Palo Alto Networks, Inc.

Symantec Corporation

Nishant Doshi

Sourabh Satish

Uriel Mann

User reputation regarding exposure of data objects in a cloud computing environment is determined. Behavioral information, which indicates behavior of a user for a cloud computing environment corresponding to one or more data objects in the cloud computing environment that are associated with the user, is analyzed. Based on analyzing the behavior information, a plurality of characteristics for the user that indicate exposure of the data object(s) associated with the user is determined. Each of the plurality of characteristics reflects the behavior of the user pertaining to the one or more data objects. Based on compliance of the plurality of characteristics with corresponding ones of a plurality of rules, a reputation of the user for exposing data objects in the cloud computing environment is determined. The reputation of the user is indicated to an entity with which the user is associated.

Determination of user reputation regarding data object exposure in cloud computing environments

Embodiments disclosed herein provide systems, methods, and computer readable media for using a single sign-on proxy to regulate access to a cloud service. In a particular embodiment, a method provides receiving an authentication request from a user system directed to a SSO service and determining whether the authentication request satisfies at least one criterion for allowing access to the cloud service associated with the SSO service. Upon determining that the authentication request satisfies the at least one criterion, the method provides forwarding the authentication request to the SSO service.

Single sign on proxy for regulating access to a cloud service

Embodiments disclosed herein provide systems, methods, and computer readable media for indicating data object exposure in a cloud computing environment. In a particular embodiment, a method provides receiving information about a data object from the cloud computing environment. The method further provides analyzing the information to determine a plurality of exposure characteristics for the data object. The method further includes determining an indication of exposure of the data object based on the plurality of exposure characteristics.

Determination of data object exposure in cloud computing environments

Embodiments disclosed herein provide systems, methods, and computer readable media for determining user reputation regarding data object exposure in a cloud computing environment. In a particular embodiment, a method provides receiving, from the cloud computing environment, information regarding behavior of a user in the cloud computing environment. The method further provides analyzing the information to determine a plurality of exposure characteristics for the user. The method provides determining a reputation of the user for exposing data objects in the cloud computing environment based on the plurality of exposure characteristics.

A computer-implemented method for determining that uniform resource locators are malicious may include identifying a uniform resource locator that may be posted on a social networking platform and that may be subject to a security assessment, gathering contextual data from the social networking platform that describes at least one instance of the uniform resource locator within the social networking platform, generating, based on the contextual data, a social fingerprint of the uniform resource locator and classifying the uniform resource locator as malicious based at least in part on the social fingerprint. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for determining that uniform resource locators are malicious

Techniques for detecting infected websites are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting an infected website comprising receiving at least one redirection report from at least one security agent, receiving at least one malware report from the at least one security agent, analyzing correlation between the at least one redirection report and the at least one malware report, aggregating information from the at least one redirection report, the at least one malware report, and the correlation analysis, and detecting an infected website based on the aggregated information.

Techniques for detecting infected websites

A computer-implemented method for preventing modification of network resources in the absence of a user's consent is disclosed. The method may comprise: 1) identifying an attempt to modify a network resource, 2) administering a human-verification test, and 3) determining, based on the outcome of the human-verification test, whether to prevent modification of the network resource. In addition, a computer-implemented method for preventing unauthorized communication with network resources may comprise: 1) identifying a communication attempt between a network resource and an untrusted resource, 2) determining whether communication between the network resource and the untrusted resource is authorized, and 3) determining, based on whether communication between the network resource and the untrusted resource is authorized, whether to allow communication between the network resource and the untrusted resource. Corresponding systems and computer-readable media are also disclosed.

Systems and methods for preventing unauthorized modification of network resources

The execution of a software application is diverted to detect software object corruption in the software application. Software objects used by the software application are identified and their pointers are inspected. One or more tests are applied to pointers pointing to the virtual method tables of the software objects, addresses (or pointers) in the virtual method tables, and memory attributes or content of the memory buffer identified by the addresses for inconsistencies that indicate corruption. A determination of whether the software objects are corrupted is made based on the outcome of the tests. If software object corruption is detected, proper corrective actions are applied to prevent malicious exploitation of the corruption.

Growing community of inventors

Sunnyvale, CA, United States of America

Nishant Doshi