Gen Digital Inc.

Nortonlifelock Inc.

Symantec Corporation

Ca, Inc.

Johann Roturier

David Luz Silva

Yun Shen

Iskander Sanchez Rola

Pratyush Banerjee

Petros Efstathopoulos

Daniel Kats

Leylya Yumer

Daniel Marino

Slawomir Grzonkowski

Andrew Delaney

Julia Schinharl

Preserving web page functionality through dynamic analysis of host web pages. Web pages accessed by a user device may be monitored. The web browser may apply a blocking policy that blocks an external domain from loading functional content into the web page, which results in a breakage in the web page. The breakage in the web page may be identified through a dynamic analysis of the web page and correlated with the functional content from the blocked external domain. Once identified and correlated, the blocking policy may be modified to allow the external domain to load the functional content and reloading the web page.

Preserving web page functionality through dynamic analysis of host web pages

The disclosed computer-implemented method for managing privacy policy violations may include obtaining, by the computing device, an intermediate representation of a privacy policy, wherein the intermediate representation denotes a formal policy and is generated by extracting the privacy policy in natural language from a website and parsing the privacy policy. The method may also include comparing, by the computing device, behavior of the website against the intermediate representation, thereby detecting at least one violation of the formal policy. The method may further include enforcing, by the computing device, the formal policy at least in part by taking a security action in response to the violation. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing privacy policy violations

Distinguishing between functional tracking domains and nonfunctional tracking domains on a host web page. In particular, a list of known tracking domains that load content into host web pages may be received. This list of tracking domains may include tracking domains that are functional and tracking domains that are nonfunctional. The tracking domains that are functional may be determined by evaluating various behaviors and characteristics of the tracking domains. Once functional tracking domains have been determined, these functional tracking domains may be allowed, and other tracking domains may be blocked from loading content onto host web pages thereby preserving the functionality of the web pages.

Distinguishing between functional tracking domains and nonfunctional tracking domains on a host web page

The disclosed computer-implemented method for preventing social engineering attacks using distributed fact checking may include (i) capturing one or more words or tones received by a party to a communication, (ii) extracting speech features associated with the words or tones to identify one or more alleged facts in the communication, (iii) generating one or more queries to verify the alleged facts in the communication, (iv) determining, utilizing distributed fact checking, whether the alleged facts are true based on the queries, and (v) performing a security action that generates an alert to protect against a potential social engineering attack on the receiving party when at least one of the alleged facts are determined to be false. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing social engineering attacks using distributed fact checking

Knowledge-aware detection of attacks on a client device conducted with dual-use tools. A method may include obtaining dual-use tool data related to a plurality of dual-use tools; collecting from a client device, by the computing device, user input related to the use of a dual-use tool of the plurality of dual-use tools; determining that the user input contains a feature of the dual-use tool data; creating a behavioral index of the user input, the behavioral index stored on the client device; detecting new input on the client device; determining a similarity level between the user input and the new input; flagging a malicious attack on the client device based on determining that the similarity level does not satisfy a pre-determined threshold; and implementing a security action on the client device based on flagging the malicious attack.

Knowledge-aware detection of attacks on a client device conducted with dual-use tools

The disclosed computer-implemented method for selectively encrypting controlled information for viewing by an augmented reality device may include (i) automatically identifying, at a computing device and using at least one of natural language processing and/or a pre-defined data loss prevention policy, a portion of a source text including controlled information, (ii) tokenizing the portion of the source text, and (iii) performing a security action that may include (A) generating a public key, (B) encrypting the tokenized portion of the source text with the public key to produce an encrypted marker, and (C) replacing the portion of the source text with the encrypted marker to produce a replacement document. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for selectively encrypting controlled information for viewing by an augmented reality device

Methods and systems are provided for monitoring private information exposure. One example method generally includes detecting, at a computing device, a potentially exposing post on a publicly-accessible server and determining, by an exposure model operated by the computing device, an exposure chance for the potentially exposing post. The method further includes transmitting an initial notification of the potentially exposing post from the computing device to a client device based on the exposure chance from the exposure model and detecting an update event associated with the potentially exposing post. The method further includes updating the exposure model based on the update event and transmitting a personalized notification from the computing device to the client device based on the update event.

User-based cyber risk communications using personalized notifications

Uniform Resource Locator (URL) transformation and redirection with access control. A method may include registering for an account with a secure redirection application; requesting, from the secure redirection application, a unique site identifier for an online entity; receiving, from the secure redirection application, the unique site identifier; submitting user data and the received unique site identifier to the online entity; receiving, from the online entity, a unique URL generated by the secure redirection application, in response to submitting the user data and the received unique site identifier to the online entity; and actuating the unique URL to be directed to the online entity.

Uniform resource locator (URL) transformation and redirection with access control

Thwarting data leakage from a webpage. In some embodiments, a method may include detecting, at a browser on the network device, a visit to the webpage, directing a headless browser on the network device to visit the webpage in parallel to the browser visiting the webpage, detecting, at the headless browser, data leakage from the webpage, presenting, at the browser, a notification regarding the data leakage that allows a user to indicate whether the data leakage should be allowed, receiving, at the browser, an indication that the data leakage should not be allowed, and in response to receiving the indication that the data leakage should not be allowed, thwarting the data leakage by performing a remedial action at the network device to protect the network device from the data leakage.

Thwarting data leakage from a webpage

Thwarting an impersonation attack using online decoy text. In one embodiment, a method may include intercepting first actual text submitted online by a first user, generating decoy text to replace the first actual text, sending the decoy text for posting online, training a machine learning model using the decoy text to make the machine learning model capable of recognizing a decoy language pattern in the decoy text, intercepting second actual text submitted to a web server by a second user purporting to be the first user, determining, using the machine learning model, that a language pattern in the second actual text matches the decoy language pattern in the decoy text, and, in response, determining that the second user is impersonating the first user in an impersonation attack and thwarting the impersonation attack by performing a remedial action at the web server to protect the web server from the impersonation attack.

Thwarting an impersonation attack using online decoy text

The present disclosure relates to security incident analysis systems, and more specifically to searching across multiple security incident analysis systems through a unified conversational agent. One example method generally includes receiving, from a client device, a natural language command requesting information about a security incident from a first incident analysis system. One or more keywords related to the security incident are extracted from the natural language command. The unified conversational agent executes a search against the first incident analysis system and one or more second incident analysis systems for the information about the security incident based on the extracted one or more keywords and transmits, to the client device, an indication of the information about the security incident aggregated from the executed search against the first incident analysis system and the one or more second incident analysis systems.

Handling computer security incidents through a unified conversational agent

The disclosed computer-implemented method for assessing security risks of users of computer networks of organizations may include (i) detecting, at a risk computing device, a location of a host electronically accessed by a user computing device, the host location having an electronic address outside of a computer network of an organization, (ii) identifying, at the risk computing device, a host user credential sent to the host location from the user computing device, (iii) determining, at the risk computing device, that the host user credential matches an organization user credential associated with the organization's computer network, and (iv) calculating, at the risk computing device, a risk score for a user of the user computing device based on the determination that the host user credential matches the organization user credential. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Maynooth, Ireland

Johann Roturier