Shape Security, Inc.

Other

Continental Intelligent Transportation Systems, LLC

Yao Zhao

Xinran Wang

Justin David Call

Timothy Dylan Peacock

Sumit Agarwal

Mengmeng Chen

Jarrod S Overson

Seval Oz

Tammer Zein-El-Abedein

Jian Jiang

Rundong Liu

Ye Xu

A security server device, method, non-transitory computer readable medium and security system that receives request data for a request from a client to a web server system where the request comprises a session identifier (ID) for a session between an authenticated user and the web server system. A determination is made whether the client is a single-user device based on the request data and multi-domain data. Another determinations is made on whether the client is compromised based on the request data. In response to the determinations that the client is a single-user device and is not compromised an extension of the session between the authenticated user on the client and the web server system is caused.

Security measures for extended sessions using multi-domain data

Computer systems and methods in various embodiments are configured for improving the security and efficiency of client computers interacting with server computers through supervising instructions defined in a web page and/or web browser. In an embodiment, a computer system comprising one or more processors, coupled to a remote client computer, and configured to send, to the remote client computer, one or more instructions, which when executed by the remote client computer, cause a run-time environment on the remote client computer to: intercept, within the run-time environment, a first call to execute a particular function defined in the run-time environment by a first caller function in the run-time environment; determine a first caller identifier, which corresponds to the first caller function identified in a run-time stack maintained by the run-time environment; determine whether the first caller function is authorized to call the particular function based on the first caller identifier.

Call stack integrity check on client/server systems

Techniques are provided for detection of malicious activity using behavior data. A behavior model is trained with behavior data generated in association with a plurality of requests. Data is received that describes a particular request from a particular client device to a server system hosting a website. The data includes particular behavior data generated at the particular client device in association with the particular request. The particular behavior data is analyzed using the behavior model to generate a behavior model result. An automation determination for the particular request is generated based on the behavior model result. The particular request is handled based on the automation determination for the particular request.

Detection of malicious activity using behavior data

In an embodiment, a method is configured to detect compromised credentials, comprising: generating a plurality of bloom filters, wherein each bloom filter corresponds to a particular subset of a set of compromised credentials; receiving an index value from a client computing device; in response to receiving the index value, determining a target bloom filter corresponding to the index value, and sending the target bloom filter to the client computing device; receiving a first value from the client computing device; in response to receiving the first value, generating a second value based on the first value, and sending the second value to the client computing device.

Detecting compromised credentials by improved private set intersection

Unsupervised or supervised machine learning ('ML') techniques discussed herein can be used to classify browsers as one or more types of browser or within one or more browser groups. For example, a computer system configured to improve security of server computers interacting with client computers through an intermediary computer, and comprising: a memory comprising processor logic; one or more processors coupled to the memory, wherein the one or more processors execute the processor logic, which causes the one or more processors to: receive a first plurality of requests from a first plurality of browsers; generate a first plurality of request-feature vectors from the first plurality of requests; generate a plurality of browser groups based on the first plurality of request-feature vectors; receive a first new request from a first client computer; generate a first new request-feature vector based on the first new request; determine that the first new request-feature vector belongs to a first browser group among the plurality of browser groups; determine that the first browser group is associated with a first rule, and in response, respond to the first new request according to the first rule.

Unsupervised and supervised machine learning approaches to detecting bots and other types of browsers

A cloud-based package-exchange-service for package delivery to, and pick-up from, a target vehicle includes a GPS-based proximity module. The GPS-based proximity module receives current GPS coordinates of a package delivery vehicle and of the target vehicle. The GPS-based proximity module stores both GPS coordinates. The GPS-based proximity module monitors a distance between the package delivery vehicle and the target vehicle of the customer. The cloud-based system also has a delivery module in the first server associated with a second database. The delivery module includes one or more lists of local delivery services that include registered individuals to be assigned for package exchange operations. The lists of local delivery services also include package delivery restrictions and conditions including package size, hours of operation, distance to operate, and delivery prices.

Package exchange service using local delivery services

Methods and apparatus are described for automatically modifying web page code. Specific implementations relate to the modification of web page code for the purpose of combatting Man-in-the-Browser (MitB) attacks.

Detecting man-in-the-browser attacks

A computer-implemented method includes providing, for use by a third-party, injectable computer code that is capable of being served with other code provided by the third-party to client computing devices; receiving data from client computing devices that have been served the code by the third-party, the data including data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices; classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices; and providing to the third party one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the third party.

Detecting attacks against a server computer based on characterizing user interactions with the client computing device

Techniques for combating man-in-the-browser attacks

A computer-implemented method, the method includes identifying a piece of data to be served from a server system to a client device that is remote from the server system; creating a plurality of expressions that, when executed, provide a result that corresponds to the piece of data; and providing the plurality of expressions to the client device with code for executing the plurality of expressions.

Encoding of sensitive data

Detection of client-side malware activity

A computer-implemented method includes identifying, in web code to be served to a client, presence of code for generating a form; generating additional, executable code to be run on the client device, the additional, executable code being arranged to identify user input on the client device and modify the form so that data from the user input is received into one or more alternative fields of the form other than a first field to which a user performing the input directed the input; receiving a request from the client device based on completion of input into the form; and converting data from the received request so that data for the one or more alternative fields of the form is directed to the first field of the form for processing by a web server system that initially generated the web code.

Growing community of inventors

Fremont, CA, United States of America

Yao Zhao