In an information collection system, an address posting unit posts address information of a hidden service provided by a hidden service providing system to a server serving as a posting target server. Then, the hidden service providing system provides a hidden service appropriate to a hidden service request received from a user terminal to the user terminal. After that, an information collection unit collects information (e.g., input request information, service result information, etc.) about the hidden service provided by the hidden service providing system.

In order to appropriately accumulate communication data to be used for communication analysis, a communication processing apparatus 200 is configured to accumulate communication data to be used for communication analysis, and includes a data processing unit 235 configured to remove at least a part of the communication data to be accumulated, based on a communication property related to the communication data.

Systems and methods for analyzing user behavior patterns to detect compromised computing devices in an enterprise network are provided. According to one embodiment, an enforcement engine running on a network security device, identifies top users of a network exhibiting a suspicious behavior relating to login failures by determining a first set of users having a number of login failure events during a given time duration exceeding a threshold. The enforcement engine identifies from the first set of computers associated with the top users, a second set of computers exhibiting a suspicious behavior relating to new connections exceeding a threshold. The enforcement engine classifies a third set of computers, representing a subset of the second set exhibiting a suspicious behavior relating to consecutive new connections, as compromised source computers when their respective new connections are in a sequence that results in a Shannon entropy measure exceeding a threshold.

Some database systems may implement encryption services to improve the security of data stored in databases or on disks. The systems may implement encryption using multiple encryption keys. For example, a worker server may implement a system call interceptor, such as a filesystem in userspace (Fuse) driver. The system call interceptor may intercept system calls (e.g., associated with query or extract, transform, and load (ETL) jobs) as they enter or exit the kernel. The system call interceptor may determine whether data sets associated with the jobs are marked for encryption, and may perform an encryption process on the data sets. A worker may encrypt and store data sets on a worker disk or at a file store, or may retrieve and decrypt the data sets. The system may additionally manage encryption keys, and may provide mechanisms for archiving or revoking encryption keys while maintaining user access to stored data sets.

Novel tools and techniques are provided for implementing monitoring and detection of fraudulent or unauthorized use in telephone conferencing systems or voice networks. In various embodiments, a computing system might monitor call activity through telephone conferencing system or voice network. In response to detecting use of the telephone conferencing system or voice network by at least one party based on the monitored call activity, the computing system might identify incoming and/or outgoing associated with a call initiated by the at least one party. The computing system might analyze the identified incoming and/or outgoing call data to determine whether the call initiated by the at least one party constitutes at least one of fraudulent use or unauthorized use of the telephone conferencing system or voice network. If so, the computing system might initiate one or more first actions.

A system includes a security controller located within a central-zone in communication with a provisioned agent operating on an edge-zone device. The security controller may implement controller-blind security control on the edge-zone device by making security authorization determinations using a secure-operation confidence analysis performed by the provisioned agent. The provisioned agent, operating within the edge-zone, may have access to un-sanitized data, which may be unavailable to the security controller in the central-zone. The provisioned agent may access condition-descriptors via a secure-operation confidence assignment matrix. Using the condition-descriptors, the provisioned agent determine feedback, which may include a secure-operation confidence coefficient, based on the un-sanitized data to which the security controller is blind.

A secure enclave may be used to satisfy privacy requirements and audit requirements. Code may be loaded into the secure enclave. The code may generate a predefined report based on data and added noise. The pre-defined report may be subject to audit requirements. The data may be subject to the privacy requirements. The secure enclave may generate an encryption key and a decryption key based on the code. Only the secure enclave may have access to the decryption key. And the secure enclave may allow only a verified copy of the code to access the decryption key. With the added noise, the report may satisfy a pre-defined differential privacy guarantee. Encrypting the code and ensuring that the report satisfies the differential privacy guarantee may satisfy the privacy requirements. Retaining the report, the code, the secure enclave, and the encrypted data may satisfy the audit requirements.

In one embodiment, a method includes: transmitting a message to a first end point that includes an instruction to initiate a communication type, wherein the communication type includes sharing a randomization token between the first and second end points; obtaining a first communication report from the first end point and a second communication report from the second end point in response to initialization of a communication based on the communication type between the first end point and the second end point across the network, wherein the first and second communication reports respectively include a first and second hash that corresponds to a function of the randomization token and identity information; determining whether the first hash matches the second hash; generating a value that correlates the first and second end points with the communication across the network in response to determining that the first hash matches the second hash.

A system and method for securely recording voice communications, comprising a network-connected computer server and an authentication system which verifies the validity of voice communications.

Among other things, this document describes systems, methods and devices for providing a cloud proxy auto-config (PAC) function for clients connected to a private network, such as an enterprise network. The teachings hereof are of particular use with cloud hosted proxy services provided by server deployments outside of the private network (e.g., external to the enterprise or other organizational network). This document also describes systems, methods and devices for providing a proxy auto-config (PAC) function for clients connected to a third party network, such as when the client moves outside of the enterprise network.