Nortonlifelock Inc.

Gen Digital Inc.

Symantec Corporation

Ca, Inc.

Daniel Kats

Daniel Marino

Kevin Alejandro Roundy

Acar Tamersoy

David Luz Silva

Petros Efstathopoulos

Yun Shen

Christopher Gates

Johann Roturier

Michael Andrew Hart

Matteo Dell'Amico

Brian Schlatter

Ilya Sokolov

Qing Li

Michael Spertus

Lei Gu

Yufei Han

Chris Gates

Brian Varner

Stanley Kiefer

Mahmood Sharif

Dong Chung

Trijimon Padmalayam Rajan

Manjunath Rajendrababu

Platon Kotzias

Steven Meckl

Jung Hui Yoon

A computer-implemented method for preventing social media harassment may include (i) intercepting a message sent by a sender to a user via a social media service, (ii) performing topic modeling on content of the message, where the topic modeling is customized based on at least one harassment topic relevant to the user, (iii) calculating, based at least in part on the topic modeling, a probability that the message is harassment targeted at the user, and (iv) blocking the message in response to determining that the probability that the message is harassment meets a threshold for harassment probability. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing social media harassment

The disclosed computer-implemented method for verifying social media accounts to prevent identity-based attacks on social media platforms may include (i) detecting identity data for an owner of a set of auxiliary social media accounts on a group of client devices, (ii) verifying, a core social media account, based at least in part on the detected identity data, (iii) linking the auxiliary social media accounts to the core social media account, (iv) signing a social media post originating from a linked auxiliary social media account by storing a unique identification of the social media post as a record on a publicly readable permissioned ledger (e.g., a blockchain), and (v) performing a security action that prevents an identity-based attack against third parties accessing the social media post by confirming that the social media post is legitimate based on the record. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for verifying social media accounts to prevent identity-based attacks on social media platforms

The disclosed computer-implemented method for managing privacy policy violations may include obtaining, by the computing device, an intermediate representation of a privacy policy, wherein the intermediate representation denotes a formal policy and is generated by extracting the privacy policy in natural language from a website and parsing the privacy policy. The method may also include comparing, by the computing device, behavior of the website against the intermediate representation, thereby detecting at least one violation of the formal policy. The method may further include enforcing, by the computing device, the formal policy at least in part by taking a security action in response to the violation. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing privacy policy violations

The disclosed computer-implemented method for utilizing telemetry data to customize threat protection actions against potential malware threats may include (i) detecting telemetry data on a group of client devices, (ii) determine customer type data and threat type data for the client devices based on the telemetry data, (iii) group the client devices into one or more threat clusters based on the customer type data and the threat type data, and (iv) perform a security action that protects against potential malware threats associated with each of the threat clusters. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for utilizing telemetry data to customize threat protection actions against potential malware threats

The disclosed computer-implemented method for detecting malware based on anomalous cross-customer financial transactions may include (i) detecting, using a machine-learning algorithm, a set of anomalies associated with fraudulent financial transactions for source user accounts in a group of customer financial accounts, (ii) identifying, based on customer transaction metadata associated with a group of target user accounts in the customer financial accounts, a cluster of financial transactions having anomaly instances in common with the set of anomalies, (iii) linking each of the customer financial accounts having the common anomaly instances in the cluster of financial transactions with a corresponding customer threat protection account to discover a user device identification, (iv) determining that artifacts appearing on a group of user devices are associated with a potential malware attack, and (v) performing a security action that protects against the potential malware attack. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting malware based on anomalous cross-customer financial transactions

Location-based anomaly detection based on geotagged digital photographs. In some embodiments, a method may include identifying a completed transaction associated with a user. The method may also include determining a transaction geographic location associated with the completed transaction. The method may further include identifying a mobile device associated with the user. The method may also include identifying one or more geotagged digital photographs taken by the mobile device. The method may further include extracting one or more photograph geographic locations from the one or more geotagged digital photographs. The method may also include, in response to determining that the transaction geographic location is not within a threshold distance of any of the one or more photograph geographic locations, identifying the completed transaction as a suspicious transaction and performing a remedial action.

Location-based anomaly detection based on geotagged digital photographs

A computer-implemented method for protecting data on devices may include (i) identifying a device that is operated by a user and that comprises private data pertaining to the user, (ii) determining that stalkerware on the device is sending the private data to an unauthorized device not operated by the user, (iii) requesting, in response to determining that the stalkerware is sending the private data to the unauthorized device, that the user select at least one safety plan step from a set of safety plan options, and (iv) modifying, at least in part based on the safety plan step selected by the user, outgoing data sent by the stalkerware to the unauthorized device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting data on devices

A computer-implemented method for detecting coordinated propagation of social media content may include calculating, by a computing device, a content similarity score for each social media post in relation to other social media posts in a set of social media posts. The method may also include identifying a related subset of social media posts based on the content similarity score. Additionally, the method may include detecting one or more clusters of social media posts in the related subset by clustering social media posts based on content similarity scores and timing. Furthermore, the method may include determining that a user account associated with a social media post in a detected cluster is in a coordinated network of user accounts. Finally, the method may include performing a security action in response to determining that the user account is in the coordinated network. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting coordinated propagation of social media content

The disclosed computer-implemented method for authenticating digital media content may include (i) receiving digital media content that has been captured by a capturing device and digitally signed through a cryptoprocessor embedded within the capturing device to provide an assurance of authenticity regarding how the capturing device captured the digital media content, and (ii) encoding an identifier of the received digital media content and a digital signature to an encrypted distributed ledger, the digital signature including at least one of a digital signature of the digital media content by the capturing device or a digital signature of the digital media content by an entity encoding the received digital media content such that the encoding becomes available for subsequent verification through the encrypted distributed ledger. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for authenticating digital media content

The disclosed computer-implemented method for customizing security alert reports may include (i) identifying a local machine learning model that predicts how a client responds to security alerts generated for the client, (ii) identifying a set of peer machine learning models that predict how a set of peers of the client each responds to security alerts generated for each respective peer, (iii) measuring a level of similarity between the client and each respective peer of the set of peers according to a similarity metric to create a similarity model, (iv) aggregating the local machine learning model and at least one of the set of peer machine learning models based on the similarity model to create an aggregated machine learning model, and (v) protecting the client by applying the aggregated machine learning model to customize an electronically displayed security alert report. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for customizing security alert reports

The disclosed computer-implemented method for protecting users may include (i) identifying a first light-and-radio frequency signature that was captured by a security device based on signals emanating from a mobile computing device at a first time and location, (ii) identifying a second light-and-radio frequency signature that was captured by a same or different security device based on signals emanating from the same mobile computing device at a second time and location, (iii) determining that the first light-and-radio frequency signature and the second light-and-radio frequency signature match such that an inference is made that an individual possessing the mobile computing device was present at both the first time and location and the second time and location, and (iv) performing, based on the inference, a security action to protect a user. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting users

Adaptive security filtering on a client device. A method may include applying a data filter to a client device to obtain a first set of data associated with the client device, determining a risk level of a datum of the first set of data, determining a resource level associated with obtaining the first set of data, adjusting the data filter to an adjusted filter based on the determined risk level of the datum and the determined resource level, and applying the adjusted filter to the client device.

Adaptive security filtering on a client device

The disclosed computer-implemented method for crowd-storing encryption keys may include (i) sending, from a client computing device and to a server, a recovery request, (ii) creating a first public-private key pair, (iii) receiving a plurality of encrypted shares of an encryption key from the server in response to the recovery request, where the encrypted shares are encrypted with a first public key of the first public-private key pair, and (iv) performing a security action including (A) decrypting the plurality of encrypted shares of the encryption key with a first private key of the first public-private key pair and (B) recovering the encryption key from the decrypted plurality of shares of the encryption key. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for crowd-storing encrypiion keys

The disclosed computer-implemented method for generating user profiles may include (i) analyzing a data set of user profiles for services, (ii) detecting a measurement of obfuscation that was applied to a specific attribute across multiple user profiles for a specific service, (iii) applying the measurement of obfuscation to true data for a new user by fuzzing the true data to create a fuzzed value, and (iv) generating automatically a new user profile for the specific service by populating the specific attribute within the new user profile with the fuzzed value. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Culver City, CA, United States of America

Daniel Kats