CrowdStrike Patente

The present disclosure provides techniques for real-time voice analysis to prevent social engineering that can be integrated with existing communication systems . A processing device generates, via an AI model, a representation of a voice of a speaker based on an audio recording comprising the voice of the speaker. The processing device determines, based on the audio recording, an identifier of the speaker. The processing device executes, based on the representation of the voice and the identifier of the speaker, a search over a database comprising cases for known threat campaigns and profiles for verified users. The processing device outputs, based on search results for the search, an indication as to whether the speaker is part of a threat campaign and a likelihood that a purported identity of the speaker matches an actual identity of the speaker.

Prediction of CPEs using banners greatly improves computer functioning. Many web services have an unknown common platform enumeration (CPE). When the CPE is unknown, a computer system is unable to obtain cybersecurity flaws and software fixes for a software product or web service. A CPE, though, is predicted by banner-prompting a large language model using a web service banner. Once the CPE is predicted, vulnerabilities may be identified.

A security agent executing on a computing system may determine when an encryption process, configured to generate an encrypted archive file containing one or more files, is initiated on the computing system. The security agent may identify files accessed by the encryption process during generation of the encrypted archive file, and may generate corresponding archive content data indicating content of the files accessed by the encryption process and that are likely included within the encrypted archive file. The security agent may apply policies to operations associated with the encrypted archive file by using the archive content data to determine contents of the encrypted archive file, without decrypting the encrypted archive file.

The present disclosure provides an approach of collecting contextual execution data of a service executing in a runtime environment. The contextual execution data indicates a communication between the service and a runtime entity within the runtime environment. The approach determines a cybersecurity risk score of the service based on the contextual execution data and prioritizes the service based on the cybersecurity risk score. In turn, the approach performs a remediation of a cybersecurity threat to the service based on the prioritizing.

The present disclosure provides techniques for machine speed attack defense. A processing device detects evidence of a potential in-progress cybersecurity attack with respect to an endpoint. The processing device generates a data structure based on the detected evidence. The processing device performs a fuzzy comparison based on the data structure and at least one data structure associated with a known cybersecurity attack. The processing device implements, based on the fuzzy comparison, a reversible response to the potential in-progress cybersecurity attack.

The present disclosure provides an approach of obtaining information associated with a software program. The present disclosure produces, by a processing device, a classification using an AI model that identifies, in the information, a provision indicating that the software program will perform an intrusive action. In turn, the present disclosure provides the classification to a destination device that indicates the information comprises the provision.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

The present disclosure provides an approach of collecting vulnerability data corresponding to a vulnerability of a target product. The approach provides the vulnerability data to an artificial intelligence model that is trained to determine a complexity indicator from the vulnerability data. The complexity indicator corresponds to applying a vulnerability patch to remediate the vulnerability. The approach determines a patch complexity classification by providing the complexity indicator to the artificial intelligence model and, in turn, provides the patch complexity classification to a target system corresponding to the target product.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

A bus filter driver and security agent components configured to retrieve and analyze firmware images are described herein. The bus filter driver may attach to a bus device associated with a memory component and retrieve a firmware image of firmware stored on the memory component. The bus filter driver may also retrieve hardware metadata. A kernel-mode component of the security agent may then retrieve the firmware image and hardware metadata from the bus filter driver and provide the firmware image and hardware metadata to a user-mode component of the security agent for security analysis. The security agent components may then provide results of the analysis and/or the firmware image and hardware metadata to a remote security service to determine a security status for the firmware.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Techniques and systems are described for enabling an identity provider to identify a computing device during authentication of a user that uses the computing device, and to do so in a manner that is independent of a browser and/or a client application and/or an operating system on the computing device. For example, upon receiving, from a first identity provider, redirection data to redirect an authentication request to a second identity provider, a security agent executing on the computing device may intercept the authentication request, retrieve data about the computing device, and send the authentication request with the device data to the second identity provider. Upon receiving, from the second identity provider, a signed response to the authentication request, the computing device may send the signed response to the first identity provider to receive a result of the authentication request from the first identity provider.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …