Trend Micro Incorporated

Method and system for evaluating contents stored in a Distributed Hash Table (DHT) network are described. Contents are stored as chunks across nodes of the DHT network. Contents are subjected to cybersecurity evaluations to generate risk histories of the chunks. A reputation of a target content is determined based on corresponding risk histories of individual chunks that are present in the target content.

Online content is received in a user computer over the public Internet. A target text of the online content is selected to check for misinformation. A search query is generated using the target text. An online search is performed using the search query to generate a first set of search results. Another online search is performed using an opposite search query, which conveys a meaning that disagrees with the target text, to generate a second set of search results. Misinformation in the online content is detected based on how much the target text aligns with collected online contents from the first and second search results.

Disclosed is a system and method of black box testing a cybersecurity system. An attack chain or an element of the attack chain is decomposed into constituent primitives. Primitive codes for the primitives are generated by a generative artificial intelligence (AI) model. The primitive codes are assembled into a pseudo-malware. A malware scanning engine is black box tested against the pseudo-malware to determine whether the malware scanning engine can detect the pseudo-malware.

A system for preventing submission of sensitive information of an enterprise to a generative artificial intelligence (AI) chatbot includes an endpoint computer and a backend system. A user of the enterprise employs the endpoint computer to chat with the generative AI chatbot. The chat is monitored on the endpoint computer, and a record of the chat is provided to the backend system over the public Internet. In the backend system, the record of the chat is parsed to identify the enterprise's sensitive information, enabling the facilitation of corresponding security management responses and actions.

A cybersecurity system protects personally identifiable information (PII) of users on a computer network. A webpage received in an endpoint computer of the cybersecurity system is parsed to detect one or more input fields that ask a user of the endpoint computer for a PII. Instead of entering the PII of the user into an input field, a substitute value for the PII of the user is entered into the input field based at least on a website that served the webpage to the endpoint computer.

An endpoint computer is protected from malicious distributed configuration profiles. The endpoint computer receives a distributed configuration profile over a computer network. Before installation of the distributed configuration profile in the endpoint computer, features of the distributed configuration profile are used to traverse a supervised decision tree. A rating score is generated based on weights of nodes of the supervised decision tree that are traversed using the features of the distributed configuration profile. The distributed configuration profile is detected to be malicious based at least on the rating score.

System and methods of analyzing customer events logs for cybersecurity with privacy protection are disclosed. Events logs of cybersecurity events are received from customer computers. Customers in the events logs are represented with ring signatures. Candidate features that occur in a group of events are identified in the events logs. A candidate feature is analyzed, based on corresponding ring signatures, to determine if the candidate feature can be attributed to a customer or a limited number of customers. If so, the candidate feature is considered private and is discarded. Otherwise, the candidate feature is retained as public data suitable for use in cybersecurity operations.

Systems and methods are presented for mitigating cyber threats. Cybersecurity-related data are stored in a semantic cybersecurity database. A user interface converts a user input to a command utterance. A command node that corresponds to the command utterance is identified in the cybersecurity database. The command node is resolved to one or more action nodes that are connected to the command node, and each action node is resolved to one or more parameter nodes that are connected to the action node. The command node has a command that implements actions indicated in the action nodes. Each action can have one or more required parameters indicated in the parameter nodes. The values of the required parameters are obtained from the command utterance, prompted from the user, or obtained from the cybersecurity database. Actions with their parameter values are executed to mitigate a cyber threat in accordance with the user input.

A scam detection system includes a user computer that runs a security application and a backend system that runs a scam detector. An email is received at the user computer. The security application extracts and forwards a content of the email, which includes a body of the email, to the backend system. The email body of the email is anonymized by removing personally identifiable information from the email body. A hash of the anonymized email body is generated and compared against hashes of a whitelist and a blacklist. The anonymized email body is classified. A segment of text of the anonymized email body is identified and provided to the user computer when the anonymized email body is classified as scam.

An attachment to an e-mail message received at an e-mail gateway is scanned by a scan server and then is converted into an HTML file. The HTML file includes preview data of the attachment (minus any macro scripts), the entire original data of the attachment, scan functionality enabling a user to send the attachment back to a scan server for a second scan, or extract functionality enabling a user to extract the original attachment data for saving or opening in an application. The recipient is able to open or save the attachment directly if he or she believes it comes from a trusted sender. If the attachment seems suspicious, the recipient previews the attachment first before performing a scan, opening the attachment or deleting it. The recipient performs a scan of the attachment by clicking a “scan” button to send the attachment to a backend server for a second scan where an updated virus pattern file may be available to detect any zero-day malware.