Bitdefender Ipr Management Ltd.

Constantin D Cernat

Ovidiu M Craciun

Paul D Boca

Adrian Budau

Daniel I A Fetti

Bogdan C Firuti

In some embodiments, a security chatbot comprises a generative language module (GLM) and a prompt manager configured to dynamically update the GLM input prompt according to the output of the GLM. The input prompt instructs the GLM to carry out a task (e.g., determine whether a target message received by a user is indicative of online fraud) and in response, to output a specific flag token. In response to detecting the flag token within the output of the GLM, the prompt manager may selectively execute a code snippet identified according to the respective flag token. Executing the code snippet effectively updates the prompt, which is then fed back to the GLM for the next inference step. In contrast to conventional LLM prompting, updates to the prompt herein comprise modifications (e.g., insertion of other flag tokens, etc.) other than merely appending an inferred token to the previous prompt. Furthermore, the prompt modifications are performed inline, i.e., without submitting an entirely new prompt to the GLM.

Logical language model prompts for fraud detection

Described systems and methods protect client devices such as personal computers and IoT devices against harmful or inappropriate Internet content. When a client uses an encrypted handshake to hide the identity of the end server, e.g., in applications implementing an encrypted client hello (ECH), some embodiments employ a modified DNS server to provide a surrogate key to the client instead of the genuine handshake key. A traffic filter executing for instance on a network gateway may then intercept and decrypt the handshake and apply an access policy to selectively allow or deny access to the respective end server. When access is allowed, the traffic filter may re-encrypt the server identifier using the genuine handshake key before forwarding the handshake to its destination. Communication privacy is maintained since the illustrated methods only decrypt the handshake, and not the actual payload.

Privacy-preserving filtering of encrypted traffic via handshake decryption and re-encryption

Described systems and methods enable protecting client devices (e.g., personal computers and IoT devices) implementing encrypted DNS protocols against harmful or inappropriate Internet content. A DNS proxy intercepts an attempt to establish an encrypted communication session between a client device and a DNS server. Without decrypting any communications, some embodiments of the DNS proxy determine an identifier of the respective session and an identifier of the client device, and send a query tracer connecting the session identifier with the client identifier to a security server. In some embodiments, the security server obtains the domain name included in an encrypted DNS query from the DNS server and instructs the DNS server to allow or block access of the client device to the respective Internet domain according to a device- and/or user-specific access policy.

Growing community of inventors

Buchare, Romania

Constantin D Cernat