with reference to examples in Figures 8B and 9.

[0023] 2 through 9 provide example implementations that may be performed by the example security system 102 of FIG. 1 to identify malicious activation and / or actors and / or prevent access to unauthorized activity and / or actors in accordance with aspects of the present disclosure.

[0024] In some examples, consider the myriad application programming interfaces (APIs) that violate the endpoint-method permutation category. The OWASP API Security Top 10 is a useful starting point. The disclosed examples provide solutions to the problems caused by some of these security issues. For example, with regard to broken object-level authorization, are API users limited in the data they can access from the protected system? With regard to broken authentication, does the system use strong authentication to ensure that the user is legitimate? With regard to excessive data exposure, does the API return only the data that is needed (e.g., specifically requested) or does it return much more? With regard to lack of resources and / or rate limitations, does the API allow users to query in extensive, possibly unnecessary amounts (e.g., thousands, millions, etc.) and with regard to suspended functionality level allocations, do users have the authority to perform the operations they want or only those they need?

[0025] In some examples, the system maintains a regularly updated list of blocked entities (e.g., addresses, users, URLs, etc.) When a new user or device is introduced, the system scans the device and associated users, data, and / or software to ensure that each is legitimate and authorized to access system data.

[0026] In some instances, models are trained to recognize such entities. For example, unsupervised learning models can be created to analyze access logs and / or login attempts to find patterns of activity that may indicate suspicious behavior. Such problems fall into the category of so-called clustering problems. Clustering can group together algorithms and / or data that have similar characteristics.

[0027] In some examples, clustering algorithms create such groups without manual supervision in unsupervised learning examples, as opposed to classification of entities / data, which is a supervised learning task. Furthermore, clustering problems can be separated into two or more use cases, such as pattern recognition and / or anomaly detection. In pattern recognition problems, the goal of the underlying algorithm (e.g., using machine learning) is to discover groups that have similar characteristics. Some examples of pattern recognition algorithms are K-means and / or self-organizing maps. For example, in anomaly detection problems, the goal of the underlying algorithm is to identify natural patterns inherent in the data and then discover entities / data that deviate from expected and / or natural behavior.

[0028] In some examples, the system includes a container protection mechanism. For example, a container may be a form of virtualization that virtualizes an operating system (rather than system hardware). To detect suspicious entities, program execution, and / or network activity, an unsupervised anomaly detection model is built by using file access data, network traffic information, and / or process maps as input data. Two exemplary anomaly detection algorithms are Density-Based Spatial Clustering of Applications with Noise (DBSCAN) and Bayesian Gaussian Mixture Models. Artificial intelligence and systems security: limitations and poor implementation

[0029] Machine learning (ML) is, by its nature, subject to limitations and dependencies. Moreover, if implemented, less secure teams may make suboptimal (or incorrect) decisions when protecting against threats. ML is probabilistic. ML algorithms, especially deep learning algorithms, do not have or maintain domain knowledge. ML algorithms are configured to understand the underlying network topology, physics, and / or business logic. These algorithms only access data at input and output to identify relationships between data, without understanding the meaning attached to these relationships. As a result, it is possible for a trained model (created based on input data) to produce one or more results that violate the fundamental constraints of the environment.

[0030] When implementing AI, relevant subject matter knowledge allows for intentionally adding constraints to constructed algorithms to ensure that such algorithms adhere to rules and / or logic applicable to the environment in which they operate. Some ML algorithms lack explainability. Thus, when an AI model identifies a pattern or detects an anomaly in a dataset, the AI ​​model cannot explain the rationale behind the decision to group the data. In other words, without a supporting explanation, security teams are presented with a challenge as to how best to accept a recommendation or action.

[0031] Probabilistic systems determine the probability of an event occurring, but there remains some degree of error associated with the probability. As a result, there is a possibility of false positives and / or false negatives in some recommendations made by AI algorithms. Furthermore, ML relies on large datasets for training, and in some cases on the availability of labeled data. If such data, and / or quantification of the necessary data, is not available (e.g., outside the organization; not from a trusted data source) to train the machine learning model, the quality and / or validity of the results becomes questionable. Artificial Intelligence and System Security: Attacks on AI Implementations

[0032] Even when models and model implementations meet the desired criteria, the algorithms themselves may be vulnerable to attacks, as shown in Figures 2A-2C. These include well-known attacks or vulnerabilities (e.g., buffer overflows, denial of service, man-in-the-middle, phishing attacks, etc.), but also dynamic and innovative attacks against ML algorithms and models at their core. In particular, the creation of AI-based systems can allow various types of attacks to surface within the data environment, opening up new ways of exploitation and misuse by malicious actors.

[0033] Innovative attacks can come in the form of attacks against the confidentiality, integrity, and / or availability of an AI system (e.g., the underlying dataset, authentication of the ML / AI algorithm, authorizations required to use the algorithm, authentication of the algorithm's results, etc.). Attacks against the confidentiality of an AI system aim to uncover details of the algorithm being used. Once the internal or underlying information supporting the algorithm is known to an attacker, the attacker can use this information to plan more targeted attacks (e.g., inference attacks). Attackers can launch inference attacks during training, which would be considered attacks against the algorithm, and / or after the ML model has been deployed, which could be considered attacks against the ML model.

[0034] Regardless of the stage at which the attack is performed, an inference attack can take many different forms. For example, an inference attack can infer attributes or features used to train a model, and / or infer the actual data used to train a model, and / or infer the algorithm itself. Once an attacker knows the training data, attributes, and / or the algorithm itself, the attacker can extract sensitive data (e.g., related to the algorithm), as well as information to facilitate attacks against the integrity and / or availability of the system.

[0035] An attack on the integrity of an AI system that aims to change the reliability of its capabilities for the tasks it is designed to perform. For example, if the goal of a machine learning model is to classify users into malicious and genuine categories, an attack on integrity will change the model's behavior and prevent it from classifying users correctly. As mentioned before, this type of attack can occur during training or production. Such attacks manifest in two different forms. First, adversarial data inputs that an attacker inputs during testing or production. Second, data poisoning attacks by an attacker during training. An attacker creates data inputs that appear valid but are not actually valid. They are then presented to a classifier model in production. Such raw data inputs are also known as adversarial or mutated inputs.

[0036] One example is malware that goes undetected by malware scanners. Under normal circumstances, new data would be correctly classified as malware, as indicated by the smiling face on the graph. However, the adversarial input fools the classifier so that the same data input is classified as genuine. Of course, what is not obvious here is that the attacker spent a significant amount of time studying the model and understanding its behavior to be able to come up with such adversarial inputs. In the second form, the attacker poisons the training data during training or during the feedback loop after the model is deployed in production. This is also known as a data poisoning attack. Under normal circumstances, new data would be correctly classified as malware, but in a data poisoning attack, the model's behavior is modified so that the same input is classified as genuine input.

[0037] If such an attack is successful, the model is distorted and its stored knowledge about the boundaries between good and bad is altered. This alteration is permanent unless the model is retrained with clean and trusted training data. Attacks on the availability axis also take many different forms. Using a technique known as adversarial reprogramming, an attacker can take control of the model and make it perform tasks completely different from those it was designed to perform. This attack renders the model useless and unavailable to its end customers. If an AI system is poorly implemented and left unprotected, an attacker can overload the AI ​​system with data inputs that cause it to exceed its computational and memory resources.

[0038] Detection of an attacker or characteristics of an attacker may be performed when an attacker is gathering information about a client as a target or as the attacker gathers information about a client.

[0039] There are many tools that attackers use to automate common tasks such as scanning networks and discovering services. However, most of the tasks that require creativity and human intelligence remain manual. For example, attackers can bypass capture controls presented on a web page, while in another example, they can test and tweak the code of malware to make it completely undetectable. Such tasks cannot be automated by traditional programming. By applying machine learning, attackers can bypass capture controls or even crack passwords, or even utilize data and APIs provided by tools (e.g., VirusTotal) to test completely undetectable malware.

[0040] In some instances, the system is configured to detect adversarial data and / or mutation input, adversarial reprogramming, and / or data poisoning attacks. For example, the identity of the attacker behind a recent breach can be proven by investigating improper logging, distributed bots, proxy changes, and / or other techniques. When AI is used in an attack, it provides another degree of isolation between the attacker and the target. Thus, one or more tasks that an attacker would have to perform themselves can be performed by an ML model that can execute autonomously and make highly sophisticated decisions (and take actions accordingly) on behalf of the attacker.

[0041] In examples of emerging IoT technologies and / or systems, these may be vulnerable to Sybil attacks where an attacker manipulates multiple false identities to overwhelm and undermine the effectiveness of the system's defenses. In the presence of a Sybil attack, the IoT system may generate false reports, users may receive spam, and lose privacy. To mitigate the impact from such attacks, a protected system may automatically and / or anonymously tag the false identities (e.g., in a shunting environment). Once tagged, the false identities may be tracked by the system. This may allow the system to gain insight into the attacker's activities and specific targets, and in some examples, gain access to the attacker's system or environment. Based on this information, the system may generate one or more responses, including, as a non-limiting list of examples, preventing future access to the false identity and / or other identities with similar characteristics, and / or planting malware to execute on the attacker's system.

[0042] In some examples, the system is configured to recreate a client environment by integrating a solution and testing the solution within a test client environment, which may apply to one or more of the items to be protected, including device components, data, and / or software, as a non-limiting list of examples.

[0043] Examples of ransomware families can be seen in Figures 3A and 3B. The key ransomware stages to a system administrator's focus are shown in Figure 3C, described as Stage 1: Initial Access; Stage 2: Staging and Distribution; Stage 3: Encryption, DoS, and Extraction.

[0044] Phase 1 reflects the attacker's initial access characteristics shown in Figure 3D. Phase 2 reflects the attack staging and distribution characteristics shown in Figures 3E and 3F. These include discovery (TA007), lateral movement (TA008), persistence (TA003), and defense evasion (TA005). Phase 3 reflects the exfiltering, encryption, and impact characteristics of the attack shown in Figures 3G and 3H. These include impact (TA0040), exfiltering (TA0010), and network communication (TA0011).

[0045] In some examples, a data loss prevention (DLP) agent can be used. The DLP agent can be configured to look for signs of sensitive data crossing the trust boundary of the target organization. If the DLP agent suspects suspicious activity (e.g., based on the intersection of sensitive information or other activity), the system can block the transmission of that data (and / or other data) and / or notify a system administrator.

[0046] There are some challenges in using DLP agents. If the DLP threshold is set too high, the DLP agent may restrict genuine messages or even authorized traffic. To avoid impacting the reasonable use of the target system and / or device, administrators can make real-time threshold adjustments.

[0047] In particular, the creation and / or use of algorithms and / or agents within the security architecture must be able to operate independently of other algorithms and / or system protections and should not compromise data integrity. System protections should ideally use efficient and shorter keys (e.g., elliptic curve cryptography) and comprise a minimal amount of memory within the system.

[0048] Additionally, each algorithm may be tested and / or aborted in a test environment (eg, a shunt environment) before being used in an active system.

[0049] Agents and / or algorithms can also be used to detect false entropy (e.g., the amount of randomness present in the data). For example, if a "Q" is detected, it is likely to be followed by a "U" due to how English (and other) languages ​​are structured. If such rules are violated, especially on a large scale, this may indicate evidence of an attack. Harnessing Quantum for Enhanced Security

[0050] Quantum technology has the potential to provide an additional layer of digital security for several reasons. For example, as the number of qubits available in a quantum machine increases, the speed at which a quantum system can analyze information increases exponentially compared to classical computers. Calculations such as data analysis and / or artificial intelligence require large parallel processing power and can perform calculations in milliseconds that classical computers may take longer to complete.

[0051] In some examples, non-interactive zero-knowledge (NIZK) proofs provide powerful building blocks in the design of expressive cryptographic protocols such as anonymous credentials, anonymous polling systems, privacy-preserving digital currencies, and general multi-party computation. In some examples, NIZK is used to defend against malicious entities and / or actions and / or to enforce honest behavior.

[0052] This technology can be used in conjunction with quantum capabilities and / or AI models to accelerate defense against malicious activity to a proactive point. For example, the system can provide an offensive approach to protecting data, systems, and / or devices from attacks.

[0053] For example, these features can speed up the verification of authentic actions while checking (often simultaneously) related data for trends of spoofing. As an example, a malicious actor can masquerade as a legitimate user. To aid in the identification of such actors, hashes can be assigned to authorized and / or existing users, data, and / or devices that are authenticated by an authorized verification system that uses one or more cryptographic processes. The hashes can include cryptographic keys and / or be utilized with zero-knowledge concise non-interactive arguments of knowledge (zk-SNARKs), such as a way to prove something is true without revealing other information. This method can be used for multi-factor authentication / verification and access to data / devices while leveraging quantum for speed. This enhances the auditing capabilities of the system.

[0054] In some examples, the system leverages ML / DL sophistication to select when and which algorithms or techniques to use based on threat type, data size, data classification, environment, people, and / or identified devices. The most appropriate encryption algorithm is often the one that best protects the data and / or devices while still allowing access and transmission of those data.

[0055] The protection system should detect when large packet volumes of data are being sent to servers, source IP addresses, IoT devices, takeover of Hadoop clusters, attacks on databases and applications (e.g., ISPs / cloud providers), pulse waves, and / or outdated or insufficient security software installed on devices, as a non-limiting list of examples. Some of these attacks use bots, the use of which is configured to detect as disclosed herein. In some examples, pulse wave distributed denial of service (DDoS) is a new attack technique designed by sophisticated malicious parties to increase the power of botnets and target weaknesses in device-first / network-second hybrid mitigation solutions.

[0056] For example, a DDoS attack can appear as a number of non-malicious activities that may cause availability problems, such as a downed server or system, a large number of legitimate requests from legitimate users, or a downed cable. Traffic analysis is often required to determine what exactly is occurring. Using the systems and algorithms disclosed herein, a protection system can identify characteristics of actions and / or actors and determine whether they have the authority to navigate the system and / or access the data therein.

[0057] Masslogger is a spyware program written in .NET that focuses on stealing user credentials, primarily from browsers, but also from several popular messaging applications and email clients (e.g., edge overload attacks). Masslogger was released in April 2020 and sold on underground forums for a moderate price with few licensing options.

[0058] Data extraction is done through one or more of these channels: · FTP (plain text on default port 21), configuration includes user credentials. HTTP - using a PHP based control panel. SMTP - user must specify email address, server and authentication information to use it.

[0059] Here are some examples: Lazarus is a North Korean (NK) hacking group that has been active since 2009. The group is primarily associated with ransomware campaigns, cyber respinning, and attacks against cryptocurrency markets. ThreatNeedle is installed when the document is opened, allowing the attacker to control the infected machine. The main purpose of the backdoor is to extract sensitive information and send it to the attacker by moving laterally through the infected network. Spearphishing is a commonly used method to deliver ThreatNeedle to the target. The malicious Word documents are written to sound like emergency communications or updates regarding COVID-19.

[0060] To prevent fraudsters (also called synthetic identities) from accessing unregistered accounts (e.g., preventing the establishment of original data points such as phone numbers or other information), a protection system can apply the methods described herein to identify characteristics of an attack and conclude that the activity is suspicious.

[0061] In some instances, relationships between actors can be revealed. For example, because some of these malicious actors are part of common organizations, a process known as "cash cycling" may occur. This may involve money being circulated between fraudulent accounts to mimic legitimate financial activity. As a result, traditional security measures will likely consider these accounts to be completely authentic.

[0062] The disclosed protection system uses user behavior analysis with biometric authentication. For example, the system collects multiple (e.g., thousands or more) important parameters about how the surveyed user navigates the banking portal and fills out new account forms. These parameters provide essential information about whether the user has unusual fluidity and / or familiarity that raises suspicions that he is not a bona fide customer. As disclosed, this monitoring and analysis occurs in the background without impacting the user experience.

[0063] In some examples, the parameters monitored and analyzed include mobility patterns (e.g., how easily one navigates around the banking application); contextual knowledge latency (e.g., familiarity with the onboarding application); brain responses (e.g., short-term and long-term memory responses for filling in certain data such as long-term memory are used by legitimate customers to fill in details such as name and address, while more complex information such as ID card number may require short-term memory); customer type pattern comparison (e.g., comparing new user behavior patterns with other applicants from the same bank and with the operating methods of fraudsters in the bank).

[0064] To develop a robust Operational Technology (OT) cybersecurity roadmap and foundation, organizations with OT systems (e.g., from manufacturing process control to building control systems to security access systems) should embrace Operational Technology Systems Management (OTSM) concepts, similar to their ITSM practices, but within the native environment of operating systems. Achieving a mature level of OTSM is critical to improving the overall ROI from increasingly connected industrial systems and ensuring that the fundamental elements of OT cybersecurity are in place to protect critical infrastructure from targeted and untargeted attacks.

[0065] Using the disclosed methods and systems to gain insight into all hardware and software in a network ensures that vulnerabilities are quickly identified, including properly updated and configured systems to reduce the opportunity for cyber attacks, operationally efficient system updates to provide automation of critical operational tasks, consistent reporting and monitoring across IT and OT for simplified progress documentation, and effective advanced security controls built with adequate visibility and access to the underlying endpoint and network data.

[0066] The challenge of secure password storage also needs to be addressed. Entities struggle with password memorization in a variety of different ways, such as storing credentials in plain text (Facebook), using insecure hash functions (MyHeritage); and / or salting passwords improperly (MyFitnessPal), see, for example, FIG. 4. For example, misusing salting, not using a hash function, or using the wrong hash function. Secure credential storage is necessary to validate the password that the end user enters with the one that is stored.

[0067] In some instances, hash functions protect the integrity of data. For example, hash functions have useful properties for data integrity protection (e.g., via being one-way functions and / or collision resistance). They are commonly used for this purpose. Additionally, providing the hash with the data makes it easier to detect tampering or other problems.

[0068] In some instances, the application of multi-party computing can be used to securely apply multi-party computing whenever an individual's personal data needs to be kept private (e.g., elections, business partnerships, processing of personal data, etc.).

[0069] A pass the hash attack is an exploit where an attacker steals a hashed user credential and, without breaking it, reuses it to trick the authentication system into creating a new authentication session on the same network. Passing the hash is primarily a lateral movement technique. This means that the hacker is using the hash to extract additional information and credentials after they have already compromised the device. By moving laterally between devices and accounts, the attacker can use the hash to obtain the correct credentials and ultimately gain access to a higher-impact system, such as an administrator account on a domain controller. Most of the movements performed during a pass the hash attack are performed using remote software programs, such as malware.

[0070] To mitigate the threat of pass-hash attacks, organizations should ensure that their domain controllers are only accessible from trusted systems without Internet access. Two-factor authentication using tokens should also be implemented, as should the principle of least privilege. Organizations should closely monitor hosts and traffic within their network for suspicious activity.

[0071] There are several types of post-quantum cryptography that are being considered for security purposes. These include lattice-based, multivariate, hash-based, code-based, and supersingular elliptic curve homogeneity, as a non-limiting list of examples. For example, Grover's algorithm reduces the security of symmetric encryption systems and thus can be used to lure hackers / malicious actors into a circumvention environment, as provided herein.

[0072] Applications of post-quantum cryptography may be useful in long-lived systems such as SSL / TLS, blockchain technology, and / or embedded systems, as a list of non-limiting examples. The disclosed system implements post-quantum cryptography to protect blockchain information from being targeted and / or altered by hackers. Using a quantum key to overtake a quantum computer makes it harder for the quantum computer to solve the algorithm. In this example, more quantum bits make the system more secure.

[0073] In some examples, the system encrypts data via homomorphic encryption. Fully homomorphic systems allow for an unlimited number of additions and multiplications. Partially homomorphic systems allow for a specific number and type of operations. There are several different generations of fully homomorphic encryption algorithms. Some examples are based on post-quantum encryption algorithms (lattice-based cryptography). Bootstrapping is often used to convert partially homomorphic systems to FHE. Homomorphic encryption applications may be useful in applications where processing encrypted data is useful, such as sharing untrusted platforms and / or sensitive data.

[0074] Quantum error correction (QEC) is used in quantum computing to protect quantum information from errors due to decoherence and other quantum noises. A single qubit of information can be spread over a highly entangled state of several (physical) qubits.

[0075] Quantum error correction is a set of methods for protecting quantum information, i.e. quantum states, from unwanted environmental interactions (decoherence) and other forms of noise. Information is stored in a quantum error correcting code, a subspace within a larger Hilbert space. The code is designed such that the most common errors move the state into an error space orthogonal to the original code space while preserving the information in the state. It is possible to determine if an error has occurred by appropriate measurement and apply a single correction that moves the state back into the code space, without measuring (and thus disturbing) the protected state itself. In general, the codewords of quantum codes are entangled states. Codes that store information cannot protect against all possible errors, instead the codes are designed to correct a particular set of errors, which should be chosen to match the most likely type of noise. The error set is represented by a set of operators that can be multiplied with the codeword state. Quantum error correction is used to protect information in quantum communication (where quantum states pass through a noisy channel) and quantum computing (where quantum states are transformed through a series of imperfect computational steps in the presence of environmental decoherence to solve computational problems). In quantum computing, error correction is just one component of a fault-tolerant design.

[0076] The system uses security parameters such as Lamport signatures (e.g., in the case of Department of Defense (DoD) related systems, e.g., using radio protocols) with biometric authentication / verification to send and receive messages. There may be ways to circumvent such systems, e.g., using flakes or generating false photon streams. For example, if a fighter pilot were to respond to a radar signal by attempting to send back a false pattern, the pilot (e.g., instrument) would need to know what the original signal looked like, which means it would have to be observed, which is a form of measurement. Doing so could potentially alter the signal. Because of that possibility, the photon (e.g., signal) stream sent back in reply would no longer match the characteristics of the stream originally sent, and would be obvious to the receiver.

[0077] The protection system uses biometrics and authentication (similar to GPS, blockchain access, etc.) to send and receive one or more signals. This adds a layer of detection for eavesdropping and deception attacks. In some examples, this can be done machine-to-machine (e.g., in a networked industrial environment, via one or more nodes such as 5G cell towers). In some examples, additional protection is possible by using highly secure quantum systems, but modifying which quantum secure systems are being used to account for known conditions of possible interference or attack. This can include modulation of quantum states and / or housing devices / data in a blockchain with an access list of people, data, systems, and / or other devices with which the system may communicate.

[0078] The security of a Lamport signature is based on the security of a one-way hash function, the length of its output, and the quality of the input.

[0079] For a hash function that produces an n-bit message digest, ideal preimage and second preimage resistance for a single hash function call implies 2n operations and 2n bits of memory effort to find a collision under the classical computing model. According to Grover's algorithm, finding a preimage collision in one call of an ideal hash function is upper bounded by 0(2n / 2) operations under the quantum computing model. In Lamport signatures, the public key and each bit of the signature are based on a short message, which requires only a single call to the hash function.

[0080] For each private key yi,j and its corresponding zi,j public key pair, the length of the private key must be chosen such that a pre-image attack on the input length is not faster to execute than a pre-image attack on the output length. For example, in the degenerate case, if each private key yi,j element was only 16 bits long, it would be trivial to exhaustively search all 216 possible private key combinations in 215 operations to find a match with the output, regardless of the message digest length. Thus, a balanced system design ensures that both lengths are approximately equal.

[0081] Based on Grover's algorithm used in quantum secure systems, the lengths of the public key elements (zi,j), private key elements (yi,j), and signature elements (si,j) must be at least twice the security class of the system. That is, an 80-bit secure system uses an element length of 160 bits or more; a 128-bit secure system uses an element length of 256 bits or more; etc.

[0082] However, caution is required as the above ideal work estimates assume an ideal (perfect) hash function and are limited to attacks that target only a single preimage at a time. In traditional computational models, it is known that if 23n / 5 preimages are explored, the full cost per preimage decreases from 2n / 2 to 22n / 5. Choosing the optimal element size given the collection of multiple message digests is an open problem. The choice of a larger element size and a stronger hash function, such as 512-bit elements and SHA-512, ensures a larger security margin to manage these unknowns.

[0083] With reference to Figures 5A-5D, utilizing blockchain provides certain advantages to security systems. For example, smart contracts are computer codes that exist on the blockchain to help exchange something of value in a transparent and conflict-free manner while avoiding an intermediary or the services of an intermediary. The code provides the rules, penalties and conditions of the contract. The contract executes its logic automatically. When certain conditions are met, the contract executes them automatically. Smart contracts are used to enable secure communication or to restrict security transactions.

[0084] Blockchains can be used to record transactions, which can be of any type, for example, transactions can be associated with identity management operations, log files, software distribution operations, etc., and / or can use smart contracts to enforce security controls.

[0085] Blockchain can also be used for trusted IoT communications. For example, implementing blockchain technology to store and manage cryptographic credentials for IoT devices can store public keys on a ledger and / or store all key or certificate operations on the chain.

[0086] Reputation-based scoring of each key or certificate, as well as layers of fraud detection and risk-adaptive controls for keys and certificates, can be stored in the chain. For example, if many peers report problems, the reputation of a particular device may be lowered, meaning that even if a valid certificate for that device exists, it may be less trustworthy.

[0087] Blockchain can also be used for semi-autonomous machine-to-machine (or system-to-system or network-to-network) transactions. For example, a key enabler of IoT technology is the ability of machines to work together semi-autonomously towards the achievement of a specific goal. Blockchain can act as a security enabler for these autonomous transactions using smart contract capabilities. Edge IoT devices can then be configured with APIs to interact with smart contracts to form agreements with peer devices and / or services.

[0088] Blockchain also enables IoT configuration and update control. For example, the ledger can host IoT properties (e.g., verified last firmware version and configuration details). During bootstrap, an IoT device can request a transaction node to get its configuration from the ledger, or the ledger can host hash values ​​of the latest configuration files for each IoT device.

[0089] Blockchains can also enable secure firmware distribution. For example, blockchains can enable secure firmware updates. For example, a vendor can write a hash of a firmware file to the blockchain, and the device can verify that hash upon securely loading the firmware.

[0090] In some examples, biometric authentication may be required to access an IoT device, for example to support authentication to an IoT device without a back-end connection. The technician downloads a signed policy file from a back-office FIDO server and performs FIDO authentication over a local protocol (NFC / Bluetooth) to the IoT device which validates the signed policy. The signed policy allows the technician to authenticate to the IoT device using a specified biometric (e.g., fingerprint, retina scan, voice recognition, etc.). In some examples, authentication to the IoT device can be performed without a device connection.

[0091] A FIDO server can be used to sign the challenge issued to the IoT device. An administrator uses a mobile device with biometric capabilities as a conduit through which the administrator can authenticate to the IoT device using the biometric. The IoT device can act as a proxy to the FIDO server when a connection to the FIDO server is available, otherwise the device acts as a cryptographic validation agent to validate the signed policy file provided by the administrator during authentication.

[0092] In some examples, the system can draft a security CONOPS document or protocol. This can include documenting various approaches to security. The document can incorporate authentication and access control capabilities for device management. It can identify monitoring and compliance approaches, define system misuse cases, and / or explain how IoT monitoring can be integrated with existing SIEM systems.

[0093] This document can define a unique approach to forensics, identify best practices, map business functions to IoT systems, understand the impact if systems are taken offline, and document emergency POCs for each system. Such protocols can be integrated into existing security systems; for example, IoT systems can often leverage existing enterprise security systems, including directory systems. Remote access to these devices can be locked down, and common or unique misuse cases associated with IoT devices can be considered and such use can be proactively mitigated.

[0094] By integrating these protocols into existing security systems, entities can use their existing asset management systems to manage all of the many IoT devices in their inventory while maintaining control of the approved configuration of each device.

[0095] When integrating such protocols into an existing security system, you need to consider: will your system sit on the same network as the rest; what ports and protocols need to be open through your perimeter defenses; key management for IoT devices; wireless access control capabilities; using Wi-Fi for communication; and integration with existing wireless access control systems.

[0096] When adopting a new security system, the impacts from the following should be considered: wireless sensor networks running on Zigbee; introducing gateways; and providing security for IoT devices.

[0097] When evaluating new security systems, consideration should be given to: use of IPv6; updating data center architectures; placement of analytical systems; and revisiting security architectures to protect previously isolated assets in the cloud or other locations.

[0098] Updates to user security training may include security awareness training for users on: risks associated with IoT devices; policies for bringing personal IoT devices into the organization; privacy protection requirements for data collected by IoT devices; procedures for interfacing with corporate IoT devices (where permissible). Updates to administrator security training shall include: policies for acceptable IoT use within the organization; a detailed technical overview of new IoT assets and sensitive data supported by new IoT systems; procedures for bringing new IoT devices online; procedures for monitoring the security posture of IoT devices; and procedures for updating incident response plans.

[0099] Security awareness training for users should take into account: the risks associated with IoT devices; policies regarding bringing personal IoT devices into the organization; privacy protection requirements regarding data collected by IoT devices; and procedures for interfacing (where permissible) with corporate IoT devices.

[0100] In some examples, information derived from user behavior analysis can be used to guide or supplement cybersecurity awareness training for authorized users.

[0101] In some instances, the system can complement and / or replace CyberWorkforce via a SaaS implementation. For example, secure configuration can include securely configuring devices to restrict the loading of unauthorized data such as firmware; rejecting unauthorized ports and protocols; accepting trusted connections to a whitelist; and / or connecting devices (e.g., Bluetooth-enabled devices, etc.).

[0102] Administrator security training updates may also include determining and enforcing policies for acceptable IoT use within the organization; a detailed technical overview of new IoT assets and sensitive data supported by new IoT systems; procedures for bringing new IoT devices online; procedures for monitoring the security posture of IoT devices; and / or updating incident response plans.

[0103] New models for IoT collaboration can be implemented using network or cloud-based solutions, for example, see FIG. 6. Security engineers must be prepared to assist IoT system designers looking for new connectivity and collaboration layers for devices. The layers span across organizations, industries, or even industrial boundaries. Edge devices communicate with the cloud using web sockets, RESTful web services, or MQTT. Protocols are also supported through custom APIs or by tunneling them through gateways. Data entering the cloud can be batches or continuous streams. CSPs often have different interfaces (AWS Kinesis for ingesting different types of data from the edge). Data, e.g. messaging, video, images. Services support processing based on events, messaging, search, notifications. Some exemplary computing services allow users to specify some types of data or actions to take. There are more advanced services such as machine learning, voice processing, and other data analytics. A survey of IoT threats, such as from a cloud perspective, is described with reference to FIG. 7A.

[0104] In some examples, the system can use certificates to help secure IoT devices and systems, as disclosed with reference to FIG. 7B. For example, IoT devices / protocols often offer options for credentials (e.g., pre-shared symmetric keys, key pairs, certificates). Many of the IoT protocols offer built-in certificate-based device-to-device authentication, such as: CoAP, DDS; Other protocols, such as MQTT (and HTTP), rely on TLS as the underlying security mechanism. TLS supports two-way certificate-based authentication (IoT devices / services).

[0105] For the evaluation of safety impacts on a system given the intended use of a product, it is useful to consider whether there is anything harmful that could happen if the product ceases to function as intended or fails to function altogether. For example, a vehicle, a drone, a commercial airliner, a large autonomous ship, a pacemaker, or a pump. Also, if there are safety-critical services or other products that depend on the functionality of this product. Safety devices such as redundancy can mitigate or prevent potential harm (e.g., from device failure). This is useful for safety-critical devices to prevent an attacker from disabling built-in safety features.

[0106] The results of the safety impact assessment provide insight into malfunctions and fraudulent activity that may result from a compromise of the device. Output from the safety impact assessment can feed into a larger risk management strategy for the system.

[0107] One or more processes and / or agreements should be identified and implemented to ensure that the IoT system is secured. For example, processes need to be established across the enterprise to maintain a secure posture within the IoT system. This should include establishing management functions, policy management frameworks, and / or configuration control boards (CCBs). In some instances, it may be useful to establish and enforce agreements with third parties, including service level agreements (SLAs), privacy agreements / data sharing, and / or information sharing (e.g., threat intelligence).

[0108] Governance standards for IoT systems should be established, including identifying who is responsible for the safe and secure operation of IoT systems (e.g., senior executives of the organization), which budgets should be evaluated to ensure adequate availability of cybersecurity controls, and establishing governance principles that flow seamlessly across all IoT systems, focusing on privacy protection and defense against threats (both physical and cyber).

[0109] A useful policy management framework may include: analysis of industry or market relevant regulations that feed into the requirements for the IoT system; privacy requirements; incident reporting requirements; security testing requirements; compliance requirements; establishment of a configuration control board (CCB); review and evaluation of proposed configuration changes; directing updates to configuration based on revised or new regulations; establishing touch points to review required configurations on a regular basis (e.g., annually); and establishing and enforcing agreements with third parties (e.g., data sharing agreements - what data can be shared? What processes must be in place to protect the privacy of the data? When must data be destroyed? Can data be forwarded onward?).

[0110] Exemplary agreements with third-party organizations may cover elements of cloud integration, availability (SLA), security mechanisms (e.g., reporting requirements - event type, timeliness of reporting), incident management support (e.g., what assistance is needed during an incident), IoT product acquisition, and / or patch updates (e.g., type, schedule, access, etc.).

[0111] In some examples, the system can perform safety impact assessments by using the system's predictive analytics and ML models. For example, the system can detect recorded videos to mitigate vulnerabilities in the ongoing authentication / verification process. Vulnerabilities are added to other user behavior analytics capabilities, and the system compares baseline behavior to real-time behavior.

[0112] As disclosed herein, updates can be run / tested in a separate, independently controlled test environment (e.g., a shunt environment) before being sent as an update to the client. This includes code, patches, data, and / or algorithms (e.g., to avoid SolarWind type violations). This includes testing and / or observing third party patches, data, and / or updates.

[0113] The system can further defend against so-called typosquat attacks. Typosquat, also known as URL hijacking, decoy sites, or fake URLs, is a form of social engineering where a malicious actor masquerades as a legitimate domain for malicious purposes such as fraud or spreading malware. This can be accomplished by the detection and prevention methods disclosed herein, which include identifying attacker characteristics and / or blocking access to requests that have such characteristics.

[0114] A protection system can be applied to a hardware system to ensure that each connected and / or accessed device is an authorized device (or "trusted platform"), as shown in FIG. 8A.

[0115] The system can be used for Ransomware as a Service (RaaS) detection. In some disclosed examples, an AI agent can be sent to one or more environments (e.g., the dark web) to extract information about potential attacks. For example, the AI ​​agent can pose as a buyer of malicious code, bring the explicit code back to a testing environment, and find ways to completely explode, destroy, and / or terminate the code so that it cannot be used. In some examples, this is accomplished by creating code or other research measures to terminate the code, which can include identifying characteristics of the malicious code to enhance detection and / or mitigation efforts.

[0116] An example of a vulnerability in a Domain Name System (DNS) implementation is DNSpooq, which can be manifested as a set of seven significant Common Vulnerabilities and Exposures (CVEs) affecting the DNS forwarder dnsmasq, which is used by major networking vendors to cache the results of DNS requests.

[0117] A vulnerability in DNS implementations concerns a protocol feature called "message compression". Because DNS response packets often contain the same domain name or parts of it several times, RFC1035 ("Domain Names-Implementation and Specification") specifies a compression mechanism in its section 4.1.4 ("Message compression") to reduce the size of DNS messages. This type of encoding is used not only by DNS resolvers, but also by multicast DNS (mDNS), DHCP clients as specified in RFC3397 ("Dynamic Host Configuration Protocol (DHCP) Domain Search Option"), and IPv6 Router Advertisements as specified in RFC8106 ("IPv6 Router Advertisement Option for DNS Configuration"). Also, some protocols do not officially support compression, but many implementations still support it, due to code reuse or a particular understanding of the specifications.

[0118] If an attacker crafts a DNS response packet with an invalid compression pointer offset combination that allows them to write arbitrary data to sensitive parts of the device's memory, the attacker can inject data into the code. The second vulnerability, CVE2020-15795, allows an attacker to construct meaningful code to be injected by abusing very large domain name records in the malicious packet. Finally, an attacker can use CVE-2021-25667 to bypass DNS query response matching in order to deliver the malicious packet to the target.

[0119] An appropriate response can be implemented via the detection and prevention methods disclosed herein, including identifying attacker characteristics and / or blocking access to requests having such characteristics.

[0120] Some exemplary implementations utilize quantum to decompose the data, as shown in the example of FIG. 8B.

[0121] Although the method and / or system have been described with reference to specific embodiments, those skilled in the art will recognize that various modifications can be made and equivalents substituted without departing from the scope of the method and / or system. In addition, many modifications can be made to adapt a particular situation or material to the teachings of the disclosure without departing from the scope of the disclosure. For example, blocks and / or components of the disclosed examples may be combined, divided, rearranged, and / or otherwise modified. Thus, the method and / or system is not limited to the particular embodiments disclosed. Instead, the method and / or system includes all embodiments falling within the scope of the appended claims, both literally and under the doctrine of equivalents.

Claims

1. 1. A security system for implementing a threat characteristic recognition process in a computing environment, comprising: monitoring data traffic at one or more access points of the computing environment; providing data to said security system as input for analysis; identifying one or more characteristics of the data traffic; comparing the one or more characteristics of the data traffic with characteristics stored in one or more databases corresponding to suspicious or malicious activity; determining whether the characteristic is an unauthorized action or is from an unauthorized actor based on the characteristic; Preventing access to the system or transmission of the data if the one or more characteristics match the characteristics stored in the one or more databases; A security system configured to:

2. The security system of claim 1 , wherein the one or more characteristics include a pattern or anomaly compared to authentic behavior.

3. 2. The security system of claim 1, wherein the one or more characteristics include a number of login attempts exceeding a threshold number, a number of failed login attempts exceeding a threshold number, a request for unauthorized data from an authorized user, or a request for an amount of data exceeding a threshold amount.

4. The security system of claim 1 , wherein the results of the comparison of the one or more databases are cross-referenced to determine whether the one or more characteristics are a match with any of the databases.

5. 10. The security system of claim 1, wherein a match generates a positive identification report, the positive identification report including details from each of the databases that contributed to the positive identification.

6. The security system of claim 1 , wherein the method is configured to execute on a client device or via one or more networked computing assets.

7. 10. The security system of claim 1, wherein the method further comprises updating one of the one or more databases when the comparison of the data results in a match.

8. The security system of claim 1 , wherein the security system is connected to one or more Internet of Things (IoT) enabled devices, including cameras or client devices.

9. The security system of claim 1 , wherein the security system operates on a quantum enabled device or system.

10. The security system of claim 1 , wherein the security system develops a machine learning algorithm to identify the one or more characteristics.

Images