156 results about "Internet safety" patented technology

A computer-implemented method of updating a set of clusters representative of a classification of a text-based dataset into a plurality of different text types for use in a cyber security system is described as part of a classification pipeline. The method comprises receiving text data associated with an entity. The method further comprises generating one or more vector embeddings representative of the text data. The method further comprises using incremental learning to update the set of clusters based on the one or more vector embeddings.

The invention discloses an operation and maintenance data query analysis method of an internet data center, and relates to the technical field of operation and maintenance of the internet data center, and the method comprises the following steps: setting an initial detection threshold value for transverse flow detection in combination with existing service requirements, security policies and historical flow data, and distinguishing normal flow from suspicious flow; after an initial detection threshold value is set, comprehensive real-time data capture is carried out on all transverse flow in the IDC, and the obtained flow data is preprocessed. According to the method, through dynamic self-adaptive adjustment of the initial threshold, microscopic behavior characteristics are deeply analyzed, and the latent permeability coefficient is accurately calculated in combination with machine learning, so that intelligent identification of distributed small-flow abnormal transmission is realized. When a risk is detected, a threshold value is automatically regulated and controlled, and the perception capability for latent attacks is enhanced, so that the IDC can timely discover and respond to hidden threats, the sensitive information leakage risk is reduced, and the network security and stability are ensured.

This disclosure describes techniques and mechanisms to retroactively identifying, classifying, categorizing, and / or remediating campaigns by an email threat defense system. The described techniques may perform a time-series analysis on record data associated with emails and identify campaigns that have bypassed threat detection mechanisms. The described techniques may extract and correlate features of the record data in order to label and determine whether a campaign is malicious. Where the email campaign is malicious, remedial action(s) can occur. Accordingly, the described techniques may remediate false negatives in a network and improve network security.

Systems and methods for protecting electronic communications are described. A cyber security appliance may be configured to calculate a topic shift score for a communication by comparing a first lexical profile derived from the communication to a historical lexical profile established for an associated user. This analysis may be performed without using a large language model. The system may also parse communications to extract sensitive data and content from attachments, performing behavioral modeling on the extracted data. Based on the analysis, an autonomous response module may take a variety of mitigation actions. Furthermore, a security mailbox assistant module may perform a secondary, in-depth analysis on user-submitted communications and generate a deterministic report. For outbound communications, a data loss prevention architecture may divert messages for in-line analysis and may include a fail-safe timeout mechanism to ensure service continuity.

The present disclosure enhances domain lookalike detection by integrating a phishing risk assessment score into a multi-layered evaluation framework. The method systematically generates lookalike domains through genetic algorithms. Registered domains undergo advanced phishing analysis, incorporating domain and URL checks, technical infrastructure assessments, content inspections, and reputation-based intelligence to calculate a dynamic phishing score. A comprehensive risk score is then determined by merging phishing likelihood with business attributes, graphical / contextual similarity metrics, and domain registration patterns. Domains are categorized into predefined risk levels including phishing, registered, preventative, company-owned, or watchlist, with specific action recommendations provided for each category. The system generates prioritized alerts for high-risk domains, offering customers actionable intelligence to mitigate threats. By combining phishing-specific indicators with contextual evaluations, this solution improves detection accuracy, reduces false positives, and enables organizations to respond effectively to domain-based threats in real time, addressing evolving cybersecurity challenges.

The present disclosure provides techniques for AI model-based detection explainability. A processing device obtains computer-readable text and an indication of a false positive detection of malicious behavior with respect to the computer-readable text by a cybersecurity system, The processing device obtains, via an artificial intelligence (AI) model trained to generate language, a reason for the false positive detection of the malicious behavior. The processing device provides an indication of the reason for the false positive detection to a destination device.

The present invention provides a computer-implemented, machine learning method for generating safe text. A first portion of a trainable prompt is generated using negative influential features and positive influential features of a predicted condition. A second portion of the trainable prompt is trained to steer a pre-trained large language model (PLLM) to generate the safe text using at least the first portion of the trainable prompt. The method has applications including, but not limited to, use cases in medicine (e.g., digital medicine, personalized healthcare, AI-assisted drug or vaccine development, diagnosis or treatment, disease prediction, etc.), and cyber security.

Various embodiments include systems and methods to implement a security platform providing application-level cyberattack detection using multiple stages of classifiers. The security platform may use requests received by a web service to determine training data to train one or more machine learning models. The training data may be determined by instrumenting an application, such as a web service, with a first stage classifier to determine security events indicative of cyberattacks. The security platform may train machine learning models using aggregations of security events over various periods of time. The machine learning models may serve as second stage classifiers for the security platform.

Implemented within a cyber security appliance, a non-transitory storage medium configured to store software that, when executed, conducts data loss prevention evaluation of an email message to protect against exfiltration of sensitive data from an enterprise. The software includes an email protection module and high availability (HA) fail-open control logic. The email protection module includes email threat detection logic to analyze content associated with an outbound or lateral email message for potential data loss characteristics. The HA fail-open control logic is configured to (i) detect operational failure of the email protection module or intake disruption of email messages via an Application Programming Interface (API) providing access to the email protection module and (ii) redirect the email messages to HA cloud infrastructure pertaining to the enterprise for temporary storage and subsequent release of the redirected email messages upon detecting the operational failure or the intake disruption.

A cloud-based, external attack surface management (or EASM) service identifies computers, servers, smartphones, and other devices that are exposed to the public Internet. Any device that can connect to the public Internet may be vulnerable to cybersecurity attacks. The EASM service identifies a device exposed to the public Internet by comparing connection notifications to an address scan of the entire Internet. The connection notifications are sent by cybersecurity sensory agents installed at client devices. When a connection notification and the address scan of the entire Internet references a matching IP address and / or a matching port within a timeframe, the corresponding device is identified as being exposed to the public Internet.

A cybersecurity service protects endpoint devices from cybersecurity attacks. The cybersecurity service deploys cybersecurity attack feature vectors to agents in the field. The cybersecurity attack feature vectors are created in the cloud to efficiently describe observed groups of cybersecurity attacks. One method to assemble these is to generate clustering centroids for the observed groups. Each agent monitors its host according to the cybersecurity attack feature vectors. Each agent monitors its host's event behaviors and locally extracts an event behavior feature vector. The agent compares the cybersecurity attack feature vectors to the event behavior feature vector and, if similarity is determined, then the agent determines that the host's event behaviors are evidence of a cybersecurity attack. The agent may implement threat procedures, such as suspending / terminating the event behaviors and generating alerts. The agent remains a small, lightweight cybersecurity detector that does not need constant Internet access.

A cybersecurity data loss prevention service stops users from stealing, or exfiltrating, sensitive data. An endpoint cybersecurity agent coordinates the installation of a browser extension. The browser extension adds content scripts to a web browser that monitor for exfiltration events. The exfiltration events represent a user's browser inputs (such as cut-n-paste or drag-n-drop) that can be used to exfiltrate usernames, passwords, credit card numbers, company secrets, and any other sensitive data. When the browser extension detects any exfiltration event, the browser extension intercepts and synchronously blocks the exfiltration event from the web browser. Moreover, the browser extension sends a duplicate copy of the exfiltration event to the cybersecurity agent for evaluation. If the cybersecurity agent determines that the user's browser inputs should have been allowed, then the browser extension is instructed to trigger the duplicate copy. The web browser thus asynchronously processes the user's browser inputs, albeit slightly delayed.

A security feed normalizer aggregates and normalizes threat intelligence data across security feeds and extracts threat descriptors of cybersecurity threats from the aggregated / normalized data. A first large language model (LLM) determines whether each threat descriptor is informative, i.e., comprises sufficient information for reproducing / generating network traffic of the corresponding cybersecurity threat. For informative threat descriptors, a second LLM generates network traffic for the corresponding cybersecurity threats. The generated network traffic is used for subsequent remediation of corresponding threats.

Systems, methods, and computer-readable storage media for protecting data. One system includes a processing circuit configured to receive, identify, or collect cybersecurity data. The processing circuit can further be configured to generate metadata from the cybersecurity data based on characterizing the at least one cyber incident or claim. The processing circuit can further be configured to generate or update a protection parameter of one or more protection products of a protector based on the metadata. The processing circuits can further be configured to determine at least two cyber incidents correspond to a catastrophic incident based on the metadata. The processing circuits can further be configured to generate and provide a claim data package including the metadata and the catastrophic incident.

The present application discloses an information security detection method, apparatus, device and storage medium, the method comprising: continuously monitoring network equipment, capturing its network traffic data in real time, or obtaining network traffic data through active interaction. Then, feature extraction is performed on the network traffic data, and the protocol and device type of the network traffic data are identified based on the extracted traffic features; according to the identified protocol and / or device type, the detection script is scheduled and the execution result of the detection script is obtained. The execution results are integrated into the information database, and finally a comprehensive security assessment is performed. The present application dynamically adapts to changes in the OT environment through this method, thereby overcoming the limitations of network security measures based on static rules and policies.

A computer-implemented method of providing web security control integration in a system that utilizes at least one vendor proxy service for securely accessing the Internet. The method comprises receiving an instruction to update a web control policy or exception, generating a web control and exception update request, using a vendor agnostic API, wherein the web control and exception update request includes policy objects and content data, delivering the web control and exception data to a policy sync worker associated with a particular vendor proxy service, converting the web control and exception update request, via the policy sync worker into a format suited to the particular vendor proxy service, and delivering the converted web control and exception update request to the particular vendor proxy service associated with the policy sync worker to update the web control policy at the particular vendor proxy service.

Prediction of matches between CPEs and banners greatly improves computer functioning. Many web services have an unknown common platform enumeration (CPE). When the CPE is unknown, a computer system is unable to obtain cybersecurity flaws and software fixes for a software product or web service. A similarity between the CPE and a service banner, though, accurately predicts a match the CPE and the web service. CPEs, for example, may thus be identified for old, obsolete, and uncomment software products and services.

The invention relates to the technical field of network security, and discloses a webpage attack detection method and device and computer equipment. The method comprises the following steps: obtaining webpage code data to be detected and webpage log data corresponding to the webpage code data; extracting corresponding webpage code features from the webpage code data, and extracting corresponding webpage log features from the webpage log data; fusing the webpage code features and the webpage log features to obtain a fused feature vector; and inputting the fusion feature vector into a pre-trained webpage attack detection model, and outputting a webpage attack result through the webpage attack detection model. By implementing the technical scheme of the invention, the potential attack behavior in the webpage can be accurately detected and identified by fusing the webpage code characteristics and the webpage log characteristics and utilizing the pre-trained webpage attack detection model, and the webpage security protection capability is improved.

A cybersecurity appliance orchestrates registration and installation of a service worker by a web browser. The service worker intercepts and modifies requests sent by the web browser for a SaaS application with tenant / user information and / or DLP scanning results. The cybersecurity appliance orchestrates the service worker registration and installation by modifying responses to requests sent by the web browser. Once installed, the service worker determines the logged in user for the session and modifies outbound requests to attach the user information (e.g., account name / email address) thereto. The service worker can also or alternatively monitor for input of data into web pages, designate the data for data loss prevention (DLP) scanning, and modify outbound requests to attach the DLP scanning result. The cybersecurity appliance receives the user information and / or DLP scanning results with requests sent by the web browser since the user information and / or results were attached to the requests client-side.

A technique and method for detection and display of the cybersecurity risk context of a cloud environment initiates an inspection of cybersecurity objects within a cloud environment utilizing an inspection environment and stores information pertaining to discovered cybersecurity objects within the inspected cloud environment in a storage environment. The technique and method further generate a cybersecurity risk context for the inspected cloud environment based on the observations made concerning the cybersecurity objects contained within it. The technique and method further configure a web browser running on a client device to automatically display the generated cybersecurity risk context to a user, either through a web page overlay or through a toolbar plugin which has been installed in the web browser and configured to enable inspections of a cloud environment, once the user has navigated to a web page containing cybersecurity object identifiers.

The invention relates to the technical field of network security, in particular to a satellite internet traffic security protection method and system, and the method comprises the steps: obtaining an orbit characteristic parameter and an external disturbance parameter, and generating a first chaotic key sequence; the method comprises the following steps: constructing a signal tampering risk coefficient, an identity camouflage risk coefficient, a data integrity risk coefficient, a traffic behavior abnormity risk coefficient and a key leakage risk coefficient based on traffic state information collected by a ground terminal in real time, and further generating a traffic safety score; and adaptively selecting an encryption algorithm based on the traffic security score, and encrypting traffic data of the communication link by using a session key derived from the first chaotic key sequence. According to the invention, the communication traffic can be monitored and encrypted in real time, and the security of the satellite internet traffic data is ensured.

To provide a technique for presenting security risk information including information present in a Dark Web.SOLUTION: An information processing device is configured to: collect first security risk information by making a search in a Dark Web; collect second security risk information from a product having a cyber-security measure; collect third security risk information by making a search in a Surface Web by using a normal browser; and calculate a security risk score of an object person on the basis of the first security risk information, the second security risk information, and the third security risk information.SELECTED DRAWING: Figure 2B

Prediction of CPEs using banners greatly improves computer functioning. Many web services have an unknown common platform enumeration (CPE). When the CPE is unknown, a computer system is unable to obtain cybersecurity flaws and software fixes for a software product or web service. A CPE, though, is predicted by banner-prompting an AI / ML model using a web service banner. Once the CPE is predicted, vulnerabilities may be identified.

A technique and method for detection and display of the cybersecurity risk context of a cloud environment initiates an inspection of cybersecurity objects within a cloud environment utilizing an inspection environment and stores information pertaining to discovered cybersecurity objects within the inspected cloud environment in a storage environment. The technique and method further generate a cybersecurity risk context for the inspected cloud environment based on the observations made concerning the cybersecurity objects contained within it. The technique and method further configure a web browser running on a client device to automatically display the generated cybersecurity risk context to a user, either through a web page overlay or through a toolbar plugin which has been installed in the web browser and configured to enable inspections of a cloud environment, once the user has navigated to a web page containing cybersecurity object identifiers.

Techniques are disclosed relate to systems, methods, and non-transitory computer readable media for implementing a browser extension for cyber threat intelligence and response. One system to perform operations comprising: scanning, in a sandbox of a browser by a browser extension, at least part of a web page to produce a set of items of interests; transmitting the set of items of interests to a cloud-based enrichment and analysis of cybersecurity threat intelligence system to request information on the set of items; receiving a response from the cloud-based enrichment and analysis of cybersecurity threat intelligence system, the response including a scan result based on the transmitted set of items of interests, and the scan result including at least one of an indicator of compromise of the at least scanned part of the web page; and displaying the scan results including the at least one of an indicator of compromise.

A method actuating a device to perform hardware interfacing for hardware and / or OS IDs (referring to identification numbers and / or serial numbers) embedded or installed thereon, setting at least one of the IDs as DI (device identification) information, and selectively allowing the DI information to be transmitted out, for providing cybersecurity protection to the device itself and / or to an external control system / Internet system to be accessed, for establishing unique DI intercommunication with the external control system / Internet system, for replacing the conventional antivirus software, for providing OS piracy protection to an OS maker, for functioning as a unique private key in encrypting / decrypting outgoing commands and / or feedback signals, wherein the device may be any communication device, computer, control system, server, Internet system, smartphone, smartwatch, Autonomous Thing (AuT), Internet of Autonomous Thing (IoAT), Internet of Medical Thing (IoMT), AI device / machine, robot, android, autonomous car or unmanned aerial vehicle, drone or unmanned aircraft system.

A method for cybersecurity threat actor severity scoring, the method comprising: receiving public data that includes publicly available information obtained via monitoring of a data connection between one or more networks; parsing first data related to a cybersecurity event from the public data; associating the first data with a first threat actor; obtaining second data that includes information regarding one or more previous cybersecurity events associated with the first threat actor; determining a first threat actor score based on the first data and the second data; receiving a second threat actor score for a second threat actor; causing a graphical user interface to display a graphical depiction of a ranking of the first threat actor and the second threat actor based on the first threat actor score and the second threat actor score.

This disclosure provides a filtering mechanism to manage anomalous security data items. An anomalous security data item is provided to an analysis engine (such as a Large Language Model (LLM) or another form of generative language model) for interpretation. By curating a selection of one or more relevant non-anomalous security data items to provide with the anomalous data item, the filtering mechanism enables the analysis engine to perform with increased accuracy, without requiring the analyst engine to process large numbers of data items to ascertain their relevance to the anomalous security data item.

In some embodiments, a collaboration feature overlays a web application by receiving a network communication that was redirected from the web application by a suffix proxy. The collaboration feature supplements or replaces activity of the web application by maintaining per-user-account activity states, deriving a shared collaboration state from the activity states, and supplying the shared collaboration state to multiple user accounts. The collaboration feature is installed without modifying the web application. The collaboration feature provides user accounts with a collaboration capability, such as shared document editing, chat rooms, shared calendars, or shared private workspaces. Some collaboration features overlay multiple web applications, even from different vendors, and some collaboration features support posting collaboratively created content to a website even when some contributors to the content are not registered users of the website. Some collaboration features impose stricter or different cybersecurity than an underlying website.