McAfee, LLC

A computer-implemented system, method, and apparatus for warning a user of fraudulent call phases may include communicating with a backend analysis engine, wherein the backend analysis engine is to provide a periodically-updated assessment of a voice call, the assessment comprising an inferred call phase and a fraudulence score; and providing a graphical user interface (GUI) visible to a participant of the voice call, wherein the GUI is to display the inferred call phase and a visual fraud indicator based on a likelihood that the voice call is fraudulent.

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a network interface; a userspace application store including a plurality of userspace applications, wherein at least some of the userspace applications are programmed to communicate via the network interface; and instructions encoded within the memory to: enumerate social connections of a user via the userspace applications; assign the social connections to virtual groups according, at least in part, to correlated connection services; assign data transfer policies to the virtual groups; detect an attempted data transfer to a social connection; and enforce the data transfer policy for a virtual group of the social connection of the attempted data transfer.

Systems, apparatus, articles of manufacture, and methods are disclosed. An example apparatus includes interface circuitry; machine readable instructions; and programmable circuitry to at least one of instantiate or execute the machine readable instructions to: remove content data from a file corresponding to a first webpage, the file to include structure determiners after the removal of the content data; normalize data within the structure determiners; group the normalized structure determiners into tiles; compute a first output of a hashing algorithm using the tiles; and compare the first output to a second output of the hashing algorithm to generate a similarity value, the second output corresponding to a second webpage, the similarity value representing a structural similarity between the first webpage and the second webpage.

There is disclosed a computer-implemented method of assigning reputations to objects, including: for respective samples in a dataset, extracting n features from a sample into a feature vector, where n is an integer greater than 1; assigning the sample a globally unique or pseudo-unique identifier (GUID); according to a clustering algorithm, mapping the feature vector into an n-dimensional space and computing distances between the sample and other samples in the n-dimensional space; assigning groups of objects to clusters according to their distances in the n-dimensional space; correlating the clusters to cluster tags based on the GUIDs of the samples, wherein the cluster tags are stored in a persistent cluster tag storage; and assigning the sample a reputation based on reputations of other samples in a cluster that the sample clustered with.

Disclosed examples include obtaining malicious neighbor samples based on a non-classified sample; obtaining clean neighbor samples based on the non-classified sample; generating a malicious proximity vector representing first distances between the non-classified sample and a first malicious neighbor sample from the malicious neighbor samples; generating a clean proximity vector representing second distances between the non-classified sample and a first clean neighbor sample from the clean neighbor samples; and classifying the non-classified sample as a clean sample or a malicious sample based on at least one of the malicious proximity vector or the clean proximity vector.

Systems, apparatus, articles of manufacture, and methods are disclosed to improve the efficiency of an artificial intelligence-based threat detection model. An example apparatus includes interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to: obtain an email address from a group of email addresses to be considered as candidates for adding to the list of non-suspicious email addresses, determine that a domain of the email address is indicative of a non-email service providing entity, determine that the email address has a policy configured for a domain-based message authentication, reporting, and conformance (DMARC) record, add the email address associated to the list of non-suspicious email addresses, and cause the artificial intelligence-based threat detection model to skip an analysis of an email associated with the email address.

Systems, apparatus, articles of manufacture, and methods to self-guardrail large language model responses are disclosed. An example apparatus includes interface circuitry, instructions, and programmable circuitry to at least one of execute or instantiate the instructions to access a first response message provided by a first large language model, the first response message generated based on an initial prompt, cause a second large language model to determine the first response message is inappropriate, modify the initial prompt to create a modified prompt, and provide the modified prompt to the first large language model to trigger generation of a second response message.

Methods, apparatus, systems, and articles of manufacture are disclosed to improve offloading of malware scans. An example apparatus is to, based on a trigger to perform a scan of a volume of data, estimate a computational burden associated with performing the scan using the CPU, the volume of data representative of at least one of a file or an object. Additionally, the example apparatus is to determine whether the computational burden satisfies a threshold associated with offloading the scan to the GPU. The example apparatus is also to cause at least one of the CPU or the GPU to perform the scan based on whether the computational burden satisfies the threshold.

There is disclosed a system and method of providing services on a home gateway, including providing a set of security scans for traffic to and from a plurality of devices on a home network; cryptographically verifying that a secured device from the plurality of devices provides for itself internal security services; and based on the cryptographic verification, skipping at least one security scan of the set of security scans for traffic of the secured device.

By way of example, a method includes, responsive to a user request to download, from the internet, a downloadable file with executable content, downloading a portion of the downloadable file, wherein the downloadable file is not executable with the portion; after download the portion of the downloadable file, scanning the portion of the downloadable file for malware characteristics to classify the downloadable file; and completing downloading the downloadable file only after determining, based on the scanning of the portion of the downloadable file, that the downloadable file is not malware.