A system for returning synthetic database query results. The system may include a memory unit for storing instructions, and a processor configured to execute the instructions to perform operations comprising: receiving a query input by a user at a user interface; determining, based on natural language processing, a type of the query input; determining, based on the received query input and a database language interpreter, an output data format; returning, based on a generation model and the output data format, a result of the query input; providing, to a plurality of training models and based on the determined query type, the query input and the result; and training the training models, based on the query input and the result.

This disclosure describes systems on a chip (SOCs) that prevent side channel attacks on encryption and decryption engines of an electronic device. The SoCs of this disclosure concurrently operate key-diverse encryption and decryption datapaths to obfuscate the power trace signature exhibited by the device that includes the SoC. An example SoC includes an encryption engine configured to encrypt transmission (Tx) channel data using an encryption key and a decryption engine configured to decrypt encrypted received (Rx) channel data using a decryption key that is different from the encryption key. The SoC also includes a scheduler configured to establish concurrent data availability between the encryption and decryption engines and activate the encryption engine and the decryption engine to cause the encryption engine to encrypt the Tx channel data concurrently with the decryption engine decrypting the encrypted Rx channel data using the decryption key that is different from the encryption key.

A computer-implemented method for building socket transferring between containers in cloud-native environments by using kernel tracing techniques is provided including probing a connection-relevant system call event by using an eBPF to collect and filter data at a router, creating a mirror call at a host namespace with a dummy server and dummy client by creating the dummy server with mirror listening parameters, sending a server host address mapping to overlay the server host address to the client coordinator in an overlay process, and creating and connecting the dummy client to return a client host address to the server coordinator. The method further includes transferring mirror connections to the overlay process via a forwarder by temporary namespaces entering and injecting socket system calls and probing a transfer call event to map an overlay socket with a transferred dummy socket to activate duplication when the overlay socket is not locked.

There is provided a method to eliminate data-theft through a phishing website by creating a layer of control between the user and the website to be visited that prevents submission of sensitive data to malicious servers. When there is a form submit event in a webpage, the data that is input (by the user or automatically) is modified by a data deception layer in a random manner that disguises the authentic content, while preserving the format of the data. Visual cues are provided to indicate that the data deception is enabled and that fake/generated data is being submitted instead of real data. The generated fake data is sent to unknown (potentially malicious) server while the users' actual private data is preserved (never submitted), with the results of the server response visible to the user.

The present invention relates to a method for automatic aggregating and enriching data from honeypots comprising defining a plurality of identified honeypots of a different type to be monitored in a network; collecting metadata and samples from said honeypots of a different type in said network, which in turn comprises defining a predefined collection model for the honeypots such as to collect homogeneous metadata and samples among the honeypots of a different type, extracting the metadata according to the collection model defining a model metadata, and extracting the samples according to the collection model defining model samples; enriching said metadata and sample collected, which in turn comprises scanning the model metadata to extract IoCs, scanning the model samples to extract IoCs, recursively scanning the model samples to generate secondary model metadata and scanning the secondary model metadata to extract IoCs, until no further IoCs can be generated, recursively obtaining secondary samples from the extracted IoCs and scanning the secondary model samples to extract IoCs, until no further secondary samples are obtained; and aggregating said metadata and samples collected and/or enriched, which in turn comprises aggregating metadata by a predefined metadata model aggregation and aggregating samples by a predefined samples model aggregation.

Management and configuration of internet of things network connected devices is facilitated herein. A proxy device comprises a memory that stores executable instructions that, when executed by a processor, facilitate performance of operations that comprise determining a first identity and a first operational parameter of a first device and a second identity and a second operational parameter of a second device. The first device and the second device can be associated with a defined communication network. The proxy device can be provisioned within the defined communication network and can operate as a security update proxy node for the first device and the second device. The operations can also comprise facilitating a first security update at the first device and a second security update at the second device based on a determination that the first device and the second device have delegated responsibility for security synchronization to the proxy device.

Various automated techniques are described herein for the runtime detection/neutralization of malware executing on a computing device. The foregoing is achievable during a relatively early phase, for example, before the malware manages to encrypt any of the user's files. For instance, a malicious process detector may create decoy file(s) in a directory. The decoy file(s) may have attributes that cause such file(s) to reside at the beginning and/or end of a file list. By doing so, a malicious process targeting files in the directory will attempt to encrypt the decoy file(s) before any other file. The detector monitors operations to the decoy file(s) to determine whether a malicious process is active on the user's computing device. In response to determining that a malicious process is active, the malicious process detector takes protective measure(s) to neutralize the malicious process.

Methods and systems for identifying a network threat are disclosed. The methods described herein may involve receiving at least one permutation of a domain name, wherein the at least one permutation is registered with a domain name registrar. The methods described herein may further involve executing a scanning function to identify an active service on the at least one permutation registered with the domain name registrar and implementing a threat prevention procedure upon identifying an active service on the at least one permutation.

A processor may install an imposter security client (ISC) at an endpoint. The processor may install a subscription based imposter security service (ISS). The ISS may be part of an identity and access management (IAM) system. The processor may exchange information between the ISC and the ISS. The exchange may be automatically triggered when the ISS receives an imposter identification (ID) from the IAM system. The imposter ID may be associated with an unauthorized endpoint user. The processor may protect the endpoint from the unauthorized endpoint user.

Systems and methods are described for leveraging the knowledge and security awareness of well-informed users in an organization to protect other users and train them to identify new phishing attacks. Initially, a report of a message being suspicious may be identified and it may be determined whether message is a malicious phishing message. In an example, a well-informed user of an organization may report the message as suspicious. Further, on determining the message to be a malicious phishing message, a simulated phishing message or a template may be created. The simulated phishing message may then be communicated to one or more devices of one or more users.