Radware Ltd.

A method and system for detecting client-side cross-site scripting exploitation attacks according to an embodiment are disclosed. The method includes downloading an access list from a remote server; capturing a request to access an external resource, wherein the request is initiated by a script executed over the web browser, wherein the external web resource is external to the web browser executed on a client device; determining, based on the access list, if the requested external web resource can be accessed; and applying a mitigation action on the request to access the external web resource when it is determined that the external web resource cannot be accessed.

A system and method for accelerating web content delivery are disclosed. The method includes capturing a request to access a webpage hosted by a web server, the request is initiated by a web browser; determining if there are resources in the requested webpage cached locally at a cache memory of the web browser; retrieving cached resources that are locally cached at the web browser; retrieving uncached resources from the web server; and rendering the webpage on the webpage from the cached resources and the uncached resources.

A method and system for defending AI agents against prompt injection attacks is provided. The method and system include: monitoring, in real-time, a plurality of prompts and a plurality of action sequences for a plurality of AI agents, wherein an action sequence is a series of actions intended to be performed by the AI agent based on at least a corresponding prompt; and for each AI agent, computing a semantic distance metric between each prompt and each action sequence, comparing the computed semantic distance metric to a learned baseline semantic distance computed for the AI agent; and causing an execution of a mitigation action when the computed semantic distance metric deviates from the baseline semantic distance.

A system and method for determining a resolution playbook for a cybersecurity incident is provided. The method includes applying a reasoning model to determine scores for a plurality of playbooks based on input data related to a root-cause of a cybersecurity incident, wherein the reasoning model includes a plurality of nodes of features and the plurality of playbooks arranged in a causal relationship; identifying a matching playbook based on the determined scores for the plurality of playbooks; and triggering execution of the matching playbook to resolve the cybersecurity incident.

In some implementations, the device may include instantiating a plurality of agents configured to communicate with a plurality of security tools deployed in the organization, where each of the plurality security tools defends against a different type of cyber-incident. In addition, the device may include receiving, by an agent of the plurality of agents, an input request from a respective security tool, where the input request includes at least a traffic pattern; generating, by the agent, a prompt for an AI model based on at least the input request the prompt when processed by the AI model returns at least instructions to modify at least one security policy set with the security tool; and feeding, by the agent, the at least instructions to the security tool, where the at least instructions, when executed by the security tool, causes the security tool to modify each of the least one security policy in real-time.

A system and method for defending against cyberattacks executed by one or more large language model (LLM)-powered agents presented. The method includes deploying one or more traps throughout a computing environment to protect at least one protected entity, wherein each trap of the one or more traps is designed to exploit one or more vulnerabilities of a LLM contained within an LLM-powered agent; monitoring, in real-time, a plurality of interactions with the deployed traps; detecting, based on the monitored plurality of interactions, interaction behavior consistent with that of at least one LLM-powered agent of the one or more LLM-powered agents; and responsive to the detection, causing one or more of the deployed traps to initiate one or more defensive actions.

A method and system for mitigating encrypted distributed denial of service (DDOS) attacks comprising: receiving a detection of an encrypted DDOS attack from an encrypted transaction related traffic, wherein the encrypted DDOS attack is associated with a plurality of transport layer security (TLS) fingerprints (FPs); classifying each of the plurality of TLS FPs as a type of FP based on a comparison of rate-invariant values to a native FP baseline, wherein the rate-invariant values are associated with the plurality of TLS FPs; selecting anomalous FPs as a subset of the plurality of TLS FPs; generating a real time signature (RTS), for the encrypted DDOS attack, having at least one unknown type of FP of the subset of anomalous FPs; and mitigating the encrypted DDOS attack based on the generated RTS.

A system and method for detecting HTTPS flood cyber-attacks. A method includes deriving traffic features from incoming traffic directed to a protected entity; determining if the derived traffic features represent at least one traffic anomaly, wherein the traffic anomaly is a deviation from at least one baseline, wherein the baseline is a normal distribution of traffic features of legitimate incoming traffic; upon determining that the derived traffic features represent at least one anomaly, determining if the anomaly characterizes an on-going HTTPS flood cyber-attack; upon determining that there is the on-going HTTPS flood cyber-attack, populating a list of suspect source internet protocol (IP) addresses of devices triggered detection of the anomaly; challenging each device in the list of suspect source IP addresses to determine if a challenged device is an attack tool; and causing execution of a mitigation action on each client device determined to be an attack tool.

A method and system for mitigating encrypted distributed denial of service (DDoS) attacks comprising: receiving a detection of an encrypted DDoS attack from an encrypted transaction related traffic, wherein the encrypted DDoS attack is associated with a plurality of transport layer security (TLS) fingerprints (FPs); classifying each of the plurality of TLS FPs as a type of FP based on a comparison of rate-invariant values to a native FP baseline, wherein the rate-invariant values are associated with the plurality of TLS FPS; selecting anomalous FPs as a subset of the plurality of TLS FPs; generating a real time signature (RTS), for the encrypted DDoS attack, having at least one unknown type of FP of the subset of anomalous FPs; and mitigating the encrypted DDoS attack based on the generated RTS.

A method and system for detecting and mitigation a cyber-attack scanner are provided. The method includes determining if a source network address designated in a received packet is suspicious as of a cyber-attack scanner, wherein the determination is based on a likelihood that the source address was previously frequently encountered; upon determining that the source network address is suspicious, determining diversity of destination network addresses sent by a source having the suspicious network address; and upon determining that the destination network addresses are diversified, generating an alarm indicating that a source network address is a cyber-attack scanner, wherein a cyber-attack scanner is a device to identify destination network addresses in a protected entity that be exploit for at least a cyber-attack scanner.