Symantec Corporation

Nortonlifelock Inc.

Matt Boucher

Michael Shavell

Lei Gu

Kevin Bangyen Jiang

Keith Newstadt

Ilya Sokolov

Christopher Robichaud

Adam Schepis

Mark Kevin Kennedy

Robert Walters

A computer-implemented method for retrieving driver safety scores by passenger devices may include (i) determining that an operator of a mobile device is a passenger in a vehicle, (ii) gathering, via one or more sensors of the mobile device, identifying information about at least one of the vehicle and a current driver of the vehicle, (iii) identifying, based on the identifying information gathered by the one or more sensors of the mobile device, the current driver of the vehicle, (iv) retrieving a driver safety score for the current driver of the vehicle from a collection of driver safety scores, and (v) performing, by the mobile device, a security action in response to retrieving the driver safety score. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for retrieving driver safety scores by passenger devices

A computer-implemented method for generating tripwire files may include (1) generating an initial tripwire file according to an initial tripwire generation calculation, the initial tripwire file configured such that modification of the initial tripwire file triggers investigation of a security breach, (2) generating a subsequent tripwire file according to a subsequent tripwire generation calculation, the subsequent tripwire generation calculation differing from the initial tripwire generation calculation along at least one dimension, (3) receiving automated feedback that indicates whether at least one of the initial tripwire file and the subsequent tripwire file failed to enable detection of a security threat, and (4) adjusting automatic generation of a third tripwire file based on the automated feedback indicating whether at least one of the initial tripwire file and the subsequent tripwire file failed to detect the security threat. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for generating tripwire files

A computer-implemented method for preventing tracking of mobile devices may include (1) identifying, from a first device with wireless networking capability, an initial service set identifier used by the first device as identification for a wireless network, where a second device with wireless networking capability also uses the initial service set identifier, (2) determining, based at least in part on a time indicator at the first device, that the initial service set identifier is to be changed, (3) generating a new service set identifier for use by the first device instead of the initial service set identifier, where the new service set identifier is generated with an identifier generation algorithm that is also used by the second device, and (4) replacing use of the initial service set identifier by the first device with use of the new service set identifier. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing tracking of mobile devices

The disclosed computer-implemented method for detecting illegitimate devices on wireless networks may include (1) identifying an initial set of hops that represent devices on a wireless network that relay network traffic between the computing device and a destination, (2) identifying, after identifying the initial set of hops, a new set of hops that relay the network traffic between the computing device and the destination, (3) comparing the initial set of hops to the new set of hops, and (4) determining, based on the comparison, that the new set of hops comprises an abnormality that indicates an illegitimate device is intercepting the network traffic on the wireless network between the computing device and the destination. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting illegitimate devices on wireless networks

A computer-implemented method for network security may include (1) obtaining initial information that at least partially identifies an initial access point for connecting to a network, (2) after obtaining the initial information, obtaining subsequent information that at least partially identifies a subsequent access point for connecting to the same network, (3) comparing, by a security program, the initial information and the subsequent information in an attempt to detect whether the initial access point and the subsequent access point are the same, (4) detecting, based on the comparison, an indication that the initial access point and the subsequent access point are different, and (5) performing, by the security program in response to detecting the indication that the initial access point and the subsequent access point are different, a remedial action to protect a user. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for network security

The disclosed computer-implemented method for protecting backed-up data from ransomware attacks may include (1) determining that a backup system periodically backs up at least one file stored at a computing device to a remote storage system by storing a copy of the file at the remote storage system, (2) identifying one or more characteristics of the file backed up by the backup system, (3) storing a tripwire file with the one or more characteristics at the computing device, (4) determining that the file stored at the computing device has likely been encrypted by ransomware executing on the computing device by detecting that the tripwire file has been modified, (5) performing an action that prevents the backup system from replacing the copy of the file at the remote storage system with a copy of the encrypted file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting backed-up data from ransomware attacks

Techniques are disclosed for monitoring and evaluating video game activity by scanning for communications between a gaming console and peripherals that wirelessly communicate with the gaming console. An activity tracker receives wireless communications sent between the gaming console and a peripheral. The activity tracker generates one or more usage metrics describing the wireless communications. The activity tracker evaluates the network data based on or more specified rules. Upon determining that the usage metrics trigger a specified rule, the activity tracker generates a notification to describing those usage metrics.

Monitoring video game activity by wireless scanning

Techniques for user authentication are disclosed. In one embodiment, the techniques may be realized as a method including during registration of a user, receiving a first captured image of a physical key having a blade; identifying from the captured image a plurality of features associated with the blade of the physical key; associating the identified plurality of features with the user as key feature data; in response to a subsequent access request by the user requiring authorization of the user, prompting the user to present the physical key; receiving a second captured image in response to prompting the user; analyzing the second image to determine if the key feature data is represented in the second image; and in response to determining that the key feature data is represented in the second image, authorizing the user's access request.

Techniques for user authentication

The disclosed computer-implemented method for detecting illegitimate devices on wireless networks may include (1) identifying a baseline signal strength for a wireless network, (2) monitoring a signal strength of the wireless network to obtain at least one additional signal strength measurement, (3) determining that the additional signal strength measurement varies from the baseline signal strength beyond a threshold, (4) determining, in response to determining that the additional signal strength measurement varies from the baseline signal strength, that an illegitimate device is present on the wireless network, and (5) initiating, in response to determining that the illegitimate device is present on the wireless network, a security action. Various other methods, systems, and computer-readable media are also disclosed.

The disclosed computer-implemented method for image-based encryption of cloud data may include (1) identifying a user account for a cloud data store, wherein the cloud data store stores at least one secret to be secured by encryption on behalf of the user account, (2) receiving an image file to be used at least in part to generate a cryptographic element to be used for encrypting the secret, the cryptographic element capable of being re-created when the image file is provided again at a later time, (3) using at least one cryptographic function, generating the cryptographic element based at least in part on the image file, and (4) securing the secret by encrypting the secret using the cryptographic element. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for image-based encryption of cloud data

The disclosed computer-implemented method for detecting illegitimate devices on wireless networks may include (1) generating a fake network identification string that uniquely identifies a fake wireless network, (2) transmitting a request to connect to the fake wireless network, (3) receiving, in response to the request, a response from a network device that indicates the fake wireless network is available, and (4) determining, based on receiving the response that indicates the fake wireless network is available, that the network device is illegitimate. Various other methods, systems, and computer-readable media are also disclosed.

The disclosed computer-implemented method for selecting identifiers for wireless access points may include (1) receiving a request to establish an identifier for a configurable wireless access point, (2) identifying an existing access-point identifier that is used to identify at least one additional wireless access point, (3) determining a physical location of the configurable wireless access point, (4) verifying that the existing access-point identifier is not being used within a predetermined proximity of the physical location of the configurable wireless access point, and (5) assigning the existing access-point identifier to the configurable wireless access point. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for selecting identifiers for wireless access points

A computer-implemented method may include tracking a child's usage of a computing system. The computer-implemented method may also include generating an event history based on the child's usage of the computing system and identifying a restricted event that violated a parental-control policy. The computer-implemented method may further include creating an event trail by identifying at least one event in the event history that led to the restricted event. Various other methods, systems, and computer-readable media are also disclosed.

Methods and systems for providing context for parental-control-policy violations

A computer-implemented method for collecting thief-identifying information on stolen computing devices may include (1) receiving an indication that a computing device has been stolen, (2) detecting an attempt by a thief of the stolen computing device to access a user account of the thief via the stolen computing device, (3) collecting, based at least in part on detecting the attempt by the thief of the stolen computing device to access the user account of the thief via the stolen computing device, information capable of identifying the thief, and (4) reporting, to a remote computing device, the information capable of identifying the thief. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for collecting thief-identifying information on stolen computing devices

A method and apparatus for monitoring text-based communications to secure a computer is described. In one embodiment, the method for monitoring text-based communications to secure a computer includes defining at least one portion of the computer display that is associated with text-based communications and examining the at least one portion of the computer display to identify textual data within the text-based communications.

Growing community of inventors

Merrimack, NH, United States of America

Matt Boucher