Acalvio Technologies, Inc.

Ca, Inc.

Arcot Systems, Inc.

Rajendra Arcot Gopalakrishna

Satnam Singh

Rammohan Varadarajan

Sanguthevar Rajasekaran

Suril Rajul Desai

Sreenivas Gukal

Johnson L Wu

Venkata Babji Sama

Geoffrey R Hird

Sanjay Vyas

Nirmesh Neema

Tarun Agrawal

Mohammad Waseem

Santosh Kosgi

VenkataBabji Sama

Roshini Thyagaraj

Srinivasan Narasimhan

Provided are systems, methods, and computer program products for a cyber-vaccination technique. In various implementations, the technique includes determine characteristics of a testing environment. A testing environment can be used to analyze malware programs. The technique can further include configuring a production network device with the characteristics, so that the production network device resembles the testing environment. The production network device is used for network operations, which excludes analyzing malware programs.

Testing environment cyber vaccine

Methods for enabling secure online transactions using a mobile device are described. A mobile device may capture an image associated with a banking card in order to generate checkout information and to automatically populate checkout fields with the checkout information prior to completing an online transaction. In some cases, the mobile device may be used to select items to be purchased from an online merchant, access a checkout page of the online merchant for purchasing the selected items, acquire an image that encodes checkout information, acquire a personal code associated with an end user of the mobile device, generate the checkout information using the acquired image and the personal code, automatically populate one or more fields associated with the checkout page with the checkout information, delete the checkout information from the mobile device, and submit the checkout information to complete the purchase of the selected items.

Methods for enabling mobile payments

Provided are methods, network devices, and computer-program products for dynamically configuring a deception mechanism in response to network traffic from a possible network threat. In various implementations, a network deception system can receive a packet from a network. The network deception system can determine an intent associated with the packet by examining the contents of the packet. The network deception system can further configure a deception mechanism to respond to the intent, for example with the appropriate network communications, software or hardware configuration, and/or data.

Responsive deception mechanisms

An application analysis computer obtains reports from user terminals identifying operational states of instances of an application being processed by the user terminals. Sequences of the operational states that the instances of the application have transitioned through while being processed by the user terminals are identified. Common operational states that occur in a plurality of the sequences are identified. For each of the common operational states, a frequency of occurrence of the common operational state is determined. For each state transition between the common operational states in the sequences, a frequency of occurrence of the state transition is determined. State predictive metrics are generated based on the frequencies of occurrence of the common operational states and the frequencies of occurrence of the state transitions. The state predictive metrics are communicated, such as to an application server to control access to the application by user terminals.

Generating state predictive metrics based on Markov chain model from application operational state sequences

Methods for securing financial transactions using dynamic PINs without requiring updates to existing banking cards or existing infrastructure at acquiring institutions. The use of a dynamic PIN may be selectively enabled for a subset of banking cards or for a particular banking card when circumstances require use of the dynamic PIN. A dynamic PIN may be required for performing a financial transaction, such as making an online purchase, if an account associated with a banking card has a particular credit limit greater than a threshold or if a suspicious transaction history has been detected (e.g., large out-of-state purchases have recently been made). A dynamic PIN may be required based on a time of day or location associated with the financial transaction (e.g., if the financial transaction is being initiated within a particular foreign country).

Anti-skimming solution

Provided are systems, methods, and computer program products for a cyber-vaccination technique. In various implementations, the cyber-vaccination technique includes using a network device that is infected by a malware program to determining a marker generated by the malware program. The marker may indicate to the malware program that the network device has been infected by the malware program. Determining the marker can include identifying a placement of the marker on the network device. The technique further includes identifying one or more other network devices that have not previously been infected by the malware program. The technique further includes automatically distributing copies of the marker. When a copy of the marker is received at one of the previously identified, uninfected network devices, the identified network device can place the marker on the identified network device according to the identified placement.

Immunizing network devices using a malware marker

Provided are systems, methods, and computer program products for a cyber-antibody technique. In various implementations, the technique includes monitoring, by a network device infected with an unknown malware program, packets set by the network device onto a network. The technique further includes identifying a packet that is associated with the unknown malware program. The packet can be identified from among the monitored packets. Identifying the packet can include determining a characteristic of the packet. The technique further includes identifying packets that have a characteristic similar to the characteristic of the packet. The technique can further include inserting data associated with a known malware program into the identified packets. The technique can further include distributing the characteristic to other network devices, to similarly taint packets that may be issued from those other network devices.

Command and control cyber vaccine

Provided are methods, network devices, and computer-program products for a network deception system. The network deception system can engage a network threat with a deception mechanism, and dynamically escalating the deception to maintain the engagement. The system can include super-low, low, and high-interaction deceptions. The super-low deceptions can respond to requests for address information, and requires few computing resources. When network traffic directed to the super-low deception requires a more complex response, the system can initiate a low-interaction deception. The low-interaction deception can emulate multiple devices, which can give the low-interaction deception away as a deception. Hence, when the network traffic includes an attempted connection, the system can initiate a high-interaction deception. The high-interaction more closely emulates a network device, and can be more difficult to identify as a deception. The high-interaction deception can fully engage a network threat, and can be initiated only as needed.

Threat engagement and deception escalation

This disclosure is related to using network flow information of a network to determine the trajectory of an attack. In some examples, an adjacency data structure is generated for a network. The adjacency data structure can include a machine of the network that has interacted with another machine of the network. The network can further include one or more deception mechanisms. The deception mechanisms can indicate that an attack is occurring when a machine interacts with one of the deception mechanisms. When the attack is occurring, attack trajectory information can be generated by locating in the adjacency data structure the machine that interacted with the deception mechanism. The attack trajectory information can correlate the information from the interaction with the deception mechanism, the interaction information of the network, and machine information for each machine to determine a possible trajectory of an adversary.

Systems and methods for detecting and tracking adversary trajectory

Methods, systems, and computer-readable mediums are described herein to provide context-aware knowledge systems and methods for deploying deception mechanisms. In some examples, a deception profiler can be used to intelligently deploy the deception mechanisms for a network. For example, a method can include identifying a network for which to deploy one or more deception mechanisms. In such an example, a deception mechanism can emulate one or more characteristics of a machine on the network. The method can further include determining one or more asset densities and a summary statistic. An asset density can be associated with a number of assets connected to the network. The summary statistic can be associated with a number of historical attacks on the network. Using at least one or more of the one or more asset densities, the summary statistic, other information associated with the network, or a combination thereof, the method can further include determining a number of deception mechanisms to deploy, and deploying the number of deception mechanisms.

Context-aware knowledge system and methods for deploying deception mechanisms

Systems and methods for identifying potentially compromised devices using attributes of a known compromised device may be provided. In one embodiment, an attribute set can be constructed for the compromised hosts using data from these logs. Weights can be assigned to each attribute in the attribute set initially, and further weights can be learned using audits by a user. This attribute set can be used in the disclosed systems and methods for identifying hosts that are similar to compromised hosts. The similar items can be used as hosts for deception mechanisms, can be taken off the network as being likely compromised or likely to become compromised, or quarantined.

Systems and methods for identifying similar hosts

Provided are methods, devices, and computer-program products for hiding one or more deception mechanisms. In some examples, the one or more deception mechanisms can be hidden from network scans. In other examples, the one or more deception mechanisms can be hidden to convince attackers that there are no deception mechanisms. In some implementations, a device, computer-program product, and method for hiding a deception mechanism is provided. For example, a method can include identifying a deception mechanism executing on a computing device. The deception mechanism can be associated with address information. In some examples, the address information can include an Internet Protocol (IP) address and a Media Access Control (MAC) address. The method can further include determining that the deception mechanism is being projected on a site network. The method can further include determining to hide a deception mechanism and hiding the deception mechanism.

Dynamic hiding of deception mechanism

Securely providing secret information, such as PINs, to users via an encrypted electronic document is disclosed. The user might receive the encrypted electronic document as an attachment to an e-mail or might access the encrypted electronic document from a web site, as two examples. In order to open the encrypted electronic document, the user may need to provide some information that is on a physical banking card that was issued to the user. Therefore, an extra level of security is provided in that the user needs to be in possession of the physical banking card that may have been delivered by traditional mail, as well as the encrypted electronic document which is delivered via an electronic network.

Method and system to securely send secrets to users

System and methods for authenticating a transaction between a user system and a host system are described herein. In one embodiment, the system and methods use a text-reading test (TRT) image as part of the authentication process. The TRT image is presented to the user upon initiation of a transaction by the user. Information provided by a user, via the user system, after perception of the TRT image is compared to the source information in the TRT image. If the user input corresponds to the source information, the user is authenticated and transaction is allowed to proceed.

Authentication using a turing test to block automated attacks

A system identifies a real Internet Protocol (IP) address of a computer device having a browser and software for masking the real IP address. The system includes a server in communication with the device through an Anonymous Proxy Server (APS), an algorithm, and a website with embedded dynamic web content from the server. The algorithm identifies the real IP address, and executes the dynamic web content on the browser to open a direct network connection between the server and device. The network connection identifies the real IP address. A method for identifying the real IP address includes embedding dynamic web content within the website, executing the content within the browser when the device accesses the website via a first network connection, thereby opening a second network connection between the server and device. The real IP address is identified over the second network connection, and a security action may be executed.

Growing community of inventors

Bengaluru, India

Rajendra Arcot Gopalakrishna