Symantec Corporation

Nortonlifelock Inc.

Gen Digital Inc.

Ca, Inc.

Petros Efstathopoulos

Daniel Marino

Iskander Sanchez Rola

David Luz Silva

Leylya Yumer

Ashwin Kumar Kayyoor

Fanglu Guo

Daniel Kats

Yun Shen

Susanta Kumar Nanda

Johann Roturier

Pierre-Antoine Vervier

Weibao Wu

Sanjay Sawhney

Yuqiong Sun

Dharmesh Shah

Xueqiang Wang

Carey S Nachenberg

Xianbo Zhang

Anand Kashyap

Yufei Han

Tzi-cker Chiueh

Sharada Sundaram

Chris Gates

Bruce Robert Montague

Tudor Dumitras

Eun Kyu Lee

Evgenios Kornaropoulos

Amit Mital

Mingwei Zhang

Tai-Ching Li

Kevin Butler

Systems and methods for protecting against an estimated level of online tracking are disclosed. In one embodiment, a method may include collecting data relating to a plurality of known users. This first data may include browser histories and a level of online tracking for each known user. The known users may be organized into clusters and second data relating to an unknown user may be received. The second data may include an identification of one or more categories of websites that the unknown user visits, and one or more websites within each of the one or more categories of websites that the unknown user visits. A matching cluster for the unknown user may be identified and levels of online tracking for similar known users within the matching cluster may be used to estimate a level of online tracking for the unknown user.

Protecting against an estimated level of online tracking

Distinguishing between functional tracking domains and nonfunctional tracking domains on a host web page. In particular, a list of known tracking domains that load content into host web pages may be received. This list of tracking domains may include tracking domains that are functional and tracking domains that are nonfunctional. The tracking domains that are functional may be determined by evaluating various behaviors and characteristics of the tracking domains. Once functional tracking domains have been determined, these functional tracking domains may be allowed, and other tracking domains may be blocked from loading content onto host web pages thereby preserving the functionality of the web pages.

Distinguishing between functional tracking domains and nonfunctional tracking domains on a host web page

Systems and methods for identifying and removing a tracking capability from an external domain that performs a tracking activity on a host web page. Tracking capabilities of an external domain may be removed by altering web requests and/or responses to API calls. Once these tracking capabilities of the external domain have been removed, the altered web requests and/or altered responses to API calls may be transmitted to a web browser and/or entity making the API call thereby protecting user privacy while allowing the external domain to interact with the host web page.

Identifying and removing a tracking capability from an external domain that performs a tracking activity on a host web page

Identifying and removing a tracking capability from an external domain that performs a tracking activity on a host web page. Tracking capabilities of an external domain may be removed by altering web requests and/or responses to API calls. Once these tracking capabilities of the external domain have been removed, the altered web requests and/or altered responses to API calls may be transmitted to a web browser and/or entity making the API call thereby protecting user privacy while allowing the external domain to interact with the host web page.

The disclosed computer-implemented method for identifying privacy leakage information may include (1) identifying, at the computing device, at least one informative word in a digital text and (2) performing a security action that identifies privacy leakage information, where the security action includes (A) determining, for at least one identified informative word, a type of privacy leakage and a respective confidence score indicating a probability the identified informative word causes the type of privacy leakage, (B) determining, using the respective confidence score, a combined confidence score for each respective element within a level of detail to display, and (C) displaying, on a display device, the combined confidence score for each respective element within the level of detail to display. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying privacy leakage information

Methods and systems are provided for monitoring private information exposure. One example method generally includes detecting, at a computing device, a potentially exposing post on a publicly-accessible server and determining, by an exposure model operated by the computing device, an exposure chance for the potentially exposing post. The method further includes transmitting an initial notification of the potentially exposing post from the computing device to a client device based on the exposure chance from the exposure model and detecting an update event associated with the potentially exposing post. The method further includes updating the exposure model based on the update event and transmitting a personalized notification from the computing device to the client device based on the update event.

User-based cyber risk communications using personalized notifications

The disclosed computer-implemented method for generating user profiles may include (i) analyzing a data set of user profiles for services, (ii) detecting a measurement of obfuscation that was applied to a specific attribute across multiple user profiles for a specific service, (iii) applying the measurement of obfuscation to true data for a new user by fuzzing the true data to create a fuzzed value, and (iv) generating automatically a new user profile for the specific service by populating the specific attribute within the new user profile with the fuzzed value. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for generating user profiles

Determining security vulnerabilities of smart home devices. A method may include obtaining data regarding a first application associated with a first IoT device associated with a known security vulnerability; analyzing the data regarding the first application to analyze expected communications with the first IoT device; identifying a second application available for download associated with a second IoT device; analyzing expected communications between the second application and the second IoT device; comparing the expected communications between the first application and first IoT device and between the second application and second IoT device to determine a similarity level between the first and second IoT devices; determining the second IoT device shares the same known security vulnerability as the first IoT device based on determining the similarity level; and implementing a security action on the second IoT device based on determining that the second IoT device shares the same known security vulnerability.

Determining security vulnerabilities of Internet of Things devices

Label for device security

The disclosed computer-implemented method for fingerprinting devices may include (i) detecting that a new device has attempted to connect to a network gateway, (ii) attempting to fingerprint the new device as an instance of a known candidate device type by (a) transmitting to the new device, from a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type and (b) confirming, by the security application based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type, and (iii) performing a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for fingerprinting devices

A method for anomaly detection using grouping-based graph summarization is performed by one or more computing devices, each including one or more processors. The method includes identifying a first graph from a stream of incoming graphs, generating a first summary of the first graph, classifying the first summary in a first category, identifying a second graph from the stream of incoming graphs, generating a second summary of the second graph, comparing the first summary with the second summary, mapping the first summary and the second summary to the first category upon determining that the comparing indicates a similarity between the first summary and the second summary satisfies a graph similarity threshold, analyzing a frequency of graphs being mapped to graph categories, the graph categories including at least the first category, and detecting an anomaly in one of the graph categories based at least in part on the analysis.

Classification using projection of graphs into summarized spaces

The disclosed computer-implemented method for controlling uploading of potentially sensitive information to the Internet may include (i) loading, at the computing device, at least a portion of a webpage and (ii) performing a security action including (A) converting, at the computing device, components of the webpage from an online status to an offline status, (B) receiving a sensitive information input to a respective offline component of the webpage, (C) converting, based on a stored user preference and in response to receiving the sensitive information input, the respective offline component to the online status, (D) buffering an outgoing network request comprising the sensitive information input, (E) receiving an approval input indicating approval to transmit the potentially sensitive information to the Internet, and (F) releasing the outgoing network request in response to receiving the approval input. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for controlling uploading of potentially sensitive information to the internet

Methods and systems are provided for detecting privacy leakage risks in text. One example method generally includes receiving, at a computing device from a client device, a keyword and generating, by the computing device, a combined query comprising the keyword and a sensitive topic query associated with a sensitive topic. The method further includes transmitting the keyword from the computing device to a search engine and transmitting the combined query from the computing device to the search engine. The method further includes receiving, at the computing device from the search engine, a number of search results for the keyword and receiving, at the computing device from the search engine, a number of search results for the combined query. The method further includes determining, by the computing device, a confidence score and transmitting the confidence score from the computing device to the client device.

Real-time detection of privacy leaks based on linguistic features

Growing community of inventors

Los Angeles, CA, United States of America

Petros Efstathopoulos