A computer program product, a computer-implemented method, and a computer system include a processor(s) that obtains side channel emanations from a device. The processor(s) analyzes the side channel emanations to identify distinct emanation patterns and timing characteristics, wherein the timing characteristics are associated with transitions between the distinct emanation patterns. The processor(s) generates a non-deterministic finite automaton (NFA) by correlating the distinct emanation patterns with states of the device, where the NFA captures states and state transitions of the device. The processor(s) identifies an anomaly in the device, based on deviation in emanations from the device.

The portable peripheral (1001) of communication with a data storage peripheral and a data network utilizing the internet protocol, comprises: a connector to mechanically connect and establish a removable wired connection between the peripheral and a portable terminal, a first means of wired bidirectional communication with the portable terminal, a second means of bidirectional communication with a data storage peripheral or a data network and a security unit protecting the communication between the portable terminal and the data storage peripheral or the data network, this communication being established between the first and the second means of communication.

A system comprising an inner kernel of an operating system (OS) running at a higher privilege level than an outer kernel of the OS, the inner kernel to measure a data structure in a memory; a device including a measurement engine to measure the data structure in the memory, wherein the device operates independently of the OS; and a trusted execution environment including an application to compare measurements from the inner kernel and the measurement engine.

The following relates generally to defense mechanisms and security systems. Broadly, systems and methods are disclosed that detect an anomaly in an Embedded Mission Specific Device (EMSD). Disclosed approaches include a meta-material antenna configured to receive a radio frequency signal from the EMSD, and a central reader configured to receive a signal from the meta-material antenna. The central reader may be configured to: build a finite state machine model of the EMSD based on the signal received from the meta-material antenna; and detect if an anomaly exists in the EMSD based on the built finite state machine model.

Generating models usable by data appliances to perform inline malware analysis is disclosed. A set of features, including a plurality of n-grams, extracted from a set of files is received. A reduced set of features is determined that includes at least some of the plurality of n-grams. The reduced set of features is used to generate a model usable by a data appliance to perform inline malware analysis.

Methods, apparatus, systems, and articles of manufacture are disclosed that improve detection of malware based on ecosystem specific data. An example apparatus includes a feedback weight controller to apply, with a machine learning model, a weight to feedback associated with a sample, the feedback obtained from at least a customer ecosystem and including endpoint feedback, human feedback, infrastructure feedback, and global feedback; and a sample conviction controller to, in response to a score based on the weighted feedback satisfying a threshold for a classification, indicate to a user, with the machine learning model, that the classification for the sample is malicious.

An example embodiment may involve a storage device comprising one or more processors, memory, a host interface connectable to a host device, a network interface connectable to a backup device, and program instructions, stored in the memory, that upon execution by the one or more processors cause the storage device to perform operations comprising: causing data received, by way of the host interface, to be stored in a page of the memory; after storing the data, marking the page as invalid due to input/output operations of the memory; determining a predicted idle time period within which the memory is not expected to be engaged in further input/output operations; determining that a duration of the predicted idle time period exceeds a threshold length; and during the predicted idle time period, transmitting, by way of the network interface, the data to the backup device.

In embodiments of the present invention improved capabilities are described for detecting restricted content associated with retrieved content. The method and system may include receiving a client request for content, saving contextual information from the client request, presenting retrieved content in response to the client request, and presenting the contextual information from the client request, and retrieved content, to a scanning facility. The scanning facility may utilize the contextual information from the client request to aid in the detection of restricted content associated with retrieved content.

A system continuously monitors, by at least one inspector, an inspection work queue for a class of inspection operation request, detects, by the at least one inspector, the class of inspection operation request in the inspection work queue, removes, by the at least one inspector, the class of inspection operation request from the inspection work queue, determines, by the at least one inspector, one of a class of inspection tool and a specific level of inspection to perform for the class of inspection operation request that references a data object, and executes, by the at least one inspector, the one of the class of inspection tool and the specific level of inspection for the class of inspection operation request that references the data object at one of a certain time and a certain event during a data lifecycle of the data object.

A computer-implemented method, a computer program product, and a computer system for creating malware domain sinkholes by domain clustering. The computer system clusters malware domains into domain clusters. The computer system collects domain metrics in the domain clusters. The computer system sorts clustered malware domains in the respective ones of the domain clusters, based on the domain metrics. The computer system selects, from the clustered malware domains in the respective ones of the domain clusters, a predetermined number of top domains as candidates of respective domain sinkholes, wherein the respective domain sinkholes are created for the respective ones of the domain clusters.