NortonLifeLock Inc.

Systems and methods for identifying accurate locations of in-person payment card transactions to detect location-based payment card anomalies. Some embodiments disclosed herein may enable identifying accurate locations of in-person payment card transactions to detect location-based payment card anomalies. In some embodiments, purchase data for a plurality financial transaction by a consumer that are performed in-person with a payment card may be received. The purchase data may identify merchant locations that are associated with each financial transaction. The merchant locations may be analyzed to determine whether they represent true physical locations of the financial transactions. Once a plurality of true physical locations has been identified, distances between them may be determined and a security action may be performed if the distances exceed a threshold.

Protecting against potentially harmful app (PHA) installation on a mobile device. In some embodiments, a method may include identifying apps already installed on multiple mobile devices, identifying PHAs in the apps already installed on the multiple mobile devices, training a machine learning classifier, based on the apps already installed on multiple mobile devices, to predict a likelihood that each of the PHAs will be installed on any mobile device, identifying one or more apps already installed on a particular mobile device, predicting, using the machine learning classifier, a likelihood that a target PHA of the PHAs will be installed on the particular mobile device based on the one or more apps already installed on the particular mobile device, and in response to the likelihood being higher than a threshold, performing a remedial action to protect the particular mobile device from the target PHA.

The disclosed computer-implemented method for detecting fraudulent shopping websites may include (i) identifying a shopping website that advertises a plurality of allegedly available payment options for completing transactions on the shopping website, (ii) determining, based at least in part on an analysis of the plurality of allegedly available payment options that at least one of the plurality of allegedly available payment options is suspicious, (iii) calculating a trustworthiness score for the shopping website that is based at least in part on the determination that at least one of the allegedly available payment options is suspicious, and (iv) displaying an alert to a user based on the trustworthiness score of the shopping website. Various other methods, systems, and computer-readable media are also disclosed.

Protecting from automatic reconnection with Wi-Fi access points having bad reputations. In some embodiments, a method may include determining that the mobile device is within range of a Wi-Fi access point, determining that the mobile device is configured to automatically reconnect to the Wi-Fi access point, receiving a request to indicate whether the Wi-Fi access point has a bad reputation, accessing an access point reputation database to determine whether the Wi-Fi access point has a bad reputation, sending an indication that the Wi-Fi access point has a bad reputation, and, in response to the indication that the Wi-Fi access point has a bad reputation, protecting the mobile device from the Wi-Fi access point by performing a remedial action at the mobile device.

Mitigating website privacy issues by automatically identifying cookie sharing risks in a cookie ecosystem. In some embodiments, a method may include generating, by the computing device, a cookie tree representing cookies created on a web browser while browsing a website. The cookie tree may include nodes representing organizations. The cookie tree may further include hierarchical edges between the nodes representing creation chains of the nodes. The method may also include determining, by the computing device, a creator, a sender, and a receiver of each of the cookies. The method may further include mitigating, by the computing device, website privacy issues based on the creator, sender, and receiver of each of the cookies.

The disclosed computer-implemented method for protecting user data privacy against anti-tracking evasion techniques for web trackers may include (i) detecting hypertext markup language (HTML) associated with a website displayed in a browser application, (ii) identifying one or more elements in the HTML capable of executing web tracking code from the website, (iii) determining, based on information describing scripting programming code responsible for embedding the HTML elements in the website, a presence of a hidden web tracking script, and (iv) performing a security action that protects against a potential invasion of user data privacy by preventing the hidden web tracking script from executing the web tracking code in the browser application. Various other methods, systems, and computer-readable media are also disclosed.

A method for securing and authorizing sensitive operations is described. A computing device may receive a first authentication factor from a second computing device based on a request from the second computing device to authorize an operation; upon validating the first authentication factor, send to at least the second computing device and a third computing device, a request for a second authentication factor; and authorize the operation based on validating the second authentication factor from the second computing device or from the third computing device, or from both.

The disclosed computer-implemented method for restricting capture of self-portrait images on mobile devices may include (i) capturing sensor data associated with a surrounding environment, (ii) detecting a user input for taking one or more self-portrait images, determining, based on the sensor data, one or more potential hazards associated with the taking of the self-portrait images within the surrounding environment, and (iv) performing a security action to protect against the potential hazards associated with the taking of the self-portrait images within the surrounding environment. Various other methods, systems, and computer-readable media are also disclosed.

The disclosed computer-implemented method for deep packet inspection of vulnerable network devices may include (i) detecting at least one vulnerability associated with a network device service, (ii) identifying one or more network devices associated with the vulnerability, (iii) initiating a deep packet inspection of data traffic communicated by a target network device, (iv) determining, based on the deep packet inspection, one or more signatures associated with a potential malware attack for the target network device, and (v) performing a security action that mitigates the potential malware attack. Various other methods, systems, and computer-readable media are also disclosed.

Identifying and removing a tracking capability from an external domain that performs a tracking activity on a host web page. Tracking capabilities of an external domain may be removed by altering web requests and/or responses to API calls. Once these tracking capabilities of the external domain have been removed, the altered web requests and/or altered responses to API calls may be transmitted to a web browser and/or entity making the API call thereby protecting user privacy while allowing the external domain to interact with the host web page.