Способ блокировки сетевых соединений

Изобретение относится к вычислительной технике. Технический результат заключается в обеспечении блокировки сетевых соединений на основании сравнения цифровых сертификатов в результате осуществления способа блокировки сетевых соединений в режиме реального времени. Способ блокировки сетевых соединений в режиме реального времени, в котором перехватывают сертификат в момент установки защищенного соединения; определяют похожесть перехваченного сертификата на запрещенные сертификаты, где похожим признается сертификат, который может быть отображен на множество запрещенных сертификатов, при этом отображение проверяется посредством применения правила, сформированного из общих признаков запрещенных сертификатов, полученных в результате кластеризации множества запрещенных сертификатов; блокируют устанавливаемое соединение, если перехваченный сертификат в результате определения похожести признается похожим на запрещенные сертификаты. 2 н. и 4 з.п. ф-лы, 7 ил.

СИСТЕМЫ И СПОСОБЫ ДИНАМИЧЕСКОГО АГРЕГИРОВАНИЯ ПОКАЗАТЕЛЕЙ ДЛЯ ОБНАРУЖЕНИЯ СЕТЕВОГО МОШЕННИЧЕСТВА

Изобретение относится к способам и системам для обнаружения сетевого мошенничества. Технический результат заключается в повышении эффективности обнаружения сетевого мошенничества. Предложен способ, в котором используют компьютерную систему для определения агрегированного показателя мошенничества целевого документа в виде комбинации первого показателя мошенничества и второго показателя мошенничества целевого документа, причем упомянутые первый и второй показатели мошенничества определяют в соответствии с отличающимися процедурами оценки мошенничества; используют компьютерную систему для определения третьего показателя мошенничества целевого документа; в ответ на определение упомянутого третьего показателя мошенничества используют компьютерную систему для изменения агрегированного показателя мошенничества на первую величину, определяемую согласно произведению упомянутого третьего показателя мошенничества и разности между агрегированным показателем и максимально допустимым агрегированным показателем ...

АВТОМАТИЧЕСКОЕ ОБНАРУЖЕНИЕ И РЕАГИРОВАНИЕ НА УЯЗВИМОСТИ

Изобретение относится к области обнаружения и реагирования на уязвимости. Техническим результатом является повышение эффективности обнаружения и нейтрализации уязвимостей. Согласно различным вариантам осуществления обнаруживают уязвимости безопасности и, в качестве реакции, могут изменить подвергающуюся их воздействию программу так, чтобы даже если вредоносный код исполняется, целостность данной программы будет сохранена и поддержана. В по меньшей мере некоторых вариантах осуществления компонент локального автоматического обнаружения уязвимостей и реагирования на уязвимости (AVD/R) исполняется на пользовательской локальной машине для обнаружения и нейтрализации возможных уязвимостей посредством использования средства защиты; и компонент удаленного автоматического обнаружения уязвимостей и реагирования на уязвимости (AVD/R) исполняется, чтобы сообщать о зафиксированных уязвимостях так, чтобы одно или более средств защиты можно было доставить и применить локально для нейтрализации зафиксированных ...

Способ автоматизированного тестирования программно-аппаратных систем и комплексов

Изобретение относится к области вычислительной техники. Технический результат заключается в обеспечении обнаружения уязвимых программных и аппаратных средств в процессе автоматизированного тестирования системы программных и аппаратных средств. Технический результат достигается за счет способа тестирования системы программных и аппаратных средств системой автоматизированного проектирования, в котором модули системы автоматизированного проектирования: получают формализованное описание архитектуры тестируемой системы и строят модель использования включающую: вид использования системы, элемент системы, способ реализации данного вида использования; получают из базы угроз формализованное описание известных угроз для систем, сходных с тестируемой и строят модель угроз того же вида, что и модель использования включающая: вид угрозы, элемент системы, способ реализации угрозы, вектор воздействия на систему; сравнивают модель угроз с моделью использования; обнаруживают средства тестируемой системы ...

Способ и система для оценки влияния исследуемого ПО на доступность систем промышленной автоматизации

Изобретение относится к способу и системе оценки влияния исследуемого программного обеспечения (ПО) на функциональность определенной конфигурации системы промышленной автоматизации (СПА). Технический результат заключается в определении влияния исследуемого программного обеспечения (ПО) на функциональность определенной конфигурации системы промышленной автоматизации. В способе производят с помощью средства отбора ПО отбор образцов исследуемого ПО, которое потенциально способно нанести ущерб функционированию СПА; проводят тестирование с помощью испытательного стенда воздействия по крайней мере одного отобранного образца исследуемого ПО на определенную конфигурацию СПА для выявления влияния выбранных образцов ПО на определенную конфигурацию СПА, где выявление влияния проводят при помощи средства мониторинга доступности и включают по меньшей мере причины и события, приводящие к нарушению работы конкретной конфигурации СПА, при этом конкретная конфигурация СПА включает по меньшей мере компоненты ...

СИСТЕМА И СПОСОБ ОЦЕНКИ РЕСУРСОВ В КОМПЬЮТЕРНОЙ СЕТИ С ПОЗИЦИИ ОБЪЕКТОВ ИНТЕРЕСА

Изобретение относится к области оценки компьютерных ресурсов компьютерной сети по объектам интереса с учетом требований к компьютерным системам, на которых располагаются компьютерные ресурсы, и требований к объектам интереса как к содержимому компьютерных ресурсов. Технический результат настоящего изобретения заключается в обеспечении возможности определения компьютерных ресурсов в рамках компьютерной сети, подходящих для целей, заданных выбранными требованиями. Способ определения компьютерных ресурсов в компьютерной сети содержит этапы, на которых: а) формируют с помощью средства инвентаризации компьютерной сети список компьютерных ресурсов, находящихся на компьютерных системах, удовлетворяющих требованиям к компьютерным системам; где компьютерная сеть состоит, по меньшей мере, из двух компьютерных систем; где требования к компьютерным системам хранятся в базе данных требований к компьютерным системам средства хранения требований; б) собирают с помощью средства инвентаризации компьютерной ...

УСТРОЙСТВО ВЫЯВЛЕНИЯ УЯЗВИМОСТЕЙ

Полезная модель относится к компьютерной технике, а более конкретно к области информационной безопасности, и предназначена для выявления уязвимостей в исходных текстах компьютерных программ.Техническим результатом, на достижение которого направлено заявляемое устройство, является снижение вероятности ложных срабатываний при обнаружении уязвимостей в компьютерных системах, что в свою очередь приводит к повышению точности выявления уязвимостей в компьютерных системах.Устройство выявления уязвимостей, содержащее модуль построения абстрактного синтаксического дерева, соединенный с модулем построения графа вызовов, который соединен с модулем проведения локального анализа функций, соединенным с модулем проверки на наличие дефекта и блок памяти, соединенный с модулями построения абстрактного синтаксического дерева, построения графа вызовов, проведения локального анализа функций и модулем проверки на наличие уязвимости, модуль проверки на наличие уязвимости, осуществляет сравнение признаков данных функций и операций с признаками, указанными в правилах для проверки на уязвимости, которые хранятся в блоке памяти, при этом совпадение этих признаков свидетельствует о наличии уязвимости. 1 ил. РОССИЙСКАЯ ФЕДЕРАЦИЯ (19) RU (11) (13) 168 346 U1 (51) МПК G06F 21/57 (2013.01) ФЕДЕРАЛЬНАЯ СЛУЖБА ПО ИНТЕЛЛЕКТУАЛЬНОЙ СОБСТВЕННОСТИ (12) ФОРМУЛА ПОЛЕЗНОЙ МОДЕЛИ К ПАТЕНТУ РОССИЙСКОЙ ФЕДЕРАЦИИ (21)(22) Заявка: 2016125045, 23.06.2016 (24) Дата начала отсчета срока действия патента: 23.06.2016 30.01.2017 (73) Патентообладатель(и): Закрытое Акционерное Общество "Научно-Производственное Объединение "Эшелон" (RU) Приоритет(ы): (22) Дата подачи заявки: 23.06.2016 Адрес для переписки: 107023, Москва, ул. Электрозаводская, 24, стр. 1, ЗАО "НПО "Эшелон", Цирлову Валентину Леонидовичу 1 6 8 3 4 6 R U (57) Формула полезной модели Устройство выявления уязвимостей, содержащее модуль построения абстрактного синтаксического дерева, соединенный с модулем построения графа вызовов, который соединен с ...

Система и способ определения уровня доверия файла

Изобретение относится к области компьютерной безопасности. Технический результат заключается в улучшении качества классификации доверенного программного обеспечения. Согласно варианту реализации используется способ определения уровня доверия файлов, в котором: выбирают имена файлов, расположенных по заданным путям у заданной доли устройств пользователей; формируют группу файлов из двух файлов со стабильными именами и являющимися компонентами одного приложения; для каждой группы определяют разработчика, с использованием закрытого ключа которого подписан файл упомянутой группы; для каждой группы определяют уровень доверия для всех файлов группы на основании вердиктов сторонних сервисов, присвоенных файлам упомянутой группы, а также на основании вердиктов сторонних сервисов, присвоенных файлу на устройствах пользователей, не принадлежащему упомянутой группе и подписанному закрытым ключом доминирующего разработчика, или на основании вердиктов сторонних сервисов, присвоенных файлам другой группы ...

СПОСОБ ПОВЫШЕНИЯ ЭФФЕКТИВНОСТИ РАБОТЫ АППАРАТНОГО УСКОРЕНИЯ ЭМУЛЯЦИИ ПРИЛОЖЕНИЙ

Изобретение относится к области эмуляции приложений. Техническим результатом является повышение эффективности работы аппаратного ускорения эмуляции приложений. Согласно одному из вариантов реализации предлагается способ ускорения эмуляции процесса, запущенного из исполняемого файла, включающий следующие этапы: эмулируют исполнение файла по инструкциям; при выполнении условия запуска аппаратного ускорителя эмулятора переводят процесс эмуляции исполнения файла в аппаратный ускоритель; производят исполнение файла по инструкциям с помощью аппаратного ускорителя до вызова исключения или вызова API-функции; переводят процесс эмуляции исполнения файла обратно в эмулятор; оценивают эффективность исполнения файла по инструкциям с помощью аппаратного ускорителя; меняют условия запуска аппаратного ускорителя эмулятора в зависимости от полученного значения эффективности; повторяют приведенные этапы не менее двух раз. 2 з.п. ф-лы, 5 ил.

МЕТОД ОТНЕСЕНИЯ РАНЕЕ НЕИЗВЕСТНОГО ФАЙЛА К КОЛЛЕКЦИИ ФАЙЛОВ В ЗАВИСИМОСТИ ОТ СТЕПЕНИ СХОЖЕСТИ

Изобретение относится к системам и методам сравнения файлов и более конкретно к отнесению данного файла к определенной коллекции в зависимости от степени схожести. Технический результат заключается в ускорении процесса детектирования программ антивирусной индустрии. Рассчитывают результаты расчета степени схожести между ними, достигается за счет преобразования файлов в массивы данных, содержащих значения хэш-функций от текстовых строк файла, без учета присутствия строк-исключений, что позволяет сократить время на сравнение строк, не несущих функциональной нагрузки. Вычисляют степень схожести строк из полученного файла со строками из коллекции фалов. На основании уровня схожести судят о принадлежности файла к какой-либо из коллекций. 3 н. и 14 з.п ф-лы, 11 ил.

СПОСОБ ОПРЕДЕЛЕНИЯ ПОТЕНЦИАЛЬНЫХ УГРОЗ БЕЗОПАСНОСТИ ИНФОРМАЦИИ НА ОСНОВЕ СВЕДЕНИЙ ОБ УЯЗВИМОСТЯХ ПРОГРАММНОГО ОБЕСПЕЧЕНИЯ

Изобретение относится к вычислительной технике. Технический результат заключается в снижении сложности и трудоемкости процесса формирования перечня потенциальных угроз. Способ определения потенциальных угроз безопасности информации на основе сведений об уязвимостях программного обеспечения содержит этапы, на которых получают перечень известных уязвимостей и угроз; создают искусственные нейронные сети (ИНС) для определения возможности реализации угроз; получают набор обучающих выборок уязвимостей для каждой ИНС; производят обучение созданных ИНС с использованием полученных выборок; получают перечень выявленных в ИС уязвимостей; подают признаки каждой выявленной в ИС уязвимости на вход каждой созданной ИНС и получают ранжированный по вероятности реализации перечень потенциальных угроз. 2 ил.

Система и способ фильтрации запрошенной пользователем информации

Изобретение относится к средствам фильтрации запрошенной пользователем информации. Технический результат настоящего изобретения заключается в безопасном предоставлении пользователю запрошенной им информации за счет фильтрации упомянутой информации на основании анализа вероятности получения несанкционированного доступа к указанной информации. Собирают данные с мобильного устройства, где в качестве данных выступают, по меньшей мере, данные о характеристиках звука вокруг мобильного устройства, данные об иных мобильных устройствах, находящихся рядом с мобильным устройством, данные о геолокации мобильного устройства, данные о состоянии беспроводных сетей, в том числе о характеристиках сигнала беспроводных сетей. Формируют на основании собранных данных параметры модели окружающего пространства мобильного устройства, представляющей собой совокупность данных. Определяют с помощью модели окружающего пространства с использованием сформированных параметров степень информационной безопасности окружающего ...

СПОСОБ ПОСТРОЕНИЯ СИСТЕМЫ ОБНАРУЖЕНИЯ ИНЦИДЕНТОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ В АВТОМАТИЗИРОВАННЫХ СИСТЕМАХ УПРАВЛЕНИЯ

Изобретение относится к защите информации. Технический результат заключается в сокращении времени обнаружения инцидента информационной безопасности. Способ построения системы обнаружения инцидентов информационной безопасности (ИБ) для автоматизированных систем управления, включающий в себя этапы построения и формирования подсистем обнаружения инцидентов ИБ, в ходе которого, используя метод морфологического анализа, формируют подсистемы планирования уровня, координации, управления средствами защиты информации и сбора данных о состоянии объекта, этап оценки реализации функций в вариантах построения системы обнаружения инцидентов информационной безопасности АСУ, в ходе которого производят оценку соответствия реализованных функций в каждом варианте построения системы из множества вариантов, сформированного на предыдущем этапе, этап оценки стоимости и вариантов построения системы защиты от компьютерных атак, этап оценки оптимального варианта построения системы обнаружения инцидентов информационной ...

Система и способ открытия файлов, созданных уязвимыми приложениями

... 1. Способ открытия файлов, созданных уязвимыми приложениями, в котором:а) определяют создание файла приложением-источником;б) определяют по меньшей мере одну уязвимость в приложении-источнике;в) определяют параметры созданного файла;г) определяют политику доступа к файлу в зависимости от информации, определенной на этапах б), в);д) перехватывают открытие созданного файла приложением-потребителем, при этом упомянутое приложение-потребитель предназначено для открытия файла;е) определяют политику запуска приложения-потребителя;ж) определяют по меньшей мере одну политику открытия файла приложением-потребителем в зависимости от: политики доступа к файлу; политики запуска приложения-потребителя;з) выполняют открытие созданного файла приложением-потребителем в соответствии с политикой открытия.2. Способ по п. 1, в котором создание файла приложением определяют по меньшей мере одним из способов:с помощью драйвер-фильтра файловой системы;с помощью перехвата вызовов системного API;с использованием ...

Способ и система для оценки влияния исследуемого ПО на доступность систем промышленной автоматизации

Система и способ поэтапного повышения информационной безопасности элементов технологической системы

Изобретение относится к области информационной безопасности технологической системы. Технический результат настоящего изобретения заключается в повышении информационной безопасности элементов технологической системы. Система повышения информационной безопасности технологической системы содержит средство сбора, средство защиты, выполненное с возможностью запуска гипервизора в защищенном окружении существующих операционных систем и приложений элементов технологической системы. 2 н. и 2 з.п. ф-лы, 5 ил.

Система и способ обеспечения безопасного изменения конфигурации систем

Изобретение относится к вычислительной технике. Технический результат заключается в обеспечении заданного уровня безопасности системы в случае изменения конфигурации. Способ модификации параметров компьютерной системы содержит получение через агента взаимодействия запроса на изменение параметров компьютерной системы от инициатора; формирование транзакции с изменениями, которые необходимо внести в параметры согласно запросу от инициатора, и актуальной копии состояния всех параметров, содержащихся в хранилище параметров, которые предают средству реконфигурирования; произведение с помощью средства реконфигурирования оценки влияния внесенных изменений на уровень безопасности компьютерной системы путем проверки корректности внесенных изменений в транзакцию и согласованности изменяемых параметров с остальными параметрами, содержащимися в хранилище параметров, применяя политику безопасности к полученной актуальной копии состояния всех параметров и к информации об изменениях, содержащихся в транзакции ...

Система и способ формирования журнала при исполнении файла с уязвимостями в виртуальной машине

Изобретение относится к способу формирования журнала при исполнении файла с уязвимостями. Технический результат заключается в повышении точности выявления наличия в виртуальной машине вредоносного приложения, эксплуатирующего уязвимости безопасного файла. Способ содержит этапы, на которых: выявляют средством перехвата во время исполнения потока процесса, созданного при открытии упомянутого файла, событие, при возникновении которого срабатывает триггер, описывающий сопутствующие событию условия, связанные с попыткой эксплуатации вредоносным приложением уязвимости упомянутого файла; анализируют средством перехвата стек процесса, созданного при открытии упомянутого файла, выявляют последовательность вызовов функций, предшествующих событию, на котором сработал триггер; анализируют средством перехвата выявленную последовательность вызовов функций на предмет выполнения сопутствующих условий триггера; в случае выполнения сопутствующих условий триггера, связанных с попыткой эксплуатации вредоносным ...

СТРАТЕГИИ ИЗУЧЕНИЯ УЯЗВИМОСТЕЙ И ПОДАВЛЕНИЯ УЯЗВИМОСТЕЙ, ВЫЗЫВАЕМЫХ ПОСРЕДСТВОМ ЗАХВАТА УЧЕТНЫХ ДАННЫХ

... 1. Способ масштабируемого изучения состояния безопасности окружения обработки данных, причем окружение обработки данных включает в себя совокупность компонентов, при этом способ содержит этапы, на которых ! принимают данные доступа, которые отражают предысторию доступа, по меньшей мере, к одному компоненту в окружении обработки данных, по меньшей мере, посредством одного осуществляющего доступ объекта (602); ! принимают данные прав, которые отражают права, которыми обладает, по меньшей мере, один управомоченный на доступ объект, при этом права дают право управомоченному на доступ объекту осуществлять доступ к нескольким компонентам в окружении обработки данных (602); ! изучают состояние безопасности окружения обработки данных на основе данных доступа и данных прав, при этом состояние безопасности идентифицирует степень, в которой получение прав на первую часть окружения обработки данных может компрометировать вторую часть окружения обработки данных (604); и ! предоставляют вывод, который ...

ВЗАИМНАЯ АУТЕНТИФИКАЦИЯ ПРОГРАММНЫХ УРОВНЕЙ

СИСТЕМА И СПОСОБ ДЛЯ ПРИМЕНЕНИЯ ИНДИКАТОРА РЕПУТАЦИИ ДЛЯ ОБЛЕГЧЕНИЯ СКАНИРОВАНИЯ НА НАЛИЧИЕ ВРЕДОНОСНЫХ ПРОГРАММ

СЛУЖБА РЕПУТАЦИИ КОНТЕНТА НА ОСНОВЕ ДЕКЛАРАЦИИ

... 1. Способ идентификации декларации контента для элемента данных, содержащий этапы, на которых:(a) с помощью по меньшей мере одного компьютера в первом сетевом узле сравнивают определенный цифровой отпечаток элемента данных с сохраненным цифровым отпечатком, ассоциированным с по меньшей мере одной декларацией контента; и(b) если этот определенный цифровой отпечаток совпадает с сохраненным цифровым отпечатком, то определяют с помощью по меньшей мере одного компьютера в первом сетевом узле, что эта по меньшей мере одна декларация контента ассоциирована с упомянутым определенным цифровым отпечатком элемента данных.2. Способ по п.1, дополнительно содержащий этапы, на которых:(c) до выполнения этапов (а) и (b), с помощью по меньшей мере одного компьютера в первом сетевом узле принимают упомянутую по меньшей мере одну декларацию контента и ассоциированный с ней цифровой отпечаток от по меньшей мере одного компьютера во втором сетевом узле; и(d) до выполнения этапов (а) и (b), сохраняют на постоянной ...

СИСТЕМА И СПОСОБ РАСПРЕДЕЛЕНИЯ ЗАДАЧ АНТИВИРУСНОЙ ПРОВЕРКИ МЕЖДУ ВИРТУАЛЬНЫМИ МАШИНАМИ В ВИРТУАЛЬНОЙ СЕТИ

... 1. Система распределения задачи антивирусной проверки между компонентами антивирусной системы, размещенными в виртуальной среде, которая содержит:а) по крайней мере, две виртуальные машины, развернутые на одном компьютерном устройстве, которое содержит монитор виртуальных машин,б) антивирусный агент, установленный на первой виртуальной машине и предназначенный для:- выявления событий, происходящих в операционной системе данной виртуальной машины,- определения объекта и типа объекта, относящихся к выявленному событию,- определения необходимости проведения антивирусной проверки в соответствии с определенной информацией,- передачи указанной выше информации средству управления,- выполнения задачи антивирусной проверки объектов с помощью назначенных методов антивирусной проверки согласно полученному запросу от средства управления;в) антивирусное средство, установленное на второй виртуальной машине и предназначенное для выполнения задачи антивирусной проверки, и взаимодействующее со средством ...

СИСТЕМА И СПОСОБ ВРЕМЕННОЙ ЗАЩИТЫ ОПЕРАЦИОННОЙ СИСТЕМЫ ПРОГРАММНО-АППАРАТНЫХ УСТРОЙСТВ ОТ ПРИЛОЖЕНИЙ, СОДЕРЖАЩИХ УЯЗВИМОСТИ

... 1. Способ защиты от угроз, использующих уязвимости в приложениях, который включает в себя этапы, на которых:а) определяют принадлежность приложения к категории приложений, содержащих, по крайней мере, одну уязвимость у приложения;б) в случае принадлежности указанного приложения к категории приложений, содержащих, по крайней мере, одну уязвимость, производят анализ указанного приложения с целью создания списка типичных действий, совершающихся во время исполнения указанного приложения, на основе анализа информации обо всех совершаемых действиях приложением,- где типичными действиями являются действия, которые совершаются приложением при выполнении команд и инструкций, заложенных при создании производителем указанного приложения, и которые направлены на выполнение задачи, соответствующей данному приложению;в) создают, по крайней мере, одно правило ограничения для контроля указанного приложения, где правило ограничения блокирует действия, совершающиеся во время работы приложения и не являющиеся ...

Система и способ ограничения работы доверенных приложений при наличии подозрительных приложений

... 1. Система ограничения работы доверенных приложений при наличии подозрительных приложений, которая содержит:а) средство анализа, предназначенное для:- определения среди установленных приложений доверенного приложения, в результате работы которого формируется защищаемая информация,- сбора данных об установленных приложениях,- передачи данных о доверенном приложении и установленных приложениях средству определения;б) средство определения, предназначенное для обнаружения по крайней мере одного подозрительного приложения, которое имеет возможность несанкционированно обработать защищаемую информацию, на основании данных о доверенном приложении и установленных приложениях с применением правил обнаружения подозрительных приложений, передачи результата обнаружения средству ограничения;в) базу данных правил, предназначенную для хранения правил обнаружения подозрительных приложений;г) средство блокирования, предназначенное для ограничения работы доверенного приложения, в результате работы которого ...

СПОСОБ ОПРЕДЕЛЕНИЯ АКТУАЛЬНЫХ УГРОЗ БЕЗОПАСНОСТИ ИНФОРМАЦИИ ОБЪЕКТОВ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ

Изобретение относится к вычислительной технике. Технический результат заключается в обеспечении возможности определения актуальных угроз безопасности информации объектов информационной инфраструктуры. Указанный результат достигается за счет того, что получают перечень известных уязвимостей и угроз; создают искусственные нейронные сети (ИНС); получают набор обучающих выборок уязвимостей для ИНС; производят обучение ИНС; получают перечень выявленных уязвимостей; подают признаки выявленных уязвимостей на входы ИНС и получают на выходе вероятность реализации соответствующей угрозы; формируют базу данных признаков использования информационных технологий; получают перечень известных угроз; создают ИНС для определения возможности реализации угроз; получают набор обучающих выборок признаков использования групп информационных технологий для ИНС; производят обучение ИНС; получают перечень групп информационных технологий; подают признаки каждой группы информационных технологий на вход ИНС и получают ...

TESTEN VON SPEICHERSCHUTZ-HARDWARE IN EINER UMGEBUNG EINER SICHEREN VIRTUELLEN MASCHINE

Ein Verfahren zum Testen von Speicherschutz-Hardware umfasst ein Empfangen, von einer nicht vertrauenswürdigen Entität, die auf einem Host-Server ausgeführt wird, einer Anforderung zum Zuteilen einer sicheren Entität. Durch eine sichere Schnittstellensteuerung des Host-Servers wird bestimmt, ob sich der Host-Server in einem sicheren Hilfs- (AS) Debug-Modus zum Testen einer AS-Entität befindet. Auf Grundlage des Bestimmens, dass sich der Host-Server in dem AS-Debug-Modus befindet, wird ein sicherer Gast-Entitätszustand aus einem Zustandsdeskriptor für die sichere Entität in einen AS-Entitätszustand in Hardware geladen, um nach Zuteilung der sicheren Entität Zugriffe auf Seiten in einem Arbeitsspeicher zu testen, die als „Sicher“ und als der AS-Entität zugehörig registriert sind.

Wirksames Testen einer Berechtigungslogik von WEB-Komponenten, die eine Berechtigung auf der Grundlage von Ansprüchen einsetzen

Es kann ein Berechtigungsalgorithmus einer Software-Komponente ausgewählt werden. Eine statische Codeanalyse kann durchgeführt werden, um eine bedingte Anweisung innerhalb eines Algorithmus der Software-Komponente zu ermitteln. Das Ergebnis der bedingten Anweisung kann auf der Grundlage einer Eingabe und eines Kriteriums mithilfe einer dynamischen Codeanalyse ermittelt werden. Bei der Eingabe kann es sich um einen Wert handeln, der einem Anspruchssatz einer Berechtigungsprüfungsrichtlinie auf der Grundlage von Ansprüchen zugehörig ist. Bei dem Kriterium kann es sich um ein Berechtigungsprüfungskriterium handeln, das innerhalb des Algorithmus angegeben ist. In Reaktion auf das Ergebnis kann ein Ausführungspfad ermittelt werden, der dem Ergebnis zugehörig ist, und ein Codeabdeckungskriterium kann für die bedingte Anweisung erfüllt werden.

Manipulationssicherheit eines Endgeräts

Bei einem auf einem portablen Datenträger (20) auszuführenden Verfahren zum Prüfen der Manipulationssicherheit eines Endgeräts (10), mit dem der Datenträger (20) als eine Transaktionseinheit (23) verbunden ist, welche dem Endgerät (10) eine sichere Datenkommunikationsverbindung (26) zur Übertragung von Transaktionsdaten (R2) an einen Transaktionsserver (17) bereitstellen kann, meldet sich der Datenträger (20) gegenüber dem Endgerät (10) gleichzeitig als Eingabeeinheit (22) an und prüft, ob als Transaktionseinheit (23) von dem Endgerät (10) entgegengenommene Pseudotransaktionsdaten (P2) gegenüber dem Endgerät (10) als Eingabeeinheit (22) übergebenen Pseudotransaktionsdaten (P1) unmanipuliert sind.

Protocol software component and test apparatus

Systems and methods for implementing modular computer system security solutions

In some embodiments, an apparatus includes a control chain generation module is configured to receive, from a control database, a security guideline control to be implemented with respect to a hardware asset. The control chain generation module is configured to select, based on requirements to satisfy the security guideline and attributes of the hardware asset, a security implementation control. The control chain generation module is configured to select a control assessor to monitor the compliance of the hardware asset with the security guideline and is configured to define a control chain including the security guideline control, the security implementation control, and the control assessor. The control chain generation module is configured to send an instruction to apply the control chain to the hardware asset such that the control assessor monitors the hardware asset for compliance with the security guideline.

Detection of malware-usable clean file

The present application regards a method of protecting against file-less or memory-resident malware which may execute a clean but vulnerable file (e.g. a web browser, media player or device driver) with a payload that takes over the process of the clean file. The present application therefore proposes methods of identifying vulnerable files by checking their threat of usage by malware or, stated differently, the detection of malware using a clean file. Such methods could exemplarily comprise identifying a vulnerable clean file in a computer system S110, which does not constitute malware but is vulnerable for usage by malware, checking the vulnerable clean file for its threat of usage by malware S120, and detecting the vulnerable clean file as malware-usable clean file on the basis of a result of said checking of its threat of usage by malware S130. A files threat of usage by malware may be indicated by checking reputation information of the vulnerable clean file.

Effective testing of authorization logic of web components which utilize claims-based authorization

Security system and method for controlling interactions between components of a computer system

Web service testing

Determining the vulnerability of computer software applications to privilege escalation attacks

Platform and method for remote attestation of a platform

A system and method to determine the validity of an interaction on a network

The method and system of the invention utilize limited data to yield information about the validity of any given interaction with a website. Once validity information is available, an operator can determine whether or not to continue offering interactions to a given user. The operator collects data (200), insets data as values into determined mathematical equations (204), accesses risk value for each interaction (206). The determination could also relate to whether to report website interaction statistics based on undesired interactions, how to handle billing or payment for such undesired interactions, and what type of content to send to users who are interacting with the webside in an undesirable manner.

Managing entitlements

Embodiments of the invention relate to systems, methods, and computer program products for managing a community's access to entitlements. In one embodiment a computer program is configured to periodically examine the members of a particular community in an organization and identify members in the community that have access to software applications, datasets, or other organizational resources that are uncommon or taboo in the community, which may indicate that the member should not have access to the such resources. The computer program is also configured to automatically and periodically determine the resources that members of the same community should all probably have access to, i.e. that are normal or common to the community. Thresholds are used to determine whether entitlements are normal and/or taboo.

Dynamic entitlement manager

Identifying a degradation of integrity of a process control system by checking the files expecting to be present in the system profile

Disclosed is a method to identify a degradation of integrity of a process control system. The method includes identifying a file on a file system of the process control system. Next, the method determines if the file is identified in a system profile, the system profile identifying the files expected to be present. A degradation of integrity of the process control system is identified when the file is not identified in the system profile. The method may compare the hash value of the file to a stored hash value. The method may also identify a network communication, compare a property of the network communication to a stored property of network communications in the system profile and identify a degradation of the process control system when the property does not match the stored property in the system profile.

Cyber security

Input data is received S1 that is associated with an entity associated with a computer system (10, fig. 1), e.g. a user or device. Preferably the data includes data relating to the entitys activity on the computer system. Metrics, representative of the datas characteristics, are derived S2 from the data and may reflect usage of the computer system by the entity over time, e.g. metrics relating to network traffic. The metrics are analysed S3 using one or more models, perhaps arranged to detect different types of threat. A cyber-threat risk parameter is determined S4, S5 in accordance with the analysed metrics and a model of normal behaviour of the entity, e.g. by comparing the metrics with the model. The parameter is indicative of a likelihood of a cyber-threat, preferably the probability of such likelihood, and is preferably determined using recursive Bayesian estimation. The parameter may be compared with a threshold, possibly a moving threshold, to determine whether or not there is a ...

Preventing clean files being used by malware

Malware barrier

A network of connected devices organised into a hierarchical tree of subnets (represented as nodes) modelled as a tree data structure 410. Generating a dynamical system for each subnet which models a rate of change of connected devices in the subnet that are susceptible, infected by, protected against and remediated of infection by malware, and basing the system on rates of transmission of malware between all subnet pairs. Evaluating infection risk for each subnet at a predetermined point in time, the risk being associated with a node corresponding to the subnet. Identifying a first subset of nodes for which a risk of infection is below a predetermined level of risk 406, identifying a second subset of nodes as a subset of the first subset, the second subset comprising nodes having a connection to a node having a risk of infection meeting or exceeding the predetermined threshold risk; and performing protective actions on devices in subnets associated with each of the first subset of nodes ...

Secure input mode for user device

Enabling secure input at a user device. A security manager is configured to determine whether the user device is in an insecure environment, for example by generating a security score from a plurality of input parameters and comparing the security score to a threshold. The input parameters maybe in the form of an audio signal and the threshold maybe a noise threshold or the parameters may be location based or visual information from the device cameras. In response to a determination that the user device is in an insecure environment, a user input unit is operated in a secure user input mode where the user input may be entered in an obfuscated manner and when received is decoded before being passed to an application, by using a decoding algorithm. The decoding algorithm may be pre-programmed or may be user-defined, and different decoding algorithms may be used for different applications. In some embodiments, a secure output mode where displayed content is encoded may also be activated when ...

Speculative side-channel hint instruction

In an apparatus 2 supporting speculative processing of read operations to read data from memory 20-22, a control circuit identifies a speculative side-channel hint instruction in a sequence of instructions to be processed. The hint instruction indicates a risk of information leakage if one subsequent read operation is processed speculatively. The control circuit determines speculative side‑channel mitigation measures based on the hint instruction. This improves upon mitigation measures applied to all operations which unnecessarily sacrifice performance. The control circuit can be decoder 12, execution stage 14, circuitry of data cache 20. Hint instructions, e.g. interpreted as NOP instructions, are inserted at compile or link time, just-in-time (JIT) compilation or dynamic recompilation, by hardware profiling. Hint instructions indicate that subsequent read operations are safe or unsafe to be processed speculatively. Control circuit annotates cached instruction or micro‑operations in 6, ...

System and method for developing a risk profile for an internet resource

System and method of defining the security vulnerabilities of a computer system

Testing applications with a defined input format

Mobile device policy enforcement

Mitigation of anti-sandbox malware techniques

Assessment program, assessment method, and information processing device

Detecting vulnerable applications

A method and system of determining a vulnerability of software. Libraries are downloaded and stored in a database. For each library, a set of features are extracted and stored in a library index table of the database. For each library, it is determined whether it poses a security concern and flagged accordingly in the library index table. Applications are downloaded and stored in the database. For each application a set of features are extracted and stored in an application index table of the database. For each application, the set of features of the application are compared to the set of features of each of the libraries in the library index table to identify which libraries in the library index table are associated with the application. For each application, a name of the application and names of the associated libraries are stored in a vulnerability reference table in the database.

Monitoring variations in observable events for threat detection

Cloud-enabled testing of control systems

Cloud computing system 201 performs a documentation check of a control system 214. It receives an instrument index - i.e. an as-designed representation of field devices 110 within the control system - and stores it in cloud storage. It also receives (e.g. from the control system) an as-built representation of the control system indicating an installation of the field devices. It compares the instrument index with the as-built representation to determine whether a discrepancy exists between them and, if so, transmits the discrepancy to a web-based interface (e.g. displayed on a mobile computing device 208). The discrepancy may be corrected and verified design documentation created and stored in the cloud storage. A function test of the control system may be performed, e.g. by a technician 108 using a loop diagram of the field devices (rendered on the mobile device) to determine whether the field devices are labelled and terminated correctly. The mobile device may provide a warning if the ...

Security method for identifying kill chains

The invention defines multi-step attacks on computers/networks (e.g advanced persistent threats (APT)) as a series of attack tactics (e.g. Initial Access, Execution, Persistence, Exfiltration) which carry out some function needed to perform the overall attack. For each tactic a set of attack techniques (e.g. Drive-By Compromise, Phishing, Hardware Additions, Exploit Public Facing Application) which fulfil the tactical function are determined. Events which match the attack techniques are detected and linked to events matching attack techniques in the other tactic sets. Hence, paths/kill chains through the techniques in the tactical sets are determined and statistics about particular paths may be gathered. Hence, the invention may determine high frequency paths (bold arrows) and prioritise security mitigations at those paths or deprioritise low frequency paths (dashed arrows).

PROCEDURE, SYSTEMS AND COMPUTER PROGRAMME PRODUCTS FOR THE EVALUATION OF THE SECURITY OF A NETWORK ENVIRONMENT

Method for safety inspection of a technical unit

Auf einem Prüfcomputersystem (2) ausgeführtes Verfahren zur Sicherheitsüberprüfung einer Technikeinheit (1), wobei zumindest eine erste plausible Modellvariante und gegebenenfalls eine oder mehrere alternative Modellvarianten ermittelt werden und wobei das Verfahren die folgenden Schritte aufweist: Zuordnen bekannter Schwachstellen zu Komponenten der Modellvarianten, Definieren eines Angriffsziels, Erstellen zumindest eines auf das Angriffsziel bezogenen Angriffsmodells für jede Modellvariante, Gewichten der Knoten des Angriffsmodells hinsichtlich zumindest einer Bewertungsvariable, Ermitteln einer Bewertung zumindest eines Testvektors des Angriffsmodells hinsichtlich der Bewertungsvariable, Ermitteln eines Sicherheitswerts als pessimaler Werts aller Bewertungen und Ausgeben einer Sicherheitsbestätigung, wenn der Sicherheitswert einem Sicherheitskriterium entspricht.

PROCEDURE FOR RISK DETECTION AND - ANALYSIS IN A COMPUTER NETWORK

Risk assessment using social networking data

Tools, strategies, and techniques are provided for evaluating the identities of different entities to protect individual consumers, business enterprises, and other organizations from identity theft and fraud. Risks associated with various entities can be analyzed and assessed based on analysis of social network data, professional network data, or other networking connections, among other data sources. In various embodiments, the risk assessment may include calculating an authenticity score based on the collected network data.

Systems and methods for identifying and monitoring solution stacks

Systems and methods for identifying and managing solution stacks integrated within a computer environment include one or more computing devices receiving information identifying one or more first assets as belonging to a solution stack integrated within a computer environment. The computing devices can iteratively identify additional assets of the computer environment related to, but not part of, the assets already identified as belonging to the solution stack, and determine, based on a comparison of attributes of the additional assets to attributes of the assets already identified as belonging to the solution stack, whether any of the additional assets belongs to the solution stack. The one or more computing devices can repeat these steps until no additional is identified as belonging to the solution stack. The computing devices can generate a current state of the solution stack defining at least a complete set of assets forming the solution stack.

DATA SECURITY AND PROTECTION SYSTEM USING UNIQUENESS FACTOR CLASSIFICATION AND ANALYSIS

A data security and protection system that provides monitoring, diagnostics, and analytics within an enterprise network to identify potentially sensitive data is disclosed. The system may provide one or more data stores to store and manage personal data within a network. The system may also provide one or more servers to facilitate operations using information from the one or more data stores. The system may also provide an analytics system with processing components that determines uniqueness of personal data. The system may receive personal data and population attribute data via a data access interface. The analytics system may compare the data received to determine a fraction assignment, which when further processed using at least a combination or correlation technique, may yield a detailed uniqueness factor classification and analysis of the personal data to indicate its relative sensitivity. If there is risk associated with the sensitivity of the personal data, additional security ...

Risk analysis to identify and retrospect cyber security threats

This disclosure provides an apparatus and method for identifying and retrospecting cyber security threats, including but not limited to in industrial control systems (100) and other systems. A method includes receiving (304), by a risk manager system (154), a selection of an asset for analysis. The method includes receiving (314), by the risk manager system (154), current and historical cyber-risk data corresponding to the asset. The method includes receiving (320) a user selection of one or more data options (404, 406, 408, 410) for analysis of the asset. The method includes identifying (322) relevant portions of the current and historical cyber-risk data according to the selected data options. The method includes producing an output (324) corresponding to the selected asset, the selected data options, and the identified relevant portions of the current and historical cyber-risk data. The method includes displaying (326) the output as a report in a graphical user interface (400).

Testing insecure computing environments using random data sets generated from characterizations of real data sets

C:\Interwovn\NRPortbl\DCC\DER8954511 Idocx-23/102018 A method for facilitating testing of an insecure computing environment, comprising: obtaining a real data set comprising a set of data strings, wherein the real data set is obtained from a column in a database; generating, based on the real data set, a combined block sequence; generating a test data set, wherein the test data set comprises a set of random data strings that conforms to the combined block sequence; and testing an insecure computing environment using the test data set.

INOCULATOR AND ANTIBODY FOR COMPUTER SECURITY

In an embodiment of the invention, a method includes: determining, in a computer, an area where an undesired 5 computer program will reside; and providing a data object in the area, so that the data object is an antibody that provides security to the computer and immunity against the undesired program. Another embodiment of the invention also provides an apparatus (or system) that can be 10 configured to perform at least some of the above functionalities. U). 0 0)0 0 (0 0Co o~ 0q ...

Method ans system for detecting vulnerabilities in source code

Event monitoring and management

Incident triage engine

An incident triage engine performs incident triage in a system by prioritizing responses to incidents within the system. One prioritization method may include receiving attributes of incidents and assets in the system, generating cumulative loss forecasts for the incidents, and prioritizing the responses to the incidents based on the cumulative loss forecasts for the incidents. Another prioritization method may include determining different arrangements of incidents within a response queue, calculating cumulative queue loss forecasts for the different arrangements of incidents within the response queue, and arranging the incidents in the response queue based on the arrangement of incidents that minimizes the total loss to the system over the resolution of all of the incidents present in the response queue.

Integrated monitoring system

Method and system for providing a robust and efficient virtual asset vulnerability management and verification service

A virtual asset testing environment is provided that is distinct from a production computing environment. A virtual asset creation template associated with a class of virtual assets to be verified is identified, each virtual asset of the class of virtual assets being created using the virtual asset creation template. A designated test virtual asset is generated using the virtual asset creation template that is deployed in the virtual asset testing environment. The designated test virtual asset is then analyzed in the virtual asset testing environment to identify any vulnerabilities in the designated test virtual asset. If a vulnerability is identified in the designated test virtual asset, a remedy to the vulnerability is applied to the virtual asset creation template, and/or virtual assets created by the virtual asset creation template deployed in the production environment.

Method and system for providing an efficient vulnerability management and verification service

A virtual asset creation template associated with a class of virtual assets is identified and analyzed to identify any vulnerabilities in the virtual asset creation template. If one or more vulnerabilities are identified in the virtual asset creation template, an appropriate remedy for each identified vulnerability identified in the virtual asset creation template is applied. If no vulnerability is identified in the virtual asset creation template, or once each vulnerability identified in the virtual asset creation template is remedied, each virtual asset of the virtual asset class generated using the virtual asset creation template is assigned an initial status of verified virtual asset. ENTER) IDENTIFY A VIRTUAL ASSET CREATION TEMPLATE ASSOCIATED WITH A CLASS OF VIRTUAL ASSETS, EACH VIRTUAL ASSET OF THE CLASS OF VIRTUALASSETS BEING CREATED USING THEVIRTUAL ASSET CREATION TEMPLATE _______ _____ _T_____ CRATON OBTAIN VIRTUAL ASSET CREATION TEMPLATE DATA REPRESENTINGTHE VRTUALASSETCREATION ...

Systems and methods for identifying and reporting application and file vulnerabilities

In various embodiments, a method comprises receiving a plurality of records from a first digital device, each of the plurality of records generated during execution or termination of a different executable and containing information related to execution or termination of the different executable, retrieving at least one segment from at least one of the plurality of records, the at least one segment being less than all of the at least one of the plurality of records, the segment including an application or file attribute related to the different executable, comparing the application or file attribute to a vulnerability database, identifying a risk based on the comparison, and generating a report identifying the risk.

Method and apparatus for a scoring service for security threat management

A method and system for providing a security threat scoring service to identify and prioritize potential security threats to an online service. The method and system include determining security threat patterns, comparing traffic to the online system with the security threat patterns, and identifying portions of the traffic as a potential security threat. The method and system include assigning a threat score to the potential security threat, and providing the threat score to the online service to enable the online service to secure against the potential security threat.

CONTEXTUALIZATION OF THREAT DATA

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for determining threat data contextualization. One of the methods includes receiving data that identifies assets, attributes for each of the assets, and respective relevance ratings for the assets, receiving threat data that identifies vulnerabilities of particular attributes, determining vulnerability trends for the particular attributes, determining whether an attribute is one of the particular attributes identified in the threat data, updating the relevance ratings of the attribute using the vulnerability trends for the attribute, for each of two or more vulnerabilities identified in the threat data: determining the particular attributes affected by the vulnerability, and determining a score for the vulnerability using the respective relevance ratings for the particular attributes affected by the vulnerability, generating a ranking of the vulnerabilities using the corresponding scores, and ...

System and methods for automated detection of input and output validation and resource management vulnerability

In an example embodiment, a system analyzes a set of computer routines. The system may perform an analysis including a determination of a likelihood of vulnerability to unexpected behavior for one or more computer routines of the set. Based upon the analysis, the system may identify one or more computer routines of the set having the likelihood of vulnerability. The system may asynchronously and dynamically manipulate at least one of the one or more computer routines through a testing technique. The system may determine unexpected behavior of at least one of the one or more computer routines.

Automated electronic computing and communication system event analysis and management

Automatic automated electronic computing and communication system event analysis and management includes identifying an event, generating a computer readable representation of the electronic computing and communication system using automated topology enumeration, identifying an element of the electronic computing and communication system based on the representation, identifying a metric for the element, automatically investigating to determine a value for the metric, generating a remediation priority for the element based on a metric weight associated with the metric and a network layer value associated with a network layer associated with a network layer role associated with the element, and generating a graphical representation of the electronic computing and communication system indicating the remediation priority.

Computer security

A system and method to determine the validity of an interaction on a network

SYSTEMS AND METHODS FOR SHIELDING AN IDENTIFIED VULVERABILITY

Systems and methods are described for shielding a vulnerability in an application through disablement of one or more features. In an implementation, a method includes identifying a vulnerability in at least one of a plurality of features for an application module. A communication is formed for receipt by a plurality of clients to shield execution of the application module from the identified vulnerability. The communication describes that the at least one feature is to be disabled from execution in conjunction with the application module.

SYSTEM AND METHOD FOR PROVIDING APPLICATION PENETRATION TESTING

A system and method provide application penetration testing. The system contains logic configured to find at least one vulnerability in the application so as to gain access to data associated with the application, logic configured to confirm the vulnerability and determine if the application can be compromised, and logic configured to compromise and analyze the application by extracting or manipulating data from a database associated with the application. In addition, the method provides for penetration testing of a target by: receiving at least one confirmed vulnerability of the target; receiving a method for compromising the confirmed vulnerability of the target; installing a network agent on the target in accordance with the method, wherein the network agent allows a penetration tester to execute arbitrary operating system commands on the target; and executing the arbitrary operating system commands on the target to analyze risk to which the target may be exposed.

USING METADATA IN SECURITY TOKENS TO PREVENT COORDINATED GAMING IN A REPUTATION SYSTEM

To prevent gaming of a reputation system, a security token is generated for a security module using metadata about the client observed during the registration of the security module. The registration server selects metadata for use in generating the security token. The generated security token is provided to identify the client in later transactions. A security server may conduct a transaction with the client and observe metadata about the client during the transaction. The security server also extracts metadata from the security token. The security server correlates the observed metadata during the transaction with the extracted metadata from the security token. Based on the result of the correlation, a security policy is applied. As a result, the metadata in the security token enables stateless verification of the client.

SYSTEM AND METHOD FOR EXTENDING AUTOMATED PENETRATION TESTING TO DEVELOP AN INTELLIGENT AND COST EFFICIENT SECURITY STRATEGY

A system and method for extending automated penetration testing of a target network is provided. The method comprises: computing a scenario, comprises the steps of: translating a workspace having at least one target computer in the target network, to a planning definition language, translating penetration modules available in a penetration testing framework to a planning definition language, and defining a goal in the target network and translating the goal into a planning definition language; building a knowledge database with information regarding the target network, properties of hosts in the network, parameters and running history of modules in the penetration testing framework; and running an attack plan solver module, comprising: running an attack planner using the scenario as input, to produce at least one attack plan that achieves the goal, and executing actions defined in the at least one attack plan against the target network from the penetration testing framework.

SYSTEM AND METHOD FOR EXTENDING AUTOMATED PENETRATION TESTING TO DEVELOP AN INTELLIGENT AND COST EFFICIENT SECURITY STRATEGY

A system and method for extending automated penetration testing of a target network is provided. The method comprises: computing a scenario, comprises the steps of: translating a workspace having at least one target computer in the target network, to a planning definition language, translating penetration modules available in a penetration testing framework to a planning definition language, and defining a goal in the target network and translating the goal into a planning definition language; building a knowledge database with information regarding the target network, properties of hosts in the network, parameters and running history of modules in the penetration testing framework; and running an attack plan solver module, comprising: running an attack planner using the scenario as input, to produce at least one attack plan that achieves the goal, and executing actions defined in the at least one attack plan against the target network from the penetration testing framework.

INSIDER THREAT CORRELATION TOOL

Systems and methods for calculating threat scores for individuals within an organization or domain are provided. Aspects of the invention relate to computer-implemented methods that form a predictive threat rating for user accounts. In one implementation, a first threat score representing a first time period may be calculated. The first threat score may be compared with aspects of the same user accounts for a second time period. Weighting schemes may be applied to certain activities, controls, and/or user accounts. Further aspects relate to apparatuses configured to execute methods for ranking individual user accounts. Certain embodiments may not block transmissions that violate predefine rules, however, indications of such improper transmission may be considered when constructing a threat rating. Blocked transmissions enforced upon a user account may also be received. Certain activity, such as accessing the internet, may be monitored for the presence of a security threat and/or an ethics ...

END USER RISK MANAGEMENT

SYSTEMS AND METHOD FOR AUTOMATING WORKFLOWS IN A DISTRIBUTED SYSTEM

Methods and systems for automating execution of a workflow by integrating security applications of a distributed system into the workflow are provided. In embodiments, a system includes an application server in a first cloud, configured to receive a trigger to execute the workflow. The workflow includes tasks to be executed in a device of a second cloud. The application server sends a request to process the task to a task queue module. The task queue module places the task request in a queue, and a worker hosted in the device of the second cloud retrieves the task request from the queue and processes the task request by invoking a plugin. The plugin interacts with a security application of the device of the second cloud to execute the task, which yields task results. The task results are provided to the application server, via the worker and the task queue module.

SIMULATED RISK CONTRIBUTIONS

Computing devices utilizing computer-readable media implement methods arranged for deriving risk contribution models from a dataset. Rather than inspect the entire data model in order to identify all quasi-identifying fields, the computing device develops a list of commonly-occurring but difficult-to-detect quasi-identifying fields. For each such field, the computing device creates a distribution of values / information values from other sources. Then, when risk measurement is performed, random simulated values (or information values) are selected for these fields. Quasi-identifying values are then selected for each field with multiplicity equal to the associated randomly-selected count. These are incorporated into the overall risk measurement and utilized in an anonymization process. In typical implementations, the overall average of reidentification risk measurement results prove to be generally consistent with the results which are obtained on the fully-classified data model.

SYSTEMS AND METHODS FOR SECURITY AND RISK ASSESSMENT AND TESTING OF APPLICATIONS

Provided herein are systems and methods for monitoring and assessing the security and risk presented by applications deployed in a complex computing environment. An exemplary application security system includes a server having a processing device in communication with storage systems, computing devices executing application instances configured to receive and transmit information over a network, and a security testing system including a first test module that is associated with a first application, which is associated with one or more of the application instances. The processing device of the server retrieves information about the first application, including current dependency information of the first application, calculates a security risk score for the first application based on the information, determines a security priority level associated with first application, and associates the security priority level of the first application with the first application in a database of application ...

CONTEXTUAL RISK MONITORING

Systems, methods, and related technologies for device monitoring and device risk monitoring are described. In certain aspects, an indicator associated with a security risk is set based on communication between a first device having an associated elevated security risk and a second device. The indicator can be stored and may be used as a basis for performing a security action.

SECURITY RISK IDENTIFICATION IN A SECURE SOFTWARE LIFECYCLE

A system and method for security risk identification in a secure software lifecycle. A knowledge database has a plurality of security elements which are identified for a particular software application depending on software environment and prioritized in a task list. Code vulnerabilities are identified using code scanners, with security requirements updated based on identified vulnerabilities, lack of vulnerabilities for weaknesses covered by a code scanner, potential weaknesses not adequately covered by code scanners, and software environment changes.

PRIORITIZED REMEDIATION OF INFORMATION SECURITY VULNERABILITIES BASED ON SERVICE MODEL AWARE MULTI-DIMENSIONAL SECURITY RISK SCORING

A method for securing a service implemented on a computer network includes identifying network assets in the computer network used by the service. The method further includes identifying vulnerabilities in one or more of the network assets, determining an asset risk score for each of the network assets, and determining a service risk score for the service. The method involves implementing one or more vulnerability remediation actions on the computer network to reduce the service risk score and secure the service.

METHODS AND SYSTEMS FOR NETWORK SECURITY

Described are devices, systems, and methods for improving network security by providing network interface devices communicatively coupled to end-point-protection platforms.

AUTOMATED SECURITY TESTING SYSTEM AND METHOD

Systems and methods for network security testing of target computer networks using AI neural networks. A command and control server controls a number of geographically separated processors running a number of neural networks. A central data hive is accessible to all the processors. The processors are organizable into logical hemisphere groupings for specific tasks and/or projects. For security testing, hemisphere groupings are created for the project. Based on data for the target system on the data hive, attacks are formulated by a hemisphere grouping and these potential attacks are tested against known characteristics of the target network. Validated potential attacks and, in some cases, random attacks, are executed and data generated by the executed attacks are stored in the data hive for use in formulating and executing other further attacks. Potential attacks may involve mining social media networks for data on users of the target system.

THRESHOLD DETERMINING AND IDENTITY VERIFICATION METHOD, APPARATUS, ELECTRONIC DEVICE, AND STORAGE MEDIUM

Disclosed are a threshold value determination and identity verification method, a threshold value determination and identity verification apparatus, an electronic device, and a storage medium. The threshold value determination method comprises: acquiring pre-set target values corresponding to a plurality of identity verification recognition models respectively, wherein the preset target values are used for indicating target recognition capabilities expected to be achieved by the identity verification recognition models; and determining, according to the pre-set target values, user service variable values and identity verification threshold values corresponding to the plurality of identity verification recognition models respectively, wherein the user service variable values are used for dividing active users from inactive users, and the identity verification threshold values are used by the identity verification recognition models for removing a user requiring a strong check from the inactive ...

SYSTEM AND METHOD FOR PREVENTING MALICIOUS CAN BUS ATTACKS

A system for preventing cyber security attacks over the CAN bus of a vehicle, from carrying out their plot. The system includes a teleprocessing device that is provided with the message identifier of at least one ECU to be blocked. The teleprocessing device is configured to read the message identifier of CAN messages, to thereby identify the at least one ECU to be blocked. Upon determining that the vehicle is under a cyber security attack, the ECU blocking device is activated. Upon identifying that a message was transmitted by the at least one ECU to be blocked, then during the CAN bus 'bit monitoring' process, before the at least one ECU to be blocked reads back the transmitted signal, the ECU blocking device alters one or more bits of the transmitted signal, to thereby force the message to be an erroneous CAN message.

SYSTEM AND METHOD FOR ASSESSING THE SECURITY POSTURE OF A NETWORK USING GOAL ORIENTED FUZZY LOGIC DECISION RULES

A method and data processing system assesses the security vulnerablity of a network. A system object model database is created and supports the information data requirements of disparate network vulnerability analysis programs. Only the required data from the system object model database representing the network is imported to the programs, which then analyze the network to produce data results from each program. These data resuls are stored in a common system model database and within the data fact base. Goal oriented fuszzy logic decision rules are applied to determine the vulnerability posture of the network.

Система адаптивного мониторинга автоматизированных систем управления военного назначения

Система адаптивного мониторинга автоматизированных систем управления военного назначения (АСУ ВН) предназначена для выполнения комплексной оценки защищенности АСУ ВН в условиях ограниченности ресурсов и формирования комплексного образа АСУ ВН. Техническим результатом полезной модели является оптимизация процедур мониторинга для осуществления оценки защищенности АСУ ВН с учетом текущей цели его функционирования и в условиях ограниченных ресурсов за счет последовательной многоуровневой адаптации, включающей: адаптацию набора и объема номенклатуры параметров, подлежащих мониторингу, адаптацию процедур наблюдения и адаптацию процедур оценивания, что обеспечивает повышение оперативности принятия решений о степени защищенности АСУ ВН за счет минимизации набора параметров, подлежащих контролю, таким образом повышается информативность полученных в процессе мониторинга данных. Указанный технический результат достигается тем, что оператор посредством модуля взаимодействия с пользователем устанавливает параметры работы системы. Модулем оценки на основе результатов, полученных в процесс функционирования модуля сбора информации, с учетом текущей цели объекта мониторинга и наличия ресурса для выполнения процедур мониторинга, определяется последовательность и параметры работы всех модулей системы и производится запуск работы модуля тестирования АСУ ВН. Данные результатов тестирования АСУ ВН посредством модуля преобразования данных приводятся к общему виду, передаются в модуль параметрического синтеза. Далее выполняется адаптация процедур наблюдения, запускается мониторинг параметров АСУ ВН и ее сетевой активности. Собранные модулем мониторинга данные приводятся к общему виду, передаются в модуль параметрического синтеза. Модулем параметрического синтеза производится синтез результатов тестирования и мониторинга, в результате чего формируется комплексный образ АСУ ВН, который выводится оператору и передается в модуль оценки, где выполняется адаптация процедур оценивания и ...

Systems and methods for processing data flows

A flow processing facility, which uses a set of artificial neurons for pattern recognition, such as a self-organizing map, in order to provide security and protection to a computer or computer system supports unified threat management based at least in part on patterns relevant to a variety of types of threats that relate to computer systems, including computer networks. Flow processing for switching, security, and other network applications, including a facility that processes a data flow to address patterns relevant to a variety of conditions are directed at internal network security, virtualization, and web connection security. A flow processing facility for inspecting payloads of network traffic packets detects security threats and intrusions across accessible layers of the IP-stack by applying content matching and behavioral anomaly detection techniques based on regular expression matching and self-organizing maps. Exposing threats and intrusions within packet payload at or near real-time rates enhances network security from both external and internal sources while ensuring security policy is rigorously applied to data and system resources. Intrusion Detection and Protection (IDP) is provided by a flow processing facility that processes a data flow to address patterns relevant to a variety of types of network and data integrity threats that relate to computer systems, including computer networks.

APPARATUS AND METHOD FOR DETECTING, PRIORITIZING AND FIXING SECURITY DEFECTS AND COMPLIANCE VIOLATIONS IN SAP® ABAPtm CODE

A static code analysis (SCA) tool, apparatus and method detects, prioritizes and fixes security defects and compliance violations in SAP® ABAP™ code. The code, meta information and computer system configuration settings are transformed into an interchangeable format, and parsed into an execution model. A rules engine is applied to the execution model to identify security and compliance violations. The rules engine may include information about critical database tables and critical SAP standard functions, and the step of applying the rules engine to the execution model may include the calculation of specific business risks or whether a technical defect has a business-relevant impact. In particular, an asset flow analysis may be used to determine whether critical business data is no longer protected by the computer system. Such critical business data may include credit or debit card numbers, financial data or personal data.

Verification of Information-Flow Downgraders

A method includes determining grammar for output of an information-flow downgrader in a software program. The software program directs the output of the information-flow downgrader to a sink. The method includes determining whether the grammar of the output conforms to one or more predetermined specifications of the sink. The method includes, in response to a determination the grammar of the output conforms to the one or more predetermined specifications of the sink, determining the information-flow downgrader is verified for the sink, wherein determining grammar, determining whether the grammar, and determining the information-flow downgrader are performed via static analysis of the software program. Apparatus and computer program products are also disclosed. An apparatus includes a user interface providing a result of whether or not output of an information-flow downgrader in the software program conforms to one or more predetermined specifications of a sink in the software program.

Protection against malware on web resources

A method and system for identification of malware threats on web resources. The system employs a scheduled antivirus (AV) scanning of web resources. The scheduled scanning of web resources allows to create malware check lists and to configure access to web resources. Frequency and depth of inspection (i.e., scan) are determined for each web resource. The user identifiers are used for scheduled AV scanning of web resources. The system allows for scanning a web resource based on selected configurations without using additional client applications.

Performing security assessments in an online services system

A system and method for performing security assessments in an online services system. In one embodiment, a method includes receiving an accepted security assessment agreement from a user, where the security assessment agreement is associated with a software application utilized in an online services system. The method also includes receiving configuration data associated with the software application; receiving scanning data associated with the software application; and sending the configuration data and scanning data to one or more security assessment systems.

Security system for computing resources pre-releases

Technology is provided for provisioning a user computer system with membership in a privilege set in order to execute a pre-release resource. Some examples of pre-release resources are alpha and beta versions of firmware or software which can be downloaded to user computer systems. The pre-release resources are associated with different privilege sets based on their security risk levels. In one example, a security risk level may represent a number of user computer systems at risk of an integrity failure of the pre-release resource. In other examples, the security risk may represent an operational layer of the user computer system affected by the resource or a level of security testing certification success for the pre-release resource. A privilege set identifier indicates membership in one or more privilege sets.

Image vulnerability repair in a networked computing environment

Embodiments of the present invention provide an approach to repair vulnerabilities (e.g., security vulnerabilities) in images (e.g., application images) in a networked computing environment (e.g., a cloud computing environment). Specifically, an image is checked for vulnerabilities using a database of known images and/or vulnerabilities. If a vulnerability is found, a flexible/elastic firewall is established around the image so as to isolate the vulnerability. Once the firewall has been put in place, the vulnerability can be repaired by a variety of means such as upgrading the image, quarantining the image, discarding the image, and/or generating a new image. Once the image has been repaired, the firewall can be removed.

Method and apparatus for securing a computing device

A method and apparatus for securing a computing device are provided. A state of the computing device is determined, the state associated with a protection state. The computing device is automatically switching between a plurality of security levels at based on the state.

Defense-in-depth security for bytecode executables

Defense-in Depth security defines a set of graduated security tasks, each of which performs a task that must complete before another task can complete. Only when these tasks complete successfully and in the order prescribed by Defense-in-Depth security criteria is a final process allowed to execute. Through such Defense-in-Depth security measures, vulnerable software, such as bytecode, can be verified as unaltered and executed in a secure environment that prohibits unsecured access to the underlying code.

Security countermeasure management platform

A management platform that allows security and compliance users to view risks and vulnerabilities in their environment with the added context of what other mitigating security countermeasures are associated with that vulnerability and that are applicable and/or available within the overall security architecture. Additionally, the platform allows users to take one or more actions from controlling the operation of a security countermeasure for mitigation purposes to documenting the awareness of a security countermeasure that is in place.

Mechanism for Generating Vulnerability Reports Based on Application Binary Interface/Application Programming Interface Usage

A method for generating vulnerability reports based on application binary interface/application programming interface usage may include extracting a binary file and a security report relating to a software program, the security report having a vulnerability list of pending vulnerabilities relating to the software program, and detecting, from the binary file, interface usage details associated with interfaces and shared libraries used by the software program. The interfaces include application binary interfaces (ABIs). The method may further include matching the interface usage details with the pending vulnerability of the vulnerability list, and generating a vulnerability report based on matching.

Methods for detecting sensitive information in mainframe systems, computer readable storage media and system utilizing same

Examples of methods, systems, and computer-readable media for detection of sensitive information are described using multiple techniques. The techniques may include applying pre-defined field structure layouts to records, applying simple template structure to records as a single field, and inferring data structure by building a map of potential packed decimal locations. The resulting information may then be analyzed for detection of sensitive information.

Method and apparatus for determining software trustworthiness

Aspects of the invention relate to a method, apparatus, and computer readable medium for determining software trustworthiness. In some examples, a software package identified as including at least one file of unknown trustworthiness is installed on a clean machine. A report package including a catalog of files that have been installed or modified on the clean machine by the software package is generated. Identification attributes for each of the files in the catalog is determined. Each of the files in the catalog is processed to assign a level of trustworthiness thereto. The report package is provided as output.

System and Method for Reducing Security Risk in Computer Network

Disclosed are systems, methods and computer program products for reducing security risk in a computer network. The system includes an administration server that collect information about one or more computers in the network, including the following information: computer user's external drive usage history, software installation history, and Web browsing history. The server calculates based on the collected information a security rating of the computer user. The server then adjust a security rating of the computer user based on the security rating of at least one other user of another computer connected to the same computer network. The server then selects security policy of the security software based on the adjusted security rating of the computer user. Different security policies provide different network security settings and prohibitions on launching of executable files from external drives.

Compliance-based adaptations in managed virtual systems

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Testing web applications for file upload vulnerabilities

A system for detecting file upload vulnerabilities in web applications is provided. The system may include a black-box tester configured to upload, via a file upload interface exposed by a web application, a file together with a signature associated with the file. An execution monitor may be configured to receive information provided by instrumentation instructions within the web application during the execution of the web application. The execution monitor may be configured to recognize the signature of the uploaded file as indicating that the uploaded file was uploaded by the black-box tester. The execution monitor may also be configured to use any of the information to make at least one predefined determination assessing the vulnerability of the web application to a file upload exploit.

Systems and Methods For Digital Forensic Triage

In one embodiment, a method for forensic triage may include coupling, communicatively, a computer and a mobile device. The computer can be booted with machine readable instructions stored on the one or more mobile memory modules of the mobile device. A search data set can be received with one or more mobile processors of the mobile device. One or more processors of the computer, the one or more mobile processors, or both, can execute, automatically, the machine readable instructions stored on the one or more mobile memory modules of the mobile device to search one or memory modules of the computer in a read only mode for triage data that corresponds to the search data set. The triage data can be transmitted via one or more communication modules of the mobile device.

Evaluating Detectability of Information in Authorization Policies

Techniques for evaluating detectablity of confidential information stored in authorization policies are described. In an example, an authorization policy has a confidential property. The confidential property is defined by whether application of a test probe to the authorization policy results in the grant of access to a resource. A processor automatically determines whether at least one witness policy can be generated that is observationally equivalent to the authorization policy from the perspective of a potential attacker, but the application of the test probe to the witness policy generates an access denial result. In the case that such a witness policy can be generated, an indication that the confidential property cannot be detected using the test probe is output. In the case that such a witness policy cannot be generated, an indication that the confidential property can be detected using the test probe is output.

Sandboxing technology for webruntime system

In a first embodiment of the present invention, a method of providing security enforcements of widgets in a computer system having a processor and a memory is provided, comprising: extracting access control information from a widget process requesting a service, generating access control rules customized for the widget process, and providing the access control rules to a trusted portion of the computer system outside of the user code space of a Web Runtime (WRT) system; and for any static access control rule, delegating security checking of the widget process from the WRT system to the trusted portion of the computer system.

System and method for real-time customized threat protection

A method is provided in one example embodiment that includes receiving event information associated with reports from sensors distributed throughout a network environment and correlating the event information to identify a threat. A customized security policy based on the threat may be sent to the sensors.

Login initiated scanning of computing devices

Embodiments of the invention relate to systems, methods, and computer program products for login initiated remote scanning of computer devices. The present invention detects login to the network via access management systems. The login data provides information that identifies the device so that the device can be checked against a scan database to determine if and when a previous scan occurred. Based on the findings in the scan database determinations are made as to whether to perform a scan. Additionally, the level of scanning can be determined based on previous scan dates and previous scan results, which may dictate customized scanning. In addition, the priority of the impending scan may be dictated by previous scan dates and results. Further embodiments provide for assessing risk, such as risk scoring or the like, concurrently or in near-real-time with the completion of the scan so that alerts may be communicated.

Setting default security features for use with web applications and extensions

According to one general aspect, a computer-implemented method for implementing default security features for web applications and browser extensions includes receiving a request to include a web application or a web browser extension in a digital marketplace. A determination is made if the web application or the web browser extension conforms to default security features, wherein the default security features include a prohibition against running in-line script on web pages. The web application or the browser extension is included in the digital marketplace if the web application or the browser extension conforms to the default security features.

Supervision of the security in a computer system

For supervising the security of a computer system (SY) comprising several elementary computer items (BI), such as machines and applications, and several gathering items (BIg), such as networks, services or sites, gathering elementary items, a supervision device (DS) collects base measurements (MB) representative of states of the elementary items. A unit (UDI) determines several security indicators (I) of different types for each elementary item according to respective functions of the base measurements and several security indicators of different types for each gathering item. Each security indicator of a given type of a gathering item is determined according to a respective function of the security indicators of the given type of the elementary items gathered in the gathering item. The indicators of one item relate to the availability, the intrusion, the vulnerability and the compliance to a security policy.

Information processing program and information processing method

An information processing device stores, in a storage device, command execution user data associating an attribute of a command with a name of a user entitled to execute the command. When execution of the command is requested, a service of the information processing device extracts, from the command execution user data, a name of a user entitled to execute the requested command and executes the command with the extracted user name.

INSIDER THREAT CORRELATION TOOL

Systems and methods for calculating threat scores for individuals within an organization or domain are provided. Aspects of the invention relate to computer-implemented methods that form a predictive threat rating for user accounts. In one implementation, a first threat score representing a first time period may be calculated. The first threat score may be compared with aspects of the same user accounts for a second time period. Weighting schemes may be applied to certain activities, controls, and/or user accounts. Further aspects relate to apparatuses configured to execute methods for ranking individual user accounts. Certain embodiments may not block transmissions that violate predefine rules, however, indications of such improper transmission may be considered when constructing a threat rating. Blocked transmissions enforced upon a user account may also be received. Certain activity, such as accessing the internet, may be monitored for the presence of a security threat and/or an ethics threat. 2. The method of claim 1 , wherein spikeis assigned a first integer if the first threshold level of spikeis about 40% great than the average of the same user account during the second time period.3. The method of claim 1 , wherein the aboveavgis assigned a first integer if the first threshold level of aboveavgis above about 30% greater than the activity of the plurality of user accounts for the same time period.4. The method of claim 1 , wherein the offhoursis assigned a first integer if the activity level is detected about 6 hours before or after the average start or end time for that user account.5. The method of claim 1 , wherein an activity is selected from the group consisting of: a security threat claim 1 , an ethics threat claim 1 , blocked transmission through the targeted communication application claim 1 , transmission through the targeted communication application meeting the predefined criterion claim 1 , attempted access of the centralized store claim 1 , an ...

System and method for evaluating marketer re-identification risk

Disclosures of databases for secondary purposes is increasing rapidly and any identification of personal data may from a dataset of database can be detrimental. A re-identification risk metric is determined for the scenario where an intruder wishes to re-identify as many records as possible in a disclosed database, known as a marketer risk. The dataset can be analyzed to determine equivalence classes for variables in the dataset and one or more equivalence class sizes. The re-identification risk metric associated with the dataset can be determined using a modified log-linear model by measuring a goodness of fit measure generalized for each of the one or more equivalence class sizes.

FIXING SECURITY VULNERABILITY IN A SOURCE CODE

A computer implemented method for automatically fixing a security vulnerability in a source code is disclosed. The method includes obtaining identification of code that sends tainted data to corresponding sink code in the source code; and automatically fixing the vulnerability by automatically performing code modification which is selected from the group of code modifications consisting of: code motion and code duplication. Also disclosed are computer program product and data processing system. 1. A computer implemented method for automatically fixing a security vulnerability in a source code , the method comprising:obtaining identification of code that sends tainted data to corresponding sink code in the source code; andautomatically fixing the vulnerability by automatically performing code modification which is selected from the group of code modifications consisting of: code motion and code duplication.2. A computer implemented method as claimed in claim 1 , further comprising performing additional code modification which is selected from the group of code modifications consisting of: code addition and code deletion.3. A computer implemented method as claimed in claim 1 , wherein the obtaining of identification of the code that sends tainted data to corresponding sink code includes performing data flow analysis.4. A computer implemented method as claimed in claim 1 , comprising translating the code that sends tainted data to corresponding sink code into a plan representation claim 1 , and performing the step of automatically fixing the vulnerability on the plan representation.5. A computer implemented method as claimed in claim 1 , comprising translating the entire source code into a plan representation claim 1 , and performing the step of automatically fixing the vulnerability on the plan representation.6. A computer implemented method as claimed in claim 1 , wherein the identification of the code that sends tainted data to corresponding sink code is provided a- ...

Interactive analysis of a security specification

Analyzing a security specification. An embodiment can include identifying a downgrader in a computer program under test. Via a processor, testing on the downgrader can be performed in a first level of analysis. Responsive to the downgrader not passing the testing performed in the first level of analysis, a counter example for the downgrader can be automatically synthesized. Further, a test unit can be created for the downgrader using the counter example as an input parameter to the downgrader. The test unit can be executed to perform testing on the downgrader in a second level of analysis. Responsive to the downgrader passing the testing performed in the second level of analysis, a user can be prompted to simplify a model of the downgrader.

METHOD AND APPARATUS FOR DETECTING EVENTS PERTAINING TO POTENTIAL CHANGE IN VULNERABILITY STATUS

Method and apparatus for Vulnerability Assessment techniques is disclosed. A method comprises detecting an event on a target in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, and an API. The event comprises a change in status of at least one of a network interface, a server network service, a client network service, and a port. An apparatus comprises a target having at least one of a deployed server network service, and a deployed client network service; and an agent deployed on the target, to detect an event on the target in real time or at periodic intervals. At least one of the agent and the VA server detect the event comprising a change in the status of at least one of a network interface, the server network service, the client network service, and a port. 1. A method comprising:detecting an event on a target, in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, and an API,the event comprising a change in status of at least one of a network interface, a server network service, a client network service, and a port.2. The method of claim 1 , wherein the status of the network interface comprises the states active and inactive claim 1 , the status of the network service comprises the states running and not running claim 1 , and the status of the port comprises the states open and closed.3. The method of further comprising conducting a test from at least one of a vulnerability assessment (VA) scanner claim 1 , and a port scanner on the target based on the detecting.4. The method of claim 3 , wherein the test from the VA scanner comprises at least one ofa test run from the VA scanner to identify the service running on a particular port on the target,a test run from the VA scanner to find a vulnerability in the service running on a particular port on the target,a test run from the VA scanner to identify a particular non-port based service running on the target,a test run from the ...

Locating security vulnerabilities in source code

A tool () automatically analyzes application source code () for application level vulnerabilities. The tool integrates seamlessly into the software development process, so vulnerabilities are found early in the software development life cycle, when removing the defects is far cheaper than in the post-production phase. Operation of the tool is based on static analysis, but makes use of a variety of techniques, for example methods of dealing with obfuscated code. 166-. (canceled)67. A computer-implemented method for evaluating a computer program , the method comprising:receiving, into a memory of a computer, source code of the computer program to be analyzed, the source code including invocations of specified methods;constructing, using a source code analyzer running on the computer, a control flow graph representing a flow of the computer program, while replacing the invocations with stubs in the control flow graph when the source code of the specified methods is unavailable;analyzing the control flow graph, while the graph contains at least some of the stubs, in order to identify a security vulnerability in the source code; andreporting the identified security vulnerability.68. The method according to claim 67 , and comprising claim 67 , when the source code is available for a given method claim 67 , replacing a corresponding stub with a single-method control flow graph.69. The method according to claim 67 , wherein the invocations refer to parameters used by the specified methods claim 67 , and wherein replacing the invocations with the stubs comprises inserting in the control flow graph at least one stub that uses but does not update the parameters of a corresponding method.70. The method according to claim 69 , wherein the at least one stub belongs to a first stub type claim 69 , replacing a first method invocation claim 69 , and wherein replacing the invocations with the stubs comprises identifying a second method invocation for which the parameters influence a ...

AUTOMATED SECURITY ASSESSMENT OF BUSINESS-CRITICAL SYSTEMS AND APPLICATIONS

Systems and methods which provide a new application security assessment framework that allows auditing and testing systems to automatically perform security and compliance audits, detect technical security vulnerabilities, and illustrate the associated security risks affecting business-critical applications. 1. A method for assessing a security configuration of a target computer system , the method comprising:a) scanning previously provided IP addresses and ports;b) fingerprinting detected open ports to identify underlying services for said open ports;c) detecting if said target system is active said at least one module is executed based on a configuration of said module;', 'said target computer system is for executing business-critical applications., 'd) accessing a database of modules and executing at least one of said modules, said modules being for determining security vulnerabilities accessible through said IP addresses and ports wherein'}3. A method according to wherein at least one of said modules is executed based on a method comprising:aa-1) determining a scope of said at least one module, said scope for each module being predetermined and coded into each module;aa-2) in the event said scope is for a system, executing a function of said module once per target system;aa-3) in the event said scope is for a component, executing a function of said module for one specific connector associated with a specific target component;aa-4) in the event said scope is for a connector, executing a function of said module for a specific connector.4. A method according to wherein at least one of said modules executes a method comprising:bb-1) receiving at least one program identifier from a user; bb-2-1) connecting to a gateway for said target system;', 'bb-2-2) attempting to initiate a specific server associated with said program identifier on a host for a program identified by said program identifier;, 'bb-2) for each of said at least one program identifier,'}bb-3) ...

Automated Detection of Flaws and Incompatibility Problems in Information Flow Downgraders

Mechanisms for evaluating downgrader code in application code with regard to a target deployment environment. Downgrader code in the application code is identified. Based on an input string, an output string that the downgrader code outputs in response to receiving the input string is identified. One or more sets of illegal string patterns are retrieved. Each of the one or more sets of illegal string patterns is associated with a corresponding deployment environment. The illegal string patterns are string patterns that a downgrader identifies in the information flow for security purposes. A determination is made as to whether the downgrader code is compatible with the target deployment environment based on the one or more sets of illegal string patterns and the output string. An output indicative of the results of the determining is generated. 1. A method , in a data processing system , for evaluating downgrader code in application code with regard to a target deployment environment , comprising:identifying, by an application analysis mechanism of the data processing system, the downgrader code in the application code, wherein the downgrader code is a portion of code in the application code that operates on an information flow of the application code to ensure confidentiality of information input to the downgrader code, in the output of the downgrader code;generating, by the application analysis mechanism, based on an input string, an output string that the downgrader code outputs in response to receiving the input string;retrieving, from a storage system associated with the data processing system, one or more sets of illegal string patterns, wherein each of the one or more sets of illegal string patterns is associated with a corresponding deployment environment, and wherein the illegal string patterns are string patterns that a downgrader identifies in the information flow for security purposes;determining, by the application analysis mechanism, whether the ...

DETECTING SECURITY VULNERABILITIES IN WEB APPLICATIONS

Method to detect security vulnerabilities includes: interacting with a web application during its execution to identify a web page exposed by the web application; statically analyzing the web page to identify a parameter within the web page that is constrained by a client-side validation measure and that is to be sent to the web application; determining a server-side validation measure to be applied to the parameter in view of the constraint placed upon the parameter by the client-side validation measure; statically analyzing the web application to identify a location within the web application where the parameter is input into the web application; determining whether the parameter is constrained by the server-side validation measure prior to the parameter being used in a security-sensitive operation; and identifying the parameter as a security vulnerability. 1. A method comprising:interacting with a web application during its execution to identify a web page exposed by the web application;statically analyzing the web page to identify a parameter within the web page that is constrained by a client-side validation measure and that is to be sent to the web application;determining a server-side validation measure to be applied to the parameter in view of the constraint placed upon the parameter by the client-side validation measure;statically analyzing the web application to identify a location within the web application where the parameter is input into the web application;determining whether the parameter is constrained by the server-side validation measure prior to the parameter being used in a security-sensitive operation; andidentifying the parameter as a security vulnerability where the parameter is not constrained by the server-side validation measure prior to the parameter being used in the security-sensitive operation.2. The method of further comprising identifying the parameter within the web page claim 1 , wherein the parameter is a hidden parameter.3. The ...

DISTRIBUTED PROCESSING SYSTEM, DISTRIBUTED PROCESSING METHOD AND COMPUTER-READABLE RECORDING MEDIUM

A distributed processing system is used in which a plurality of machines including a virtual machine constructed by cloud computing perform distributed execution of a task. Machines to each include: a communication unit that acquires environment information relating to the environment of another machine other than the own machine; an information acquisition unit that acquires environment information relating to the environment of the own machine; a risk calculation unit that calculates a risk for the case where the own machine executes the task based on the acquired environment information; a risk determination unit that determines whether or not the calculated risk is equal to or higher than a predetermined threshold; and an execution control unit that stops execution of the task on the own machine when the risk determination unit determines that the risk is equal to or higher than the predetermined threshold. 1. A distributed processing system including a plurality of machines that perform distributed execution of a task , each machine comprising:a communication unit that acquires environment information relating to an environment of another machine other than the own machine;an information acquisition unit that acquires environment information relating to an environment of the own machine;a risk calculation unit that calculates a risk for a case where the own machine executes the task based on the acquired environment information of said another machine and the acquired environment information of the own machine;a risk determination unit that determines whether or not the calculated risk is equal to or higher than a predetermined threshold; andan execution control unit that stops execution of the task on the own machine when the risk determination unit determines that the risk is equal to or higher than the predetermined threshold.2. The distributed processing system according to claim 1 , whereinany of the plurality of machines is a virtual machine constructed ...

SECURITY STATUS AND INFORMATION DISPLAY SYSTEM

Systems and methods disclosed herein provide a local security component on a mobile device that may acquire data concerning a current configuration of the mobile device. The local security component may receive raw or partially processed data about events on the mobile device. The received data may be processed against a database containing identification data for security threats and against the current mobile device configuration data to assess a security state of the mobile device. The processing may include assigning a severity level for each event. The local security component may output to the mobile device the security state assessment results, including a first assessed security state of the mobile device. The raw or partially processed data about events on the mobile device may be transmitted to a server for processing. A second assessed security state of the mobile device may be received at the mobile device from the server. 1. A method comprising the steps of:providing a local security component on a mobile device;acquiring by the local security component data concerning a current configuration of the mobile device;receiving at the local security component from one or more other applications running on the mobile device raw or partially processed data about events on the mobile device;processing the received data by the local security component against a database containing identification data for security threats and against the current mobile device configuration data to assess a security state of the mobile device, the processing including assigning by the local security component a severity level for each event;outputting by the local security component to the mobile device the security state assessment results, including a first assessed security state of the mobile device by the local security component for display of the current security state assessment on a mobile device display home screen;transmitting the raw or partially processed data about ...

REMEDIATION OF COMPUTER SECURITY VULNERABILITIES

A computer security vulnerability remediation system (CSVRS) is disclosed, including a CSVRS client communicatively coupled to a remediation server through a network. The CSVRS client includes software having a security vulnerability, which vulnerability may be known to malicious actors who develop an exploit. In some cases, the exploit is a “zero-day exploit,” meaning the vulnerability may not be known to the CSVRS client until the exploit is deployed. A RSP receives information about the exploit and vulnerability from a team of remediation experts. The RSP may prepare a remedial exploit, which carries a self-healing pay load. The remedial exploit may be delivered either through the vulnerability itself, or through credentials granted by the CSVRS client to the RSP. The self-healing pay-load takes appropriate action, such as closing ports or disabling scripts, to prevent the vulnerability from being further exploited. 1. A tangible data storage medium having stored thereon executable software instructions that are configured , when executed , to instruct a processor to:communicate with a client computing device;evaluate the client computing device to determine whether the client computing device is subject to a known security vulnerability; the remedial exploit is configured to exploit the security vulnerability to gain privileged access to the client computing device and deliver thereto a self-healing payload; and', "the self-healing payload configured to take a remedial action to reduce the client machine's exposure to the security vulnerability."], 'upon determining that the client computing device is subject to the vulnerability, deliver a remedial exploit to the client computing device, wherein2. The tangible storage medium of wherein the remedial action is selected from group consisting of disabling selected forms of scripting claim 1 , modifying firewall rules claim 1 , disabling services claim 1 , modifying registry settings claim 1 , downloading programs ...

Method, System And Apparatus For Improving Security Level Of A Terminal When Surfing Internet

A method, system, and apparatus for improving security level of a terminal when it surfs the Internet. The method includes receiving, by a network side, network security information reported by a terminal, generating a network security policy according to the network security information reported by each terminal, and transmitting a security indication to the network security policy to the terminal; providing, by the terminal, a security prompt for network information to be obtained or having been obtained according to the security indication. Various embodiments can improve the security level of the terminal when it surfs the Internet and save resources of the terminal.

Detecting Application Harmful Behavior and Grading Application Risks for Mobile Devices

In one embodiment, a method determines a permission list from an application and generates a set of potential behaviors. The potential behaviors are associated with actions that the application allows when executing on a mobile device where the potential behaviors are determined without execution of the application. The method then determines functional category information regarding a functional category from a set of application marketplaces that contain the application and determines application description information for the application. A required behavior list is generated including a set of required behaviors from the functional category information and the application description information. The method compares the required behaviors to the potential behaviors to determine a set of security related behaviors. The security related behaviors are behaviors found in the potential behaviors, but not in the required behaviors. A security rating is determined based on the set of security related behaviors.

Remote Security Self-Assessment Framework

A system for security self-assessment for a computer platform. The system comprises a memory, a processor, and an application stored in the memory. When executed by the processor, the application in association with a call to action transmits security self-assessment logic and at least one security self-assessment policy to a computer platform, wherein the security self-assessment policy defines at least one scan tool to be used by the security self-assessment logic when executed on the computer platform to perform a security self-assessment of the computer platform. The system further comprises a plurality of scan tools stored in the memory and accessible for downloading by the computer platform. The security self-assessment logic is configured to cause a processor of the computer platform to download at least one scan tool defined by the security self-assessment policy and to perform a security self-assessment. 1. A system for security self-assessment of a computer platform , comprising:a memory;a processor; 'in association with a call to action, transmits security self-assessment logic and at least one security self-assessment policy to a computer platform, wherein the security self-assessment policy defines at least one scan tool to be used by the security self-assessment logic when executed on the computer platform to perform a security self-assessment of the computer platform; and', 'an application stored in the memory that, when executed by the processor,'}a plurality of scan tools stored in the memory and accessible for downloading by security self-assessment logic when executed on the computer platform,wherein the security self-assessment logic is configured to cause a processor of the computer platform to download to the computer platform the at least one scan tool defined by the security self-assessment policy from the plurality of scan tools stored in the memory, to perform a security self-assessment of the computer platform based at least in part on the ...

METHOD AND SYSTEM FOR PROTECTION AGAINST INFORMATION STEALING SOFTWARE

Methods and systems reduce exposure to a dictionary attack while verifying whether data transmitted over a computer network is a password. In one aspect, a method includes performing a search of network traffic based, at least in part, on a weak validation using a Bloom filter based on an organizational password file, determining the existence of a password in the network traffic based only on the weak validation, and determining whether to block, alert, or quarantine the network traffic based at least in part on the existence of the password in the network traffic. 1. A computer-implemented method for reducing exposure to a dictionary attack while verifying whether data transmitted over a computer network is a password , the method comprising:performing a search of network traffic based, at least in part, on a weak validation using a Bloom filter, wherein the Bloom filter is based on an organizational password file;determining the existence of a password in the network traffic based only on the weak validation; anddetermining whether to block, alert, or quarantine the network traffic based at least in part on the existence of the password in the network traffic.2. The method of claim 1 , wherein the network traffic is from at least one computerized device within an organizational perimeter to a site outside the organizational perimeter.3. The method of claim 1 , further comprising encoding an organization password file with the Bloom filter.4. The method of claim 3 , wherein passwords in the password file are configured for use by users to access sensitive resources.5. The method of claim 1 , wherein the step of analyzing the data is performed by a traffic analyzer in communication with the computer network.6. The method of claim 5 , wherein the traffic analyzer is configured to block the data from being transmitted over the network if the data is a password.7. The method of claim 1 , wherein a percent of false positives provided by the Bloom Filter is tunable.8. A ...

System and method for cyber attacks analysis and decision support

A method for cyber attack risk assessment, the method comprising operating at least one hardware processor for: collecting global cyber attack data from a networked resource; collecting organizational profile data from a user, wherein the organizational profile data comprises: types of computerized defensive controls employed by the organization, a maturity of each of the computerized defensive controls, and organizational assets each pertaining to a business environment and each associated with at least one of the computerized defensive controls; and computing a cyber attack risk of the organization in real time, by continuously performing said collecting of global cyber attack data and comparing the global cyber attack data to the organizational profile data, to compute a cyber attack risk score for each of the organizational assets.

Method and system for application-based policy monitoring and enforcement on a mobile device

A method and system for application-based monitoring and enforcement of security, privacy, performance and/or other policies on a mobile device includes incorporating monitoring and policy enforcement code into a previously un-monitored software application package that is installable on a mobile device, and executing the monitoring and policy enforcement code during normal use of the software application by a user of the mobile device.

Method and system for application-based policy monitoring and enforcement on a mobile device

A method and system for application-based monitoring and enforcement of security, privacy, performance and/or other policies on a mobile device includes incorporating monitoring and policy enforcement code into a previously un-monitored software application package that is installable on a mobile device, and executing the monitoring and policy enforcement code during normal use of the software application by a user of the mobile device.

Information System Security Based on Threat Vectors

A security system is provided. The system comprises a computer system, a memory accessible to the computer system, a data store, and an application. The data store comprises a threat catalog, wherein the threat catalog comprises a plurality of threat vectors, each threat vector comprising a plurality of fields, wherein each field is constrained to carry a value selected from a predefined list of enumerated values. The application is stored in the memory and, when executed by the computer system receives a threat report, wherein the threat report comprises an identification of at least one threat vector, determines a correlation between the at least one threat vector received in the threat report with the threat vectors comprising the threat catalog, and, based on the correlation, sends a notification to a stakeholder in an organization under the protection of the security system. 1. A security system , comprising:a computer system;a memory accessible to the computer system;a data store comprising a threat catalog, wherein the threat catalog comprises a plurality of threat vectors, wherein each threat vector of the plurality of threat vectors comprises a plurality of fields, wherein the plurality of fields comprises at least an attack type field that identifies a type of security attack, and wherein each field of the plurality of fields is constrained to carry a value of a plurality of values; and receives a threat report, wherein the threat report comprises an identification of at least one threat vector, wherein the at least one threat vector comprises at least some of the plurality of fields including the attack type field, and wherein each of the at least some of the plurality of fields is constrained to carry a value of the plurality of values,', 'determines a correlation between the at least one threat vector received in the threat report with the plurality of threat vectors comprising the threat catalog by comparing the values of the at least some of the ...

Security scanning system and method

The present disclosure provides a computer-readable medium, method, and system for determining security vulnerabilities for a plurality of application programs used to provide television services to a customer device over a communications network. The method includes running a first scanning program against a first application program relating to a control panel for the customer device; running a second scanning program against a second application program that provides Internet content to the customer device, running a third scanning program against a third application program that relates to a component management system of customer premises equipment; and correlating security vulnerabilities identified utilizing the first, second, and third scanning programs.

MINING SOURCE CODE FOR VIOLATIONS OF PROGRAMMING RULES

A method for software code analysis includes automatically processing a body of software source code () by a computer () in order to identify a group of sequences of instructions that are characterized by a common pattern. A sequence within the group containing a deviation from a norm of the common pattern is found and reported as a potential vulnerability in the software source code. 1. A method for software code analysis , comprising:automatically processing a body of software source code by a computer in order to identify a group of sequences of instructions that are characterized by a common pattern;finding a sequence within the group containing a deviation from a norm of the common pattern; andreporting the deviation as a potential vulnerability in the software source code.2. The method according to claim 1 , wherein processing the body of the software code comprises creating a document object model (DOM) of the code claim 1 , and applying the DOM in identifying the sequences.3. The method according to claim 1 , wherein processing the body of the software code comprises normalizing the code claim 1 , and identifying the sequences in the normalized code.4. The method according to claim 3 , wherein normalizing the code comprises finding in the code names of entities of a given type claim 3 , and replacing the names appearing in the code with an indicator of the type.5. The method according to claim 4 , wherein the entities whose names are replaced with the indicator of the type are selected from a group of the entities consisting of variables and constants.6. The method according to claim 4 , wherein the code is written in an object-oriented language claim 4 , and wherein the entities whose names are replaced with the indicator of the type are selected from a group of the entities consisting of classes and members.7. The method according to claim 3 , wherein normalizing the code comprises finding in the code control blocks of a given type claim 3 , each control ...

Verifying firmware integrity of a device

In one embodiment, the present invention includes a method for receiving an integrity request in a device of a computer system from a software entity external to the device, performing a measurement of firmware of the device using an integrity measurement logic of the device, analyzing a plurality of pointer structures of the device to determine whether a potential security violation exists, and sending the measurement and a status report regarding the analysis to the software entity. Other embodiments are described and claimed.

Systems and methods for implementing security in a cloud computing environment

Computer systems and methods are provided in which an agent executive, when initially executed in a virtual machine, obtains an agent API key from a user. This key is communicated to a grid computer system. An agent identity token, generated by a cryptographic token generation protocol when the key is valid, is received from the grid and stored in a secure data store associated with the agent executive. Information that evaluates the integrity of the agent executive is collected using agent self-verification factors. The information, encrypted and signed with a cryptographic signature, is communicated to the grid. Commands are sent from the grid to the agent executive to check the security, compliance, and integrity of the virtual machine processes and data structures. Based on these check results, additional commands are sent by the grid to the agent executive to correct security, compliance or integrity problems and/or to prevent security compromises.

System and method for determining and using local reputations of users and hosts to protect information in a network environment

A method in an example embodiment includes correlating a first set of event data from a private network and determining a local reputation score of a host in the private network based on correlating the first set of event data. The method further includes providing the local reputation score of the host to a security node, which applies a policy, based on the local reputation score of the host, to a network communication associated with the host. In specific embodiments, the local reputation score of the host is mapped to a network address of the host. In further embodiments, the first set of event data includes one or more event indicators representing one or more events, respectively, in the private network. In more specific embodiments, the method includes determining a local reputation score of a user and providing the local reputation score of the user to the security node.

Unified scan management

A particular scan set to be performed on at least a portion of a computing environment is identified. A particular scan engine, in a plurality of scan engines, is identified that is adapted to perform at least one scan in the particular scan set, each scan engine in the plurality of scan engines adapted to perform one or more scans on one or more host devices in the computing environment. A request is sent to the particular scan engine to perform the at least one scan in the particular scan set and scan result data is received from the particular scan engine corresponding to the at least one scan in the particular scan set.

SYSTEMS, METHODS, APPARATUSES AND COMPUTER PROGRAM PRODUCTS FOR PROVIDING MOBILE DEVICE PROTECTION

Systems, methods, apparatuses and computer program products for providing mobile device protection. Some example embodiments provide for analyzing the current risks associated with a user's mobile device and providing solutions to improve the security of the mobile device. Further, some example embodiments provide for analysis of the hardware and software configuration of a mobile device, the applications installed on a mobile device, the accounts on a mobile device, the user data stored on or accessed from a mobile device, and/or the current location of a mobile device and then comparing this device data to known risk data to provide a user with an increased awareness of the current risks associated with a mobile device. 1. A method comprising:receiving information regarding a system configuration of a mobile device;receiving information regarding a location of the mobile device;determining a risk profile by at least comparing the received information to known risk information;generating a risk report based at least in part on the risk profile, the risk report comprising a system risk component and a location risk component; andcausing the risk report to be presented via the mobile device.2. The method of claim 1 , further comprising receiving information regarding applications installed on the mobile device claim 1 , and wherein the risk report further comprises an application risk component.3. The method of claim 2 , wherein the application risk component comprises one or more of: one or more recommended protection applications claim 2 , one or more recommended changes to one or more application settings claim 2 , or one or more categories of missing protection applications.4. The method of claim 3 , further comprising receiving selection of at least one of the one or more recommended protection applications and claim 3 , in response claim 3 , providing for the purchase and/or installation of the selected application.5. The method of claim 1 , further comprising ...

GENERATING VULNERABILITY REPORTS BASED ON APPLICATION BINARY INTERFACE/APPLICATION PROGRAMMING INTERFACE USAGE

A method for generating vulnerability reports based on application binary interface/application programming interface usage may include extracting, by a processing device, a binary file and a security report relating to a software program executed by the processing device, the security report having a vulnerability list of pending vulnerabilities relating to the software program, detecting, from the binary file, interface usage details associated with interfaces used by the software program and associated with shared libraries used by the software program, wherein the interfaces comprise application programming interfaces (APIs) corresponding to rules that the software program follows to access and use services and resources provided by another software program, matching the interface usage details with the pending vulnerabilities of the vulnerability list, and generating a vulnerability report based on the matching, wherein the vulnerability report comprises a list of the pending vulnerabilities based on their associated interface usage. 1. A method comprising:extracting, by a processing device, a binary file and a security report relating to a software program executed by the processing device, the security report having a vulnerability list of pending vulnerabilities relating to the software program;detecting, from the binary file, interface usage details associated with interfaces used by the software program and associated with shared libraries used by the software program, wherein the interfaces comprise application programming interfaces (APIs) corresponding to rules that the software program follows to access and use services and resources provided by another software program;matching the interface usage details with the pending vulnerabilities of the vulnerability list; andgenerating a vulnerability report based on the matching, wherein the vulnerability report comprises a list of the pending vulnerabilities based on their associated interface usage.2. The ...

SYSTEMS, METHODS AND COMPUTER READABLE MEDIA FOR CALCULATING A SECURITY INDEX OF AN APPLICATION HOSTED IN A CLOUD ENVIRONMENT

The present invention provides a method and system for calculating a security index of an application hosted in a cloud environment. The application is mapped to a cloud service provider of the cloud environment, and a set of security controls and a set of security metrics applicable for the application are identified. The set of security controls and the set of security metrics are encapsulated into a security profile object by a security control module. A set of values of the set of security metrics are retrieved from the cloud service provider, by a cloud probe module, and the security index of the application is calculated. 1. A system for calculating a security index of an application hosted in a cloud environment , the system comprising:an application module, configured to receive an identifier of the application and a list of cloud service providers from a user;a security control module, configured to receive a set of security controls;assign a set of security metrics to the set of security controls; andcreate a security profile object for the application;a cloud probe module, configured to retrieve a set of values of the set of security metrics from the cloud environment; anda measurement engine configured to calculate the security index of the application, based on the retrieved values of the set of security metrics and the security profile object.2. The system of claim 1 , wherein the application module is further configured to:map the identifier of the application to a cloud service provider; andmodify, the identifier of the application, and the list of cloud service providers.3. The system of claim 1 , wherein the set of security controls is received from a security policy module claim 1 , whereby the security policy module is configured to import the set of security controls from an enterprise security policy system.4. The system of claim 1 , wherein the set of security controls is received from the user.5. The system of claim 1 , wherein the security ...

Method for simulation aided security event management

A method for simulation aided security event management, the method comprises: generating attack simulation information that comprises multiple simulation data items of at least one data item type out of vulnerability instances data items, attack step data items and attack simulation scope data items; wherein the generating of attack simulation information is responsive to a network model, at least one attack starting point and attack action information; identifying security events in response to a correlation between simulation data items and event data; and prioritizing identified security events. 1. A method for simulation aided security event management , the method comprises: generating attack simulation information that comprises multiple simulation data items of at least one data item type out of vulnerability instances data items , attack step data items and attack simulation scope data items; wherein the generating of attack simulation information is responsive to a network model , at least one attack starting point and attack action information; identifying security events in response to a correlation between simulation data items and event data; and prioritizing identified security events.2. The method according to comprising generating claim 1 , by a first computer claim 1 , attack simulation information; and identifying security events claim 1 , by a second computer claim 1 , in response to the attack simulation information and to actual network event information.3. The method according to comprising determining a correlation between a simulation data item and event data by comparing between key fields of the simulation data item and corresponding key fields of the event data.4. The method according to comprising defining field based correlation rules and specific simulated event correlation rules; and applying the correlation rules and specific simulated event correlation rules during the identifying of the security events.5. The method according to ...

VERIFYING APPLICATION SECURITY VULNERABILITIES

Verifying application security vulnerabilities includes receiving a source code to analyze, performing a static analysis using the received source code and generating a vulnerability call trace for the received source code. Responsive to a determination that all static analysis results are not validated, mock objects are generated using the vulnerability call trace and a unit test is created using the generated mock objects. The unit test is executed using the generated mock objects and responsive to a determination that an identified vulnerability was validated; a next static analysis result is selected. Responsive to a determination that all static analysis results are validated, results and computed unit tests are reported. 1. A computer-implemented process for verifying application security vulnerabilities , the computer-implemented process comprising:receiving a source code to analyze;performing a static analysis using the received source code;generating a vulnerability call trace for the received source code;determining whether all static analysis results are validated;responsive to a determination that all static analysis results are not validated, generating mock objects using the vulnerability call trace;creating a unit test using the generated mock objects;executing, using a processor, the unit test using the generated mock objects;determining, using the processor, whether an identified vulnerability was validated;responsive to a determination that an identified vulnerability was validated, selecting a next static analysis result; andresponsive to a determination that all static analysis results are validated, reporting results and computed unit tests.2. The computer-implemented process of claim 1 , wherein performing a static analysis using the received source code further comprises:identifying an entry point and a corresponding sensitive location for potentially malicious user input in a path suspected to have vulnerabilities of the source code received. ...

DETECTING EXPLOITABLE BUGS IN BINARY CODE

Systems and methods for performing hybrid symbolic execution to detect exploitable bugs in binary code are described. In some example embodiments, the systems and methods determine that resources associated with an execution client performing symbolic execution of a target program are below, at, or above a threshold performance level, generate checkpoints for active executing paths of the online symbolic execution, and cause the execution client to perform symbolic execution in response to the determination that the resources are at or above the threshold performance level. 1. A system , comprising:a management module, implemented by at least one processor, configured to monitor resources associated with an execution client performing online or offline symbolic execution of a target program; andan execution module that is configured to cause the execution client to switch between online and offline symbolic execution based on a performance level of the monitored resources.2. The system of claim 1 , further comprising:a checkpoint module that is configured to generate checkpoints for active symbolic execution paths of the performing online or offline symbolic execution; and executing the target program using a path predicate for at least one checkpoint; and', 'identifying the active executing path based on the execution of the target program using the path predicate., 'a restoration module that is configured to restore the generated checkpoints by3. The system of claim 1 , further comprising:a checkpoint module that is configured to generate checkpoints for active symbolic execution paths of the performing online or offline symbolic execution; anda restoration module that is configured to restore the generated checkpoints by concretely executing the target program using one satisfiable assignment of a path predicate associated with the checkpoint until the target program reaches the instruction when a previous execution state was suspended.4. The system of claim 1 , ...

Reporting and Management of Computer Systems and Data Sources

A system and method are provided for managing data, such as for example security or other business data. For the example of security data, security data is received from a plurality of assets that may or may not be remotely located. A plurality of security metrics are computed and normalized according to thresholds. Security metrics are aggregated to generate an aggregate score, this may include weighting the metrics according to metric priorities. A change effort corresponding to each metric is also received and a corresponding change effort for the aggregate score is calculated. Aggregate scores and aggregate change efforts are analyzed to generate risk reduction recommendations. Upon instruction, metrics corresponding to an aggregate score may be displayed including recommendations of metrics for risk reduction. The recommended metrics may be selected according to analysis of change-to-effort ratios for the metrics.

VULNERABILITY-BASED REMEDIATION SELECTION

A machine-actionable memory comprises one or more machine-actionable records arranged according to a data structure. Such a data structure may include links that respectively map between a remediation, at least one action, and at least two vulnerabilities. A method of selecting a remediation, that is appropriate to a vulnerability which is present on a machine to be remediated, may include: providing a machine-actionable memory as mentioned above; and indexing into the memory using: a given vulnerability identifier to determine (A) at least one of a remediation mapped thereto and (B) at least one action mapped to the given vulnerability identifier; and/or a given remediation to determine at least two vulnerabilities mapped thereto. 1. A host device comprising:at least one processor;at least one memory device;a network interface device; assess a current state of the host device;', 'send information representative of the current state of the host device to a server via the network interface device;', 'receive, via the network interface device, vulnerability remediation information from the server, the vulnerability remediation information including:', 'instructions executable by the processor though the sensor program, the instructions including at least one remediation for at least one vulnerability of the host device and a plurality of T_ID fields, wherein the content of a T_ID field denotes an identification (ID) of a technology species (T) present in the host device; and', 'for each of the T_ID fields, a plurality of ACT_ID fields, wherein the content of an ACT_ID field denotes an ID of an action (ACT); and, 'a sensor program held in the at least one memory device and executable by the at least one processor toimplement the at least one remediation upon the host device through execution of the instructions of the received remediation information to mitigates the at least one vulnerability present on the host device.2. The host device of claim 1 , wherein the ...

SECURITY LEVEL VISUALIZATION DEVICE

A security level of each service is calculated and visualized. The device includes a security level calculation unit and a security level visualization unit. The security level calculation unit receives information regarding security of the service from a plurality of sensors as observation information, and calculates a security level of each service based on the received observation information and a security level calculation policy. The security level visualization unit outputs the security level of each service, based on the security level calculated by the security level calculation unit and configuration information of the service. Further, the security level calculation policy has a service, a user using the service, and an observation item to be observed in the service. The security level calculation unit calculates the security level in association with the user of the service and the service, based on the security level calculation policy. 1. A security level visualization device which calculates and visualizes a security level of a system including a plurality of services , the device comprising:a security level calculation unit which receives information regarding security of the services from a plurality of sensors, as observation information, and calculates a security level of each of the services based on the received observation information and a security level calculation policy held by the security level visualization device; anda security level visualization unit which outputs the security level of each of the services, based on the security level of each of the services which is calculated by the security level calculation unit and configuration information of the service which is held by the security level visualization device.2. The security level visualization device according to claim 1 ,wherein the security level calculation policy has the services, a user using the service, and an observation item to be observed in the service; andthe ...

ASSET RISK ANALYSIS

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for asset risk analysis. One method includes receiving threat definition data for threats, vulnerability detection data for assets, and countermeasure detection data for assets. The method further includes determining a respective risk metric for each of the assets for each of the threats. This includes analyzing the vulnerability detection data for an asset to determine whether the asset is vulnerable to a threat, determining from the threat definition data and the countermeasure detection data whether the asset is protected by one of the countermeasures identified for the threat, and determining the risk metric for the asset for the threat according to whether the asset is vulnerable to the threat and whether the asset is protected by one of the countermeasures identified for the threat. 133-. (canceled)34. A method comprising:determining whether a particular asset is vulnerable to a particular threat;determining whether the particular asset is protected from the particular threat by one or more countermeasures in a set of countermeasures including at least one network-based countermeasure and at least one agent-based countermeasure, wherein determining whether the particular asset is protected from the particular threat includes determining a likelihood that one or more of the network-based countermeasures protects the particular asset and determining a likelihood that one or more of the agent-based countermeasures protects the particular asset; anddetermining, using at least one data processing apparatus, a risk metric for the particular asset for the particular threat according to whether the particular asset is vulnerable to the particular threat and whether the particular asset is protected by one or more of the countermeasures for the particular threat.35. The method of claim 34 , wherein the risk metric is further based on determining claim 34 , for each of a ...

Detecting anomalies in real-time in multiple time series data with automated thresholding

An approach is provided for detecting an anomaly in a processing environment. The approach includes using a processor to obtain a series of values collected within a processing interval of the processor in the processing environment. The processor normalizes this first series of values to obtain a first series of normalized values. A second series of normalized values is generated by applying a predictive filter to the first series of normalized values. A comparison score is generated from the normalized values by comparing the first series of normalized values and the second series of normalized values. The approach then determines whether the comparison score represents an anomaly relative to at least one other comparison score derived from values collected within the processing interval.

Collective Threat Intelligence Gathering System

Threat intelligence is collected from a variety of different sources. The threat intelligence information is aggregated, normalized, filtered and scored to identify threats to an information network. Threats are categorized by type, maliciousness and confidence level. Threats are reported to network administrators in a plurality of threat feeds, including for example malicious domains, malicious IP addresses, malicious e-mail addresses, malicious URLs and malicious software files.

Static analysis for discovery of timing attack vulnerabilities in a computer software application

Discovering timing attack vulnerabilities in a computer software application by statically analyzing instructions of a computer software application to identify multiple possible execution paths traversing any of the instructions, calculating, for each of the possible execution paths, a cost associated with the execution of the instructions traversed by the possible execution path, comparing the costs of at least two of the possible execution paths having inputs of the same size, and identifying as a timing attack vulnerability any of the compared possible execution paths whose cost differs, by at least a predetermined amount, from the cost of any other of the compared possible execution paths.

SYSTEMS AND METHODS FOR GENERATING RISK ASSESSMENTS

Aspects of the present disclosure involve methods and systems for generating risk assessments that quantify real-time and/or near real-time threats, risks, dangers, hazards, uncertainties, and/or vulnerabilities for businesses, governments, cities, and/or other types of communities. One or more interfaces may be generated for receiving threat assessment data. The threat assessment data is processed to generate one or more risk assessments and/or risk summaries. 1. A threat assessment system application comprising: receive threat assessment data corresponding to a community, the threat assessment data including a vulnerability assessment, a capability and capacity assessment, and a hazard assessment;', 'process the vulnerability assessment, the capability and capacity assessment, and the hazard assessment to calculate at least one risk assessment score quantifying a risk of a threat associated with the community; and', 'transmit the at least one risk assessment score for display., 'at least one processor to2. The system of claim 1 , wherein the at least one processor is further configured to generate one or more interactive interfaces for receiving the threat assessment data.3. The system of claim 1 , wherein to transmit the at least one risk assessment for display comprises:generating a risk assessment summary including the at least one risk assessment score, a first percentage corresponding the vulnerability assessment, a second percentage corresponding the capability and capacity assessment, and a third percentage corresponding to the hazard assessment; anddisplaying the risk assessment summary.4. The system of claim 1 , wherein processing the vulnerability assessment claim 1 , the capability and capacity assessment claim 1 , and the hazard assessment to calculate the at least one risk assessment score comprises:calculating a consequence value corresponding to the threat, the consequence value quantifying the impact of the threat occurring on the community; ...

SYSTEM AND METHOD FOR ENABLING REMOTE REGISTRY SERVICE SECURITY AUDITS

The system and method for enabling remote registry service security audits described herein may include scanning a network to construct a model or topology of the network. In particular, the model or topology of the network may include characteristics describing various devices in the network, which may be analyzed to determine whether a remote registry service has been enabled on the devices. For example, the security audits may include performing one or more credentialed policy scans to enable the remote registry service for certain devices that have disabled the remote registry service, auditing the devices in response to enabling the remote registry service, and then disabling the remote registry service on the devices. Thus, the system and method described herein may enable remotely scanning information contained in device registries during a security audit without exposing the device registries to malicious activity. 120-. (canceled)21. A computer system for enabling remote registry service security audits for a plurality of devices in a network having a remote registry service , comprising: identify at least one of the plurality of devices in the network that has disabled the remote registry service;', 'communicate an activation message to the identified at least one device, wherein the activation message enables the remote registry service on the identified at least one device;', 'interact with the enabled remote registry service on the identified at least one device to obtain registry information; and', 'communicate a deactivation message to the at least one identified device in response to obtaining the registry information, wherein the deactivation message disables the remote registry service on the identified at least one device., 'an active vulnerability scanner device configured to scan the network to detect a vulnerability in the network, wherein the active vulnerability scanner device is configured to22. The computer system of claim 21 , wherein the ...

System and method to provide automatic classification of phishing sites

A phishing classification model that detects a phishing website based on one or more feature vectors for the website is provided. The phishing classification model may operate on a server and may further select a website, generate a feature vector for a landing page of the website, create a feature vector for every iframe that is a descendent of the landing page, and derive a final feature vector from the feature vectors of the landing page and the descendent iframe pages. Further, machine learning techniques may be applied to generate, or train, a classification model based upon one or more known phishing websites. Based on the feature vector, the classification modeler may classify a website as either a phishing website or as a non-phishing website. Feedback in the form of human verification may further be incorporated.

System and method for detecting a security compromise on a device

Embodiments of a system and method for detecting a security compromise on a device are described. Embodiments may be implemented by a content consumption application configured to protect content decryption keys on a device, such as a computer system (e.g., a desktop or notebook computer) or a mobile device (e.g., a smartphone or tablet). For instance, the content consumption application may be configured to provide decryption keys for respective content to a media component (or another component of the operating system) if multiple conditions have been met. For instance, in various embodiments, the content consumption application may pass the key to the media component after ensuring that i) one or more security mechanisms of the device operating system have not been compromised and ii) one or more executable instructions of the content consumption application have not been tampered (e.g., instructions corresponding to a function that handles the decryption key(s)).

Expert system for detecting software security threats

An instance of a vulnerability risk management (VRM) module and a vulnerability management expert decision system (VMEDS) module are instantiated in a cloud. The VMEDS module imports scan results from a VRM vulnerability database and saves them as vulnerabilities to be reviewed in a VMEDS database. The VMEDS module converts vulnerabilities into facts. The VMEDS module builds a rule set in the knowledge base to verify whether certain vulnerabilities are false positives. Rules related to a vulnerability are received in plain English from a web-based front-end application. The VMEDS module tests each rule against all of the facts using the Rete algorithm. The VMEDS module executes the action associated with the rule derived from the Rete algorithm. The VMEDS module stores the results associated with the executing of the action in the VMEDS database and forwards the results to the VRM module.

SYSTEM AND METHOD FOR LIMITING EXPLOITABLE OR POTENTIALLY EXPLOITABLE SUB-COMPONENTS IN SOFTWARE COMPONENTS

Approaches for limiting exploitable or potentially exploitable sub-components in software components are disclosed. In certain implementations, a first software component in the component creation environment may be identified. The first software component may include a first sub-component that provides a function that is exploitable or potentially exploitable to compromise the first software component. The first sub-component may be disabled such that the function provided by the first sub-component is not available via the first software component when the first software component is executed. The first software component may be placed in the component repository after the first sub-component is disabled such that the first software component is placed in the component repository without availability of the function provided by the first sub-component. In some implementations, disabling the first sub-component may comprise removing the first sub-component from the first software component. 1. A computer-implemented method of limiting exploitable or potentially exploitable sub-components in software components that are created in a component creation environment before placing the software components in a component repository that is separate from the component creation environment , the method being implemented by a computer system that includes one or more processors programmed with one or more computer program instructions , the method comprising:identifying, by the computer system, at least a first software component in the component creation environment, the first software component including a first sub-component that provides a function that is exploitable or potentially exploitable to compromise the first software component;identifying, by the computer system, the first sub-component;disabling, by the computer system, the first sub-component such that the function provided by the first sub-component will not be available via the first software component ...

SYSTEM AND METHOD FOR REPLACING SOFTWARE COMPONENTS WITH CORRESPONDING KNOWN-GOOD SOFTWARE COMPONENTS WITHOUT REGARD TO WHETHER THE SOFTWARE COMPONENTS HAVE BEEN COMPROMISED OR POTENTIALLY COMPROMISED

Approaches for replacing software components executing in a runtime environment with corresponding known-good software components are disclosed. In some implementations, at least a first event indicating that at least a first software component executing in the runtime environment should be replaced may be determined. The first event may be determined without respect to whether the first software component has been compromised or potentially compromised. At least a second software component corresponding to the first software component may be obtained from a component repository that is separate from the runtime environment. The first software component may be replaced with the second software component based on the first event such that the second software component is available for use in the runtime environment after the first event and the first software component is no longer available for use in the runtime environment after the first event. 1. A computer-implemented method of replacing software components executing in a runtime environment with corresponding known-good software components without regard to whether the software components executing in the runtime environment have been compromised or potentially compromised , the method being implemented by a computer system that includes one or more processors programmed with one or more computer program instructions , the method comprising:determining, by the computer system, at least a first event indicating that at least a first software component executing in the runtime environment should be replaced, the first event being determined without respect to whether the first software component has been compromised or potentially compromised;obtaining, by the computer system, at least a second software component from a component repository that is separate from the runtime environment, wherein the second software component corresponds to the first software component; andreplacing, by the computer system, the ...

Method for Scalable Analysis of Android Applications for Security Vulnerability

A method for scalable analysis of Android applications for security includes applying Android application analytics to an Android application, which in turn includes applying an application taint tracking to the Android application and applying application repacking detection to the Android application, and determining security vulnerabilities in the Android application responsive to the analytics. 1. A method for scalable analysis of Android applications for security vulnerability comprising the steps of: applying an application taint tracking to said Android application;', 'applying application repacking detection to said Android application; and, 'applying Android application analytics to an Android application, said applying comprisingdetermining security vulnerabilities in said Android application responsive to said analytics.2. The method of claim 1 , wherein said application taint tracking comprises a descrying information leakage procedure and an application vulnerability espial procedure to said Android application.3. The method of claim 2 , wherein said descrying information leakage procedure comprises leak detection of at least one of a phone number claim 2 , contact list claim 2 , browsing history claim 2 , voice messages claim 2 , SMS messages claim 2 , and photos.4. The method of claim 2 , wherein said application vulnerability espial procedure comprises at least one of controlling hijack claim 2 , permission re-delegation claim 2 , and unauthorized data access.5. The method of claim 1 , wherein said application repacking detection comprises detecting at least one repacked malware and piracy software.6. The method of claim 1 , wherein said application taint tracking comprises an application taint analysis that includes a preprocessing and static taint analysis of said Android application.7. The method of claim 6 , wherein said preprocessing comprises subjecting said Android application to unpacking and then Dalvik bytecode claim 6 , manifest and ...

METHOD AND DEVICE FOR PROMPTING PROGRAM UNINSTALLATION

The present disclosure discloses method and device for prompting program uninstallation and belongs to the field of the Internet. The method comprises: performing a security assessment of an application program installed on a mobile terminal, thereby obtaining a security assessment result; obtaining security identification information corresponding to the security assessment result based on pre-stored correlations between security assessment results and security identification information; establishing a correlation between the obtained security identification information and the application program, and displaying the correlation to a user. By performing a security assessment of an application program installed on a mobile terminal, obtaining security identification information, and establishing a correlation between the security identification information and the application program, a user can quickly uninstall and clean up malware with hidden security issues based on the security identification information, thereby safeguarding safe running of the mobile terminal. 1. A method of prompting program uninstallation , comprising:obtaining a security assessment result associated with a security assessment of an application program installed on a mobile terminal,obtaining security identification information corresponding to the security assessment result based on correlations between security assessment results and security identification information,establishing a correlation between the obtained security identification information and the application program, anddisplaying the established correlation.2. The method of claim 1 , wherein obtaining the security assessment result comprises:obtaining attribute information of the application program installed on the mobile terminal.3. The method of claim 2 , wherein obtaining the security assessment result comprises:performing the security assessment of the application program based on the obtained attribute information.4. ...

Method for testing the security of an electronic device against an attack, and electronic device implementing countermeasures

A method of testing security of an electronic device against a combination of a side-channel attack and a fault-injection attack implemented during a method of cryptographic processing that includes: delivering a message signature based on a secret parameter and implementing a recombination of at least two intermediate values according to the Chinese remainder theorem; and verifying the signature on the basis of at least one public exponent. The method of testing includes: transmitting a plurality of messages to be signed by said electronic device; disturbing each message, including modifying the message by inserting an identical error for each message, before executing a step of determining one of the intermediate values; and analyzing physical measurements, obtained during the step of verifying the signature as a function of the message to be signed, the identical error for each message, and an assumption of a value of part of the secret parameter.

Static security analysis using a hybrid representation of string values

Systems for constructing hybrid string representations include a string parser configured to parse received string information to produce one or more string components, a database configured to store a set of known concretizations, and a processor configured to compare the one or more string components to the set of known concretizations to determine string components that may be represented concretely, to abstract all string components that could not be represented concretely, and to create a hybrid string representation that includes at least one concrete string component and at least one abstracted string component.

DYNAMIC RISK MANAGEMENT

A dynamic risk management system for operating systems that provides monitoring, detection, assessment, and follow-up action to reduce the risk whenever it rises. The system enables an operating system to protect itself automatically in dynamic environments. The risk management system monitors a diverse set of attributes of the system which determines the security state of the system and is indicative of the risk the system is under. Based on a specification of risk levels for the various attributes and for their combinations, the risk management system determines whether one or more actions are required to alleviate the overall risk to the system. 1. A method performed on a computing device , the method comprising:determining a risk level; andinitiating, in response to the determined risk level exceeding a threshold, a plurality of risk-alleviation actions that are configured for alleviating one or more risks considered in the determining the risk level.2. The method of where the determining is in response to a change in a security state.3. The method of where the change is detected based on an assessment that comprises monitoring system components of the computing device.4. The method of where the determining is further in response to risk factors identified by the assessment.5. The method of where the assessment is configured for identifying risk factors including a host security profile of the computing device.6. The method of where the assessment is configured for identifying risk factors including a network security profile of the computing device.7. The method of where the assessment is configured for identifying risk factors including a software risk profile of the computing device.8. At least one computer storage medium storing computer-readable instructions that claim 4 , when executed on a computing device claim 4 , cause the computing device to perform actions comprising:determining a risk level; andinitiating, in response to the determined risk level ...

Customizing a security report using static analysis

Respective edge weights are assigned to edges of a plurality of paths in a control flow graph representing a model of data flow of a computer program. Edge weights assigned to each edge are processed to determine a total edge weight for the respective paths, the total edge weight for a respective path being a sum of the edge weights assigned to the respective edges of the path. At least one path in the control flow graph whose total edge weight satisfies a particular total edge weight criteria can be identified, and the control flow graph can be updated to indicate to the user the at least one path in the control flow graph whose total edge weight satisfies the particular total edge weight criteria. The updated control flow graph can be presented to the user.

Method and apparatus for paralleling and distributing static source code security analysis using loose synchronization

A method of static source code analysis is provided. A forward search of source code is performed from each of a plurality of source nodes. A backward search of source code is performed from each of a plurality of sink nodes, wherein the forward search and the backward search are performed in parallel simultaneously. The progress of the forward search and the backward search are monitored to determine if the searches intersect at a common node. A vulnerability alert is generated when the monitoring determines that a forward search and a backward search reach a common node.

Customizing a security report using static analysis

Respective edge weights are assigned to edges of a plurality of paths in a control flow graph representing a model of data flow of a computer program. Edge weights assigned to each edge are processed to determine a total edge weight for the respective paths, the total edge weight for a respective path being a sum of the edge weights assigned to the respective edges of the path. At least one path in the control flow graph whose total edge weight satisfies a particular total edge weight criteria can be identified, and the control flow graph can be updated to indicate to the user the at least one path in the control flow graph whose total edge weight satisfies the particular total edge weight criteria. The updated control flow graph can be presented to the user.

Systems and Methods for Runtime Adaptive Security to Protect Variable Assets

A method of adapting a security configuration of a data processing application at runtime, and a system, together with its computing architecture, are disclosed. The system stores a causal network comprising a plurality of nodes and a plurality of incoming and outgoing causal links associated therewith, wherein each node of the causal network is associated with a security concern or a requirement that can be affected by any configuration of the security controls. The current value of assets nodes, as well as those of the security concerns that can be affected by monitored contextual factors, are updated. The control nodes corresponding to the security controls is updated according to the security configuration whose utility is evaluated by the causal network. The node corresponding to the at least one variable is updated with the determined current value, which is propagated through the causal network through the causal links associated with the updated node. The security configuration with the highest utility is selected and replaces the actual configuration by activating and/or deactivating the security functions corresponding to security control nodes enabled/disabled in the selected security configuration. 1. A method of adapting a security configuration in a data processing application processed by a data processing device , wherein the adaptation is based on changes of assets associated with the security configuration and/or factors representative of the context of the data processing application , the method comprising the steps ofstoring a fuzzy causal network comprising a plurality of nodes and a plurality of incoming and outgoing causal links associated therewith, wherein at least application variables and security functions are assigned respective nodes,determining a current value of at least one application variable,determining a current security configuration as a set of security function nodes,updating the node corresponding to the at least one ...

System, method, and apparatus to mitigaterisk of compromised privacy

Various exemplary embodiments relate to a method and related network node including one or more of the following: retrieving a record of a first transaction, wherein the first transaction is associated with personally identifiable information of an owner; determining a first privacy risk value based on: a first transaction security metric associated with the first transaction, wherein the first transaction security metric includes a first set of security parameters, and a first set of weights correlated to the first set of security parameters; determining the current security status based on the first privacy risk value; and transmitting the current security status to the entity.

Correcting workflow security vulnerabilities via static analysis and virtual patching

A computer program can be statically analyzed to determine an order in which client side workflows are intended to be implemented by the computer program. A virtual patch can be generated. When executed by a processor, the virtual patch can track web service calls from a client to the computer program, and determine whether the order of the web service calls from the client to the computer program correlate to the order in which client side workflows are intended to be implemented by the computer program. If the order of the web service calls from the client to the computer program do not correlate to the order in which client side workflows are intended to be implemented by the computer program, an alert can be generated.

SECURITY REMEDIATION

A method is provided to remediate defects in first computer program code that can be used to configure a computer to produce code for use by the same or a different computer configured using second computer program code to use the produced code to produce output information, the method comprising: configuring a computer to perform static analysis of the first program to produce an information structure in a non-transitory computer readable storage device that associates a respective code statement of the first program code with a respective context, wherein the context associates a parser state with a potential defect in the produced code; identify a defect in the first computer program code that is associated with the respective code statement; and determining a remediation for the identified defect. 1. A method to remediate a defect in first computer program code that can be used to configure a computer to produce code for use by the same or a different computer configured using second computer program code to use the produced code to produce output information , the method comprising: produce an information structure in a non-transitory computer readable storage device that associates a respective code statement of the first program code with a respective context, wherein the respective context associates a parser state associated with the produced code with a potential defect in the produced code;', 'identify a defect type in the first computer program code that is associated with the respective code statement; and, 'configuring a computer to perform static analysis of the first program to,'}determining a remediation for the identified defect type to be applied to the first computer program code based upon at least the identified defect, the context associated with the respective code statement and a technology used by the first computer program code to produce the respective code statement.2. The method of claim 1 ,{'b': '3', 'claim-ref': {'@idref': 'CLM-00001 ...

CORRECTING WORKFLOW SECURITY VULNERABILITIES VIA STATIC ANALYSIS AND VIRTUAL PATCHING

A computer program can be statically analyzed to determine an order in which client side workflows are intended to be implemented by the computer program. A virtual patch can be generated. When executed by a processor, the virtual patch can track web service calls from a client to the computer program, and determine whether the order of the web service calls from the client to the computer program correlate to the order in which client side workflows are intended to be implemented by the computer program. If the order of the web service calls from the client to the computer program do not correlate to the order in which client side workflows are intended to be implemented by the computer program, an alert can be generated. 1. A method for correcting workflow security vulnerabilities , the method comprising:statically analyzing, via a first processor, client side code of a computer program to determine an order in which client side workflows are intended to be implemented by the computer program; and tracking web service calls from a client to the computer program;', 'determining whether the order of the web service calls from the client to the computer program correlate to the order in which client side workflows are intended to be implemented by the computer program; and', 'responsive to determining that the order of the web service calls from the client to the computer program do not correlate to the order in which client side workflows are intended to be implemented by the computer program, generating an alert; and, 'based on the static analysis, generating a virtual patch configured to, when executed by the first processor or a second processor, perform executable operations comprisingconfiguring the virtual patch to be applied to a processing system hosting the computer program.2. The method of claim 1 , further comprising:statically analyzing the client side code of the computer program to determine whether at least one security vulnerability exists in the ...

SYSTEMS AND METHODS FOR TRAINING SYSTEMS TO DETECT SOFTWARE BUGS

A method is disclosed and includes receiving, using a first client computing system, an instance from an administrative computing system. The instance includes a partition of computing resources of the administrative computing system. The partition of computing resources includes a virtual processor and first machine-readable instructions. The first machine-readable instructions include a first predefined software bug. The method includes executing, using the virtual processor, the first machine-readable instructions. Executing the first machine-readable instructions includes receiving, using the virtual processor, a first input indicating an identification of the first predefined software bug of the first machine-readable instructions. Executing the first machine-readable instructions includes transmitting, using the virtual processor, a first signal associated with the first input to the administrative computing system, wherein the first signal causes the administrative computing system to generate a score associated with the first client computing system in response to verification by the administrative computing system. 1. A method comprising: the instance comprises a partition of computing resources of the administrative computing system;', 'the partition of computing resources comprises a virtual processor and first machine-readable instructions; and', 'the first machine-readable instructions comprise a first predefined software bug;, 'receiving, using a first client computing system, an instance from an administrative computing system, wherein receiving, using the virtual processor, a first input indicating an identification of the first predefined software bug of the first machine-readable instructions; and', 'transmitting, using the virtual processor, a first signal associated with the first input to the administrative computing system, wherein the first signal causes the administrative computing system to generate a score associated with the first client ...

SENSOR DATA ANOMALY DETECTOR

Methods and systems are provided that are effective to generate an alarm for a vehicle. The methods include receiving, by a device, a first sensor value from a first sensor for the vehicle. The methods further include receiving, by the device, a second sensor value from a second sensor for the vehicle. The methods further include retrieving, by the device, an instruction from a memory disposed in the vehicle while the memory is in a write-protected mode. The methods further include evaluating, by the device, the first sensor value and the second sensor value based on the instruction. The methods further include determining, by the device, that the first sensor value is outside a range associated with the first sensor based on the evaluation. The methods further include transforming, by the device, the determination into an alarm. 1. A method to detect an attack on a vehicle , the method comprising:receiving a sensor value from a sensor associated with the vehicle;in response to receiving the sensor value, generating sample data to be written onto a memory which is disposed in the vehicle;attempting to write the generated sample data to the memory;detecting an attack on the vehicle based on a determination that the attempt to write the generated sample data to the memory is unsuccessful; andgenerating an alarm that is indicative of the detected attack on the vehicle.2. The method of claim 1 , wherein receiving the sensor value from the sensor comprises receiving a value of a speed of the vehicle from a speedometer associated with the vehicle.3. The method of claim 1 , wherein the memory is configured to operate in one of a write-access mode and a write-protected mode.4. The method of claim 3 , further comprising:activating the write-access mode for the memory, while the vehicle is stopped; andactivating the write-protected mode for the memory, while the vehicle is in motion.5. The method of claim 1 , wherein detecting the attack on the vehicle comprises detecting one ...

Generating an automated security analysis for an installation

A method, with the aid of which an installation-wide security consideration may be carried out, that is not limited only to automation components of a single manufacturer, but that functions across all manufacturers, is provided. Through suitable user guidance and automated support in process-conforming execution of assessments, incident handling and the definition of security measures as well as corresponding tracking, the method has a high level of user-friendliness. A rule generator uses security criteria in order to develop user-specific analysis rules from a complex rulebook with a number of input values. All the installation-relevant data is automatically compiled in an inventory. The machine security auditor applies the user-specific rulebook to the collected installation data from the asset inventory, and from that, prepares the audit trail.

AUTOMATED MAPPING FOR IDENTIFYING KNOWN VULNERABILITIES IN SOFTWARE PRODUCTS

Systems, methods, and computer-readable for identifying known vulnerabilities in a software product include determining a set of one or more processed words based on applying text classification to one or more names associated with a product, where the text classification is based on analyzing a database of names associated with a database of products Similarity scores are determined between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products. Equivalence mapping is performed between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores. Known vulnerabilities in the product are identified based on the equivalence mapping. 1. A method comprising:determining a set of one or more processed words based on applying text classification to one or more names associated with a product, wherein the text classification is based on analyzing a database of names associated with a plurality of products;determining similarity scores between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products; andperforming equivalence mapping between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores.2. The method of claim 1 , wherein the names associated with the plurality of products are based on a first naming convention and the names associated with the one or more known vulnerabilities are defined using a second naming convention claim 1 , the first naming convention being different from the second naming convention.3. The method of claim 1 , wherein analyzing the database of names associated with the plurality of products comprises:splitting one or more complex words into component word units based on performing word boundary detection ...

CENTRALIZED NETWORK ENVIRONMENT FOR PROCESSING VALIDATED EXECUTABLE DATA BASED ON AUTHORIZED HASH OUTPUTS

A centralized network environment is provided for processing validated executable data based on authorized hash outputs. In particular, the system may generate cryptographic hash outputs of code or software that has been evaluated (e.g., within a virtual environment). The system may then store the hash outputs within a hash database which may be accessible by multiple entity networks, where multiple entities may upload hash output values to and/or retrieve hash output values from the hash database. Based on the data within the hash database, each entity may efficiently identify code that may be safe or unsafe to execute on certain computing systems within its network environment. The system may further comprise an artificial intelligence-powered component which may be configured to detect patterns within code that has been identified by the system as unsafe and provide notifications containing systems likely to be affected and recommended countermeasures. 1. A system for a centralized network environment for processing validated executable data based on authorized hash outputs , the system comprising:a memory device with computer-readable program code stored thereon;a communication device; and receive, from a first entity computing system, a first hash output value of a first set of executable code, wherein the first set of executable code contains unauthorized code;', 'store the first hash output value within an authorization database;', 'detect an attempt to execute a second set of executable code within a second entity computing system;', 'generate a second hash output value of the second set of executable code;', 'compare the second hash output value with one or more hash values within the authorization database; and', 'based on comparing the second hash output value with the one or more hash values, perform validation of the second set of executable code., 'a processing device operatively coupled to the memory device and the communication device, wherein the ...

COMPLIANCE METHOD FOR A CYBER-PHYSICAL SYSTEM

The present invention provides for analysis of cyber-physical systems with relation to compliance requirements such as regulatory compliance, maintenance compliance and safety compliance. Generally, the invention provides for a set of paths from an initial state to an end state, and analyzing the paths to determine which ones contain a violation state. Based on the resultant paths test scripts are generated. Additionally, other compliance related procedures can be performed utilizing the path analysis. 1. A method of adjusting a cyber-physical system having a plurality of components with at least one of said components being a digital component and at least one of said components being a physical component , said method comprising:(a) describing each of said plurality of components and defining at least one compliance penalty as a quality associated with at least one component of said plurality of components wherein said compliance penalty results from said at least one component being noncompliant with a compliance requirement;(b) defining an initial state for said cyber-physical system;(c) generating a set of paths, wherein each path comprises at least one event necessary for transition from said initial state to an end state, which transition can include passage through one or more intermediate states in transit from said initial state to said end state, and wherein said at least one event is indicative of how actions and time can alter said initial state or said one or more intermediate states;(d) identifying a set of violation paths from said set of paths where each violation path contains at least one violation state in which said at least one component is noncompliant with said compliance requirement;(e) identifying said compliance penalty associated with said violation state; and(f) adjusting said cyber-physical system to prevent said at least one component becoming noncompliant by one of said violation paths and thus preventing said compliance penalty.2. ...

SEMANTIC RESTRICTION

In one implementation, a data sharing system can comprise a trust engine to identify an environment that satisfies a level of trust, an access engine to request access to a set of data, a procedure engine to receive a procedure, a restriction engine to receive a semantic restriction associated with a semantic term of the environment, a tracker engine to track the procedure during execution, and a control engine to maintain execution of the procedure based on the restriction and trace information. In another implementation, a method for sharing a set of data can comprise validating an environment satisfies a level of trust, receiving a procedure to access the set of data, receiving a semantic restriction associated with a semantic term of the environment, tracing the procedure during execution, and providing a view of the set of data based on the restriction and a semantic mapping of trace information. 1. A data sharing system comprising:a trust engine to identify an environment that satisfies a first level of trust of a first entity and a second level of trust of a second entity;an access engine to request access to a set of data associated with the first entity;a procedure engine to receive a procedure from the second entity and execute the procedure in the environment, the procedure to request access to the set of data via the access engine and the environment to classify an instruction of the procedure based on a semantic mapping;a restriction engine to receive a restriction associated with execution of he procedure in the environment, the restriction mapable to a semantic term;a tracker engine to track the procedure during execution and produce trace information associated with the semantic mapping; anda control engine to maintain execution of the procedure based on the semantic term associated with the restriction and the semantic mapping associated with the trace information.2. The system of claim 1 , wherein the restriction maps to one of a data structure ...

Visual display of risk-identifying metadata for identity management access requests

An identity management system is augmented to enable a manager to associate “risk” metadata with different types of access requests representing computer system accounts that can be requested by authorized users. When an authorized user then requests access to a particular account, any “risk” associated with that access is shown to the user, typically in the form of a visual “badge” or other such indicator. The badge includes an appropriate informational display (e.g., “High Risk” or “Regulated”) that provides an appropriate risk warning. The risk metadata badge information preferably also is displayed for risk-based access request approval routing; in such context, the risk metadata may also determine the risk approval workflow itself. Thus, for example, if the risk metadata is present when the authorized user requests access, an approval workflow may be modified so that the request approval is routed appropriately. 1. A method of identifying a risk associated with access to one or more computer system accounts , comprising:for at least one access request type, receiving data that associates risk metadata with a type of visual indicator;displaying a user interface that includes request access options to access the one or more computer system accounts; anddisplaying a graphic element in association with at least one of the request access options in the user interface, the graphic element being defined by the risk metadata and the type of visual indicator to identify the risk associated with access to the computer system account;wherein the receiving and displaying operations are carried out in software executing in a hardware element.2. The method as described in wherein the risk metadata defines one of: a risk associated with requesting access claim 1 , a handling requirement claim 1 , an approval requirement claim 1 , and a compliance requirement.3. The method as described in wherein the risk metadata and the type of visual indicator define an appearance of the ...

VERIFICATION OF TRUSTED THREAT-AWARE MICROVISOR

A trusted threat-aware microvisor may be deployed as a module of a trusted computing base (TCB). The microvisor is illustratively configured to enforce a security policy of the TCB, which may be implemented as a security property of the microvisor. The microvisor may manifest (i.e., demonstrate) the security property in a manner that enforces the security policy. Trustedness denotes a predetermined level of confidence that the security property is demonstrated by the microvisor. The predetermined level of confidence is based on an assurance (i.e., grounds) that the microvisor demonstrates the security property. Trustedness of the microvisor may be verified by subjecting the TCB to enhanced verification analysis configured to ensure that the TCB conforms to an operational model with an appropriate level of confidence over an appropriate range of activity. The operational model may then be configured to analyze conformance of the microvisor to the security property. A combination of conformance by the microvisor to the operational model and to the security property provides assurance (i.e., grounds) for the level of confidence and, thus, verifies trustedness. 1. A method comprising:verifying a security property for an operational model of a microvisor adapted for deployment in a node of a network, wherein the operational model is created in a functional programming language;generating an executable of the operational model;initiating a state dump of the executable operational model;initiating a corresponding state dump of the microvisor;iteratively comparing the states of the executable operational model and the microvisor; andcontinuing iterative comparison of the states of the executable operational model and the microvisor until a predetermined number of the states match, wherein the predetermined number of matched states correspond to a predetermined level of confidence that the security property is implemented by the microvisor.2. The method of wherein the ...

APPLICATION NEGOTIABLE RESOURCE DIRECTOR TECHNOLOGY FOR EFFICIENT PLATFORM RESOURCE MANAGEMENT

Systems, apparatuses and methods may provide for technology that automatically determines a first proposed change to an existing resource allocation associated with a first application in a first node, wherein the first proposed change is determined at least partially based on a requested resource allocation associated with a pending application and a first tolerance associated with the first application. The technology may also issue the first proposed change to the first application and automatically conduct the first proposed change if the first application accepts the first proposed change. 1. A computing system comprising:a network controller;a processor coupled to the network controller; and determine a first proposed change to an existing resource allocation associated with a first application in a first node of the computing system, wherein the first proposed change is to be determined at least partially based on a requested resource allocation associated with a pending application and a first tolerance associated with the first application,', 'issue the first proposed change to the first application via a first bi-directional interface, and', 'conduct the first proposed change if the first application accepts the first proposed change via the first bi-directional interface., 'a memory coupled to the processor, the memory including a set of executable program instructions, which when executed by the processor, cause the processor to2. The computing system of claim 1 , wherein the first proposed change is to include a reduction to the existing resource allocation within a tolerable limit specified by the first application claim 1 , and wherein the instructions claim 1 , when executed claim 1 , further cause the processor to:conduct the requested resource allocation on the first node, andactivate the pending application on the first node.3. The computing system of claim 1 , wherein the first proposed change is to include a migration of the first application to ...

DETERMINING APPLICATION ATTACK SURFACE FOR NETWORK APPLICATIONS

Systems, methods, and computer-readable media for attack surface score computation can include the following processes. An attack surface score service receives information identifying open ports associated with an application. The attack surface score service determines an attack surface score for the application based on the information and common attack ports. A policy engine determines whether to implement a policy for reducing vulnerability of the application to attacks to yield a determination. The policy engine implements a vulnerability reduction policy based on the determination. 1. A method comprising:receiving information identifying open ports associated with an application;determining based on the information and common attack ports, an attack surface score for the application;determining, based on the attack surface score, whether to implement a policy for reducing vulnerability of the application to attacks to yield a determination; andimplementing a vulnerability reduction policy based on the determination.2. The method of claim 1 , wherein the information includes identification of open ports and unused open ports associated with the application claim 1 , a vulnerability score of the application claim 1 , a process hash evaluation of the application claim 1 , and an allowed ports list of the application.3. The method of claim 1 , wherein determining the attack surface score is based on the information and one or more unused ports from the common attack ports.4. The method of claim 1 , wherein determining the attack surface score is further based on a common vulnerability score associated with the application.8. A device comprising:one or more memories having computer-readable instructions stored therein; andone or more processors configured to execute the computer-readable instructions to:receive information identifying open ports associated with an application;determine based on the information and common attack ports, an attack surface score for ...

BIOMETRIC RECOGNITION ATTACK TEST METHODS, APPARATUSES, AND DEVICES

Methods, systems, and apparatus for operations for performing a biometric recognition attack test on a biometric recognition device. An example method includes obtaining a test object for performing the biometric recognition attack test corresponding to the target user; performing the biometric recognition attack test on the biometric recognition device, comprising: controlling a mechanical arm to place the test object in a recognition area of the biometric recognition device; controlling the mechanical arm to adjust the test object to have a plurality of different test object poses with respect to the biometric recognition device; obtaining a test result for the test object in each test object pose of the plurality of different test object poses; and determining an attack test result of the biometric recognition attack test on the biometric recognition device corresponding to the target user. 1. A computer-implemented method for performing a biometric recognition attack test on a biometric recognition device , wherein the method comprises:obtaining, based on information about a target user to be tested, a test object for performing the biometric recognition attack test corresponding to the target user, wherein the test object comprises a test image or a physical model of a body part of the target user corresponding to the biometric recognition attack test; controlling a mechanical arm to place the test object in a recognition area of the biometric recognition device;', 'controlling the mechanical arm to adjust the test object to have a plurality of different test object poses with respect to the biometric recognition device;', 'obtaining a test result for the test object in each test object pose of the plurality of different test object poses; and, 'performing the biometric recognition attack test on the biometric recognition device, comprisingdetermining, based on the test result for the test object in each test object pose of the plurality of different test ...

REAL-TIME FEATURE LEVEL SOFTWARE SECURITY

Systems and techniques for real-time feature level software security are described herein. A request may be received from a computing device for data from the feature of the software application. The request for data may include authorization information of a user of the computing device. It may be identified that the feature of the software application contains code containing a reference to a security configuration service. A security configuration may be determined for the feature of the software application by comparing a resource identifier and a feature identifier of the feature of the software application to a set of security configurations of the security configuration service. The security configuration may provide access rules for the feature of the software application. A response may be sent to the computing device based on a comparison of the received authorization information of the user of the computing device to the determined security configuration. 1. A system for providing security for a feature of a software application in real-time , the system comprising:at least one processor; and receive a request, from a computing device, for data from the feature of the software application, the feature of the software application including code containing a reference to a security configuration service;', 'determine a security configuration for the feature of the software application by comparing identifiers of the feature to a set of security configurations of the security configuration service, the security configuration providing access rules for the feature of the software application;', 'determine, using the security configuration, that a first data item identified in the request for data should be encrypted before transmission and a second data item identified in the request for data should be transmitted unencrypted;', 'encrypt the first data item using an encryption algorithm; and', 'send a response including the encrypted first data item and the ...

IMPROVED APPLICATION DEPLOYMENT

A computer implemented method of improved security of an application for deployment to a virtualized computing environment, the method including receiving configuration information for the application; accessing a set of configuration descriptors for a known security attack, each descriptor encoding at least a portion of an application configuration so as to identify one or more descriptors matching at least part of the configuration information, each descriptor in the set having a probability that the security attack will occur in a deployed application having a configuration consistent with the descriptor; evaluating a risk score for a risk of occurrence of the security attack, the risk score evaluated from the probabilities associated with the identified descriptors; identifying a set of compatible alternative configurations for the application; evaluating a risk score for a risk of occurrence of the security attack for each alternative configuration; selecting an alternative configuration having a risk score meeting a predetermined threshold; and adjusting the application configuration information to implement the selected alternative configuration. 1. A computer implemented method of improved security of an application for deployment to a virtualized computing environment , the method comprising:receiving configuration information for the application;accessing a set of configuration descriptors for a known security attack, each configuration descriptor in the set encoding at least a portion of an application configuration so as to identify one or more configuration descriptors matching at least part of the configuration information, each configuration descriptor in the set having a probability that the known security attack will occur in a deployed application having a configuration consistent with the configuration descriptor;evaluating a risk score for a risk of occurrence of the known security attack, the risk score evaluated from the probabilities ...

EXECUTION ENVIRONMENT AND GATEKEEPER ARRANGEMENT

A computer system has a separation mechanism which enforces separation between at least two execution environments such that one execution environment is a gatekeeper which interposes on all communications of the other execution environment. The computer system has an attestation mechanism which enables the gatekeeper to attest to properties of the at least two execution environments. A first one of the execution environments runs application specific code which may contain security vulnerabilities. The gatekeeper is configured to enforce an input output policy on the first execution environment by interposing on all communication to and from the first execution environment by forwarding, modifying or dropping individual ones of the communications according to the policy. The gatekeeper provides evidence of attestation both for the application specific code and the policy. 1. A computer system comprising:at least two execution environments;a separation mechanism which enforces separation between the at least two execution environments such that one execution environment is a gatekeeper which interposes on all communications of the other execution environment;an attestation mechanism which enables the gatekeeper to attest to properties of the at least two execution environments;a first one of the execution environments running application specific code which may contain security vulnerabilities;the gatekeeper configured to enforce an input output policy on the first execution environment by interposing on all communication to and from the first execution environment by forwarding, modifying or dropping individual ones of the communications according to the policy;such that outgoing communications from the first execution environment are sent out of the computer system according to the policy and incoming communications to the first execution environment are accepted according to the policy; andwhere the gatekeeper provides evidence of attestation both for the ...