Systems, computer program products, and methods are described herein for active detection and mitigation of unauthorized activity within a technology infrastructure. The present invention is configured to continuously monitor one or more incoming messages in one or more computing devices; detect one or more assessment vectors embedded in the one or more incoming messages; initiate an isolated virtual environment; redirect the one or more incoming messages associated with the one or more assessment vectors from the one or more computing devices to the isolated virtual environment; trigger an access routine to emulate, within the isolated virtual environment, an action of accessing the one or more incoming messages; determine, based on at least the access routine, whether the one or more incoming messages is associated with malware; and display a notification to the user indicating whether the one or more incoming messages is associated with malware.

The present disclosure presents blockchain-based cyber security management systems and related methods. One such method comprises obtaining cyber intelligence input data from a cyber defender computing device, wherein the cyber defender computing device manages network security of a network, wherein the cyber intelligence input data identifies a cyber attacker or a victim of a cyber attack on the network; executing one or more Cyber Security Management (CSM) functions with the cyber intelligence input data received from the cyber defender computing device and cyber data stored in the blockchain ledger, wherein the cyber data stored in the blockchain ledger provides details on a cyber attack on a network that is managed by another cyber defender computing device; and outputting an alert to the cyber defender computing device with a potential cyber attacker or potential victim of the cyber attack on the network managed by the cyber defender computing device.

The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to accessing permissions data and access control data for pairs of compute resources and storage resources in the cloud environment, tracing network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data, accessing sensitivity classification data for objects in the storage resources, qualifying a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack based on an evaluation of the permissions data, the access control data, and the sensitivity classification data against a set risk criterion, and generating a representation of propagation of the breach attack along the network communication paths, the representation identifying relationships between the subset of the pairs of the compute resources and the storage resources.

A system and method for fast-detection and mitigation of emerging network fraud attacks includes sourcing digital event data samples associated with one or more online services; executing graph-rendering computer instructions that automatically construct a backbone graph using a subset of features extracted from the sourced digital event data samples, wherein the constructing includes: identifying, as graphical nodes, a first plurality of distinct features of the subset of features; identifying, as graphical edges, a second plurality of distinct features of the subset of features; generating a graphical edge between distinct pairs of graphical nodes comprising a same type of feature of the subset of features based on feature values associated with at least one distinct feature of the second plurality of distinct features; and mitigating, via a digital threat mitigation action, if one or more emerging network fraud attacks is identified based on an assessment of a cluster of networked nodes.

A multi-node, quantum communication network for providing quantum-secure time transfer with Damon attack detection is described. The network includes three or more nodes connected via authenticated communication channels forming a closed loop. By determining differences between the local times at as well as the time durations required for photons to travel between the three or more nodes, the network detects a Damon attack, if present. For example, the network imposes a closed loop condition to detect the Damon attack. The network can also use the local time differences and time durations for photon travel between nodes to synchronize the local clocks at the three or more nodes of the network.

An endpoint protection system is provided. The system comprises: an endpoint agent deployed to an endpoint device, wherein the endpoint agent is built-into one or more existing applications running on the endpoint device and is configured to capture network session activity between the endpoint device and one or more internet servers to detect a phishing attack using a set of machine learning algorithm trained classifiers, and block the phishing attack; and an endpoint management system in remote communication with the endpoint agent, wherein the endpoint management system is configured to train and develop the set of classifiers, and receive information about the detected phishing attack and an incident report from the endpoint agent, the endpoint agent provides a graphical user interface running on the endpoint device allowing an end user to configure one or more protections provided by the endpoint agent.

The disclosed computer-implemented method for protecting against misleading clicks on websites may include (i) detecting a user click event on a uniform resource locator (URL) for navigating to a website during a web browsing session, (ii) analyzing the user click event to identify expected domain behavior associated with navigating to the website based on the URL, (iii) determining, based on the analysis, that the user click event deviates from the expected domain behavior associated with navigating to the website based on the URL, and (iv) performing a security action that protects against potentially malicious activity caused by the user click event deviating from the expected domain behavior associated with navigating to the website based on the URL. Various other methods, systems, and computer-readable media are also disclosed.

A system for data protection includes a first computing device comprising a security module; and a storage device coupled to the first computing device via a network interface. The security module comprises at least one of Software Root of Trust (SRoT) and Hardware Root of Trust (HRoT). The security module is further configured to: establish a trust channel between the first computing device and the storage device or storage service; monitor the first computing device and the storage device; create and enforce multi-dimensional data access control by tightly binding data access and permissions to authorized computing devices, users, applications, system services, networks, locations, and access time windows; and take over control of the storage device or storage service in response to a security risk to the system.

A method of detecting manipulation of data on a Controller Area Network (CAN) bus, and a device performing the method. In an aspect, the method includes detecting manipulation of data on a CAN bus to which the device is connected. The method comprises detecting that bus impedance is below a threshold bus impedance value, detecting whether or not CAN node arbitration currently may occur on the CAN bus upon detecting that the bus impedance is below the threshold bus impedance value, and if not determining that an attempt to manipulate data on the CAN bus has occurred.

Systems and methods to detect malicious software include an application software repository including a stored header file associated with a driver, an executable, or both, and are operable to (i) receive a memory dump file upon an operating system crash including a driver copy, an executable copy, or both, (ii) verify the memory dump file is new for analysis, (iii) compress the verified memory dump file to generate a memory snapshot of the verified memory dump file, (iv) scan the memory snapshot for a memory dump header file associated with the driver copy, the executable copy, or both, and (v) identify and extract malicious software when the memory dump header file from the memory snapshot fails to match at least one stored header file in the application software repository.