A method and device for detecting botnets in a cloud-computing infrastructure are provided. The method includes gathering data feeds over a predefined detection time window to produce a detection dataset, wherein the detection dataset includes at least security events and a first set of bot-labels related to the activity of each of at least one virtual machine in the cloud-computing infrastructure during the detection time window; generating, using the detection dataset, a features vector for each of a plurality of virtual machines in the cloud-computing infrastructure, wherein the features vector is based on idiosyncratic (iSync) scores related to botnet activity; transmitting each generated features vector to a supervised machine learning decision model to generate a label indicating if each of the plurality of virtual machines is a bot based on the respective features vector; and determining each virtual machine labeled as a bot as being part of a botnet.

Systems and methods for monitoring malicious software engaging in online advertising fraud or other form of deceit are disclosed herein. An example method includes identifying a communication process used by a compromised computing device to communicate with a control server, the control server providing access to advertising weblinks, the compromised computing device associated with malicious software, directing, by an instruction executed by a processor, the compromised computing device to communicate with an uncompromised computing device by re-routing of packets used for communication between the compromised computing device and the control server, the uncompromised computing device is configured to mimic communications between the compromised computing device and the control server using the communication processes, storing information from one or more packets transmitted from the uncompromised computing device, and creating a profile of the malicious software based on the stored information.

Aspects of the present disclosure involve systems, methods, computer program products, and the like, for detecting a spoofed source IP address on an incoming communication to any type of network, such as a telecommunications or content delivery network. Each interface to the network may include a classifier that defines or describes source IP addresses that are recognized by the interface as a valid source IP address. If a received communication packet includes a source IP address that is not included or defined by the interface classifier, the packet is considered as a possible spoofed IP address and one or more mitigation techniques may be applied to the incoming packet to prevent an attack on a device or network utilizing the spoofed packet. Such techniques may lessen or prevent an unauthorized access of the device or network or a DDOS attack on the network or device.

A computer implemented method of identifying an encryption algorithm used by a ransomware algorithm, the ransomware algorithm encrypting a data store of a target computer system using a searchable encryption algorithm, the method including intercepting an ordered plurality of messages communicated from the target computer system to a ransomware server computer system, each message including a payload storing an encrypted unit of data from the target computer system; inspecting a final byte in the encrypted unit of data in each message to identify a byte value used by an encryption algorithm of the ransomware as a padding byte to pad messages to the size of an integral multiple of units of encryption for the encryption algorithm; training an autoencoder based on a position of a message in the ordered plurality of messages and the padding byte to provide a trained autoencoder adapted to differentiate the encryption algorithm used by the ransomware from other different encryption algorithms.

Methods and systems of classifying suspicious users are described. A processor may determine whether a domain name, of an email address of a user that requested to access a network, is valid. The processor may classify the user as a suspicious user if the domain name is invalid. If the domain name is valid, the processor may determine a likelihood that the email address is a script-generated email address. The processor may classify the user as a suspicious user if the email address is likely to be a script-generated email address. If the email address is unlikely to be a script-generated email address, the processor may identify abnormal usage behavior exhibited by the user based on a reference model. The processor may classify the user as a suspicious user if abnormal usage behavior is identified, and may reject a subsequent request from the user to access the network.

A computer-implemented method for detecting anomalies in DNS requests comprises receiving a plurality of DNS requests generated within a predetermined period. The predetermined period includes a plurality of DNS data fragments. The method further includes receiving a first DNS request and selecting a plurality of second DNS requests from the plurality of DNS requests such that each of the second DNS requests is a subset of the first DNS request. The method also includes calculating a count value for each of the DNS data fragments, where each of the count values represents a number of instances the second DNS requests appear within one of the DNS data fragments. In some embodiments, the count values for each of the DNS data fragments can be normalized. The method further includes determining an anomaly trend, for example, based on determining that at least one of the count values exceeds a predetermined threshold value.

This disclosure describes a bot detection system that distinguishes bot transactions from human transactions. The system utilizes an anomaly-based filter process to reduce the number of false positives as determined by the system. The filter process includes maintaining a database of anomaly patterns, wherein the patterns are encoded as anomaly pattern strings. As anomalies are detected, they are encoded in the anomaly pattern strings, and the database is updated by maintaining counts on the occurrences of the strings. When a particular pattern string as reflected in the database has a count that exceeds a threshold, the string is determined to be associated with a bot as opposed to a human user.

A method and apparatus that securely obtains services in response to a request for a service while concealing personally identifiable information (PII) includes a software package having a user identification (ID) and network protection module that runs on a third party system and an anonymizer module that runs on a user system. The user system sends the request for the service via an API that invokes the user ID and network protection module to validate the request. In response to receiving validation, the anonymizer module modifies the request for the service to conceal at least part of the PII and sends the modified request to the service provider. In one embodiment, the third party system may be an application program configured to run on the user system. Thus, no PII or data to identify the unique individual is transmitted to the service provider.

The present disclosure provides a challenge-response testing systems for distinguishing between human users and bots. When a user requests to access an electronic resource on a computing device, the computing device identifies a challenge-response test for the user to complete. As part of the test, the computing device renders a first view of a 3D environment on a digital display. The computing device notifies the user of a test condition to complete. To satisfy the test condition, the user has to provide input that will effect a specified change to the view of the 3D environment seen on the display. Once the user provides electronic input, the computing device updates the viewing perspective of the 3D environment and renders an updated view on the digital display. When the user submits an indication that the test has been completed, the computing device verifies whether the test condition has been satisfied.

Systems and methods for security and control of Internet of Things (IOT) and ZeroConf devices using cloud services. The present disclosure uses an application that runs on a user device in a promiscuous mode to look for potentially vulnerable and compromised machines on the local network. Specifically, the user device can fingerprint ZeroConf and IOT networks based on their static and dynamic behavior. The application discovers all hosts on the network and uses a cloud service such as via a cloud-based system to detect potentially malicious IOTs with known vulnerabilities. Based on an enterprise policy or user's preferences, the solution can alert if any IOT device tries to communicate with the user's device or if the user's device itself broadcasts services running on the device such as screen sharing/file sharing.