Methods, systems, and products protect personally identifiable information. Many websites acquire the personally identifiable information without a user's knowledge or permission. Here, though, the user may control what personally identifiable information is shared with any website. For example, the personally identifiable information may be read from a header of a packet and compared to a requirement associated with a domain name.

Embodiments are directed to a computer-implemented method of identifying an imposter web page. The method includes extracting, using a processor system, visited web page data from a visited web page. The method further includes determining, using the processor system, that the visited web page is an imposter web page, based at least in part on determining, using the processor system, that website location data of the visited web page does not match website location data of at least one legitimate web page, as well as determining that text data associated with image data of the visited web page matches text data associated with image data of the at least one legitimate web page.

The present disclosure relates to a system (1) and a method that employs such system (1) to detect and counteract Internet attacks of Man-in-the-Browser and/or Man-in-the-Middle type. The system (1) comprises a Traffic Inspector (2) in signal communication with a client computer (3) having a Web browser (4) residing therein for Internet browsing and with a Web server (5) having a Web application (6) residing therein. The Traffic Inspector (2) is configured to receive a request associated with the Web application (6) from the Web browser (4) and to send it to the Web browser (5), the Traffic Inspector (2) is configured to receive a DOM server code associated with the request from the Web server (5). The system is characterized in that it comprises a Traffic Analyzer (7) in signal communication with the Traffic Inspector (2) and having an algorithm application (8) residing therein, the Traffic Inspector (2) is configured to add a default code portion to the DOM server code to thereby generate a DOM client code to be sent to the Web browser (4) to receive a DOM rendered code associated with the DOM client code, the Traffic Inspector (2) is configured to send the DOM client code and the DOM rendered code to the Traffic Analyzer (7), the algorithm application (8) is configured to process the DOM rendered code to compare it with the DOM client code, to thereby identify at least one code difference.

A method and system for discovering inappropriate and/or illegitimate use of Web page content, comprising: monitoring access to a first Web page by a user; comparing information from the first Web page to information from a second known legitimate Web page; and determining whether the first Web page is legitimate based on the compared information.

A new approach is proposed that contemplates systems and methods to support scanning through a file of large size without having to load the entire file into memory of single file parser or scanner. The proposed approach is configured to divide a ginormous file to be parsed and scanned into a plurality of sections following a divide and conquer scheme. The plurality sections of the file are then parsed and loaded to a plurality of file scanners each configured to scan its allocated file section of a certain file type. Each of the plurality of file scanners is then configured to extract and evaluate from its allocated section file parts that can be harmful to a user of the file and/or expose sensitive/protected information of the user. The scan results are then collected, analyzed, and report to a user with a final determination on the malicious content and sensitive data.

A method and system for authenticating a user at a first computer to first and second applications installed in a second computer. The second computer receives from the user a first request to access the first application, and in response, the second computer redirects the first request to a third computer, and in response, the third computer determines that the user was previously authenticated and so notifies the second computer, and in response, the second computer returns a first session key to the third computer. The first session key enables a session with the first application but not with the second application. A second session key was sent by the third computer to the first computer after the third computer received the first session key from the second computer. The second session key enables a session with both the first application and the second application.

In some embodiments, techniques for computer security comprise receiving an email message; determining a sender of the email message; determining whether the sender of the email message is trusted, wherein determining whether the sender of the email message is trusted includes determining whether the sender of the email message is associated with a whitelist; retrieving domain-related information by performing a DNS query on a domain associated with the sender; based at least in part on the domain-related information, determining whether the sender of the email message is verified; determining whether the sender is both trusted and verified; and when it is determined that the sender is both trusted and verified, treating the email message as trustworthy, wherein treating the email message as trustworthy includes bypassing a classifier.

An extraction apparatus includes processing circuitry configured to receive an input of information about a plurality of web pages including a hypertext markup language (HTML) element that is known to reach a malicious web page through browser operation and an HTML element that is known to reach a benign web page through browser operation, classify the plurality of web pages whose input is received into clusters, extract an HTML element that reaches the malicious web page and an HTML element that reaches the benign web page from a web page of each cluster that is classified to extract a first character string included in HTML elements that are extracted, and extract, as a keyword, a second character string that characterizes the HTML element that reaches the malicious web page from the first character string.

A learning device includes processing circuitry configured to use a web browser to crawl one or more web pages from an originating web page, and to accept input of log information obtained from the web browser until an ending web page is reached, and generate a training model using, as training data, any one or more feature amounts among a feature amount of each web page included in the log information, a feature amount about an operation performed on the web browser on a path reaching the ending web page, and a feature amount about an event occurring on the path reaching the ending web page.

An access classification device includes: a processor configured to: construct a plurality of trees in each of which at least a first destination and a second destination are set as nodes, content information corresponding to the nodes is added to the nodes, and an instruction to transfer an access from the first destination to the second destination is set as an edge; associate nodes of the plurality of trees with each other for the plurality of trees constructed, based on similarity between local structures of the trees; calculate similarity between the nodes associated with each other in the plurality of trees, based on the content information added to the nodes, and calculate similarity between the plurality of trees using the calculated similarity between the nodes associated with each other; and classify the access into a set with similar features, based on the similarity calculated.