New York University

Matsushita Electric Industrial Co., Ltd.

Hewlett-packard Development Company, L.p.

Nasir D Memon

Kulesh Shanmugasundaram

Anandabrata Pal

Baris Coskun

Sevinc Bayram

Husrev Taha Sencar

Debargha Mukherjee

Hong Heather Yu

Amir Said

Dennis Bushmitch

Sathya Narayanan

Keith W Ross

Herve Bronnimann

Ahmet Emir Dirik

Umut Topkara

Husrev T Sencar

Gleb Naumovich

Ezgi Yalcin

Justin Cappos

Mikhail Sosonkin

Sai Teja Peddinti

Katherine Isbister

Napa Sae-Bae

As image source attribution techniques have become significantly sophisticated and are now becoming commonplace, there is a growing need for capabilities to anonymize images and videos. Focusing on the photo response non-uniformity noise pattern based sensor fingerprinting technique, this work evaluates the effectiveness of well-established seam carving method to defend against sensor fingerprint matching. We consider ways in which seam-carving based anonymization can be countered and propose enhancements over conventional seam carving method. Our results show that applying geometrical distortion in addition to seam carving will make counter attack very ineffective both in terms of computational complexity and accuracy.

Seam carving based anonymization

A security system and service, which improves the performance of SECaaS services, is described. A security server system tracks the content that has successfully passed through its security modules and distributes this information to the end user client devices as hashlist information. The remote client devices can then safely bypass the cloud for a significant fraction of Web object requests by using information on a locally stored hashlist to validate Web objects.

Providing a fast, remote security service using hashlists of approved web objects

The problem of obtaining a multi-touch input sequence for use in user authentication is solved by determining, at a plurality of time instances, a mapping from an unordered set of at least four touch points to a an ordered set of at least four fingertips, wherein for at least one of the plurality of time instances, the mapping from the unordered set of at least four touch points to the ordered set of at least four fingertips is subject to a constraint that the ordered set of at least four touch points defines a simple polygon.

Biometric-rich gestures for authentication on multi-touch devices

A peer-to-peer (P2P) bot(s) in a network is identified using an already identified P2P bot. More specifically, such embodiments may facilitate determining a candidate set of computers, which may be potential P2P bots, by identifying computers in a network that have a private mutual contact with a seed bot, which is a computer identified as a P2P bot, and identifying additional computers that have private mutual contacts with the identified computers. Further, a confidence level indicative of a certainty of a membership of each of the candidate computers in the P2P botnet is determined and responsive to a determination that the confidence level of the candidate computer exceeds a determined threshold confidence level, the candidate computer is identified as a P2P bot.

Method and apparatus for identifying members of a peer-to-peer botnet

For user authentication, finger touch information from a user is accepted via a touch sensitive element, the finger touch information including at least a time series of finger touch samples that define a trace of the user's signature, and each of the finger touch samples including centroid coordinates and non-centroid information, the non-centroid information including at least one of (A) a shape of the finger touch sample, (B) a size of the finger touch sample, (C) an orientation of the finger touch sample, and (D) characteristics of a multi-touch finger touch sample. A similarity of such finger touch samples with previously entered and stored finger touch samples is determined and compared with a threshold for purposes of user authentication.

User authentication for devices with touch sensitive elements, such as touch sensitive display screens

File carving is a technique whereby data files are extracted from a digital device without the assistance of file tables or other disk meta-data, and can therefore be used to recover files that are fragmented. Sequential hypothesis testing procedures are used to detect a fragmentation point of a file by sequentially comparing adjacent pairs of blocks from the starting block of a file until the fragmentation point is reached. The detected fragmentation point can be used to help recover the fragmented file. Such a serial analysis helps to minimize errors and improve performance.

Detecting a file fragmentation point for reconstructing fragmented files using sequential hypothesis testing

Several promising techniques have been recently proposed to bind an image or video to its source acquisition device. These techniques have been intensively studied to address performance issues, but the computational efficiency aspect has not been given due consideration. Considering very large databases, the efficiency of the sensor fingerprint based source device identification technique is described. Novel schemes that improve search complexity as compared to a conventional approach are described.

Sensor fingerprint matching in large image and video databases

Flexible network policies might be enforced by (a) obtaining a flow of network packets, (b) determining a content characteristic by characterizing content of the flow using bit-stream level statistics, (c) determining content-independent flow characteristics, port-independent flow characteristics, and/or application header-independent flow characteristics, and (d) enforcing a policy on the flow using both (1) the determined content characteristic and the (2) determined content-independent flow characteristics, port-independent flow characteristics, and/or application header-independent flow characteristics.

Effective policies and policy enforcement using characterization of flow content and content-independent flow information

Host malware (or change) may be detected by (1) receiving baseline set of response time information for each of one or more transactions involving (A) the host and (B) at least one peer of the host, (2) determining or receiving a later set of response time information for each of the one or more transactions involving the host and the at least one peer of the host, and (3) determining whether or not host slowdown has occurred using the baseline set of response time information and the later set of response time information. The execution of a host malware (or change) protection policy may be controlled using at least the determination of whether or not host slowdown has occurred.

Network-based infection detection using host slowdown

Whether or not a node is a relay node may be determined by, for each of a plurality of active flows, assigning a random number to the flow, wherein each of the random numbers is drawn from a distribution. Then, for each of a plurality of time slots, any incoming flows to the node and any outgoing flows from the node may be determined, random numbers assigned to any active flow of the incoming flows may be summed to generate a first sum, random numbers assigned to any active outgoing flows may be summed to generating a second sum, and the first sum may be multiplied with the second sum to generate a product associated with the time slot. The products over the plurality of time slots may then be summed to obtain a summed product. This may be repeated, reassigning random values to each of the plurality of flows, thereby obtaining a plurality of summed products. A variance of the plurality of summed products may be determined and compared with a threshold to obtain a comparison result. Whether or not the node is a relay node may then be determined using the comparison result. Execution of a relay node protection policy may be controlled using the determination of whether or not the node is a relay node.

Efficient detection of relay node

Files can be reassembled from fragments by (a) accepting (or determining) adjacency scores for each pair of fragments from a set of fragments, (b) identifying header fragments from among the fragments of the set of fragments, and (c) for each of the header fragments identified, reconstructing a corresponding one of two or more files from the fragments of the set of fragments such that the sum of the adjacency scores are optimized. Any of the fragments, other than the identified header fragments, are permitted to belong, at least provisionally, to more than one of the at least two files when reconstructing the file(s).

Reassembling fragmented files or documents in a file order-independent manner

A hierarchical data structure of digested payload information (e.g., information within a payload, or information spanning two or more payloads) allows a payload excerpt to be attributed to earlier network flow information. These compact data structures permit data storage reduction, while permitting efficient query processing with a low level of false positives. One example of such a compact data structure is a hierarchical Bloom filter. Different layers of the hierarchy may correspond to different block sizes.

Facilitating storage and querying of payload attribution information

Files can be reassembled from fragments by (a) accepting adjacency scores for each pair of fragments from the set of fragments, (b) identifying header fragments from among the fragments of the set of fragments, and (c) for each of the header fragments identified, reconstructing a corresponding one of the two or more files from the fragments of the set of fragments such that the sum of the adjacency scores are optimized, wherein each of the fragments is permitted to belong to only one of the at least two files, and wherein at least two files are reconstructed such that the results are independent of the order in which the files are reconstructed.

Reassembling fragmented files or documents in an order-independent manner that ensures each of the fragments belongs to only one reassembled file

Files can be reassembled from fragments by (a) accepting adjacency scores for each pair of fragments from a set of fragments, (b) identifying header fragments from the set of fragments, and (c) for each of the header fragments, (i) setting a current fragment to the identified header fragment, (ii) selecting, from any of the fragments not identified as a header fragment, a fragment with a best adjacency score with the current fragment, (iii) determining if the selected fragment has a better adjacency score with any of the other fragments not identified as a header than with the current fragment, (iv) if so, then (A) selecting another fragment, from any of the fragments not identified as a header fragment, a fragment with a next best adjacency score with the current fragment, and continuing, and otherwise (A) adding the selected fragment to a reassembly path started with the identified header fragment, and (B) setting the current fragment to the selected fragment, and continuing until the file is reconstructed.

Growing community of inventors

Brooklyn, NY, United States of America

Nasir D Memon