安全术语表

冒充可信主体,试图窃取凭证、资金或敏感信息的欺骗性消息。

针对特定个人或组织,利用精心搜集的信息定制而成的高精度定向钓鱼攻击。

冒充高管或供应商,诱导转账、变更账户信息或泄露数据的社会工程欺诈手法,常常不含任何链接或附件。

供应链型商业邮件欺诈(BEC),攻击者劫持受信任供应商的账户,篡改发票中的收款账户信息。

将恶意链接隐藏在二维码背后,以绕过URL过滤机制的钓鱼手法。

利用短信(Smishing)或语音电话(Vishing)进行的钓鱼攻击,常与邮件攻击结合使用。

伪造发件人地址或显示名称,使邮件看起来像是来自合法发件人的技术手段。

实际发件地址不变,仅伪造显示名称(例如冒充高管或品牌)的一种冒充手法。

外观与正规域名极为相似的仿冒域名(例如以rn仿冒m,以0仿冒o)。

利用窃取的凭证接管真实账户,从而在内部发起攻击的行为。

通常通过伪造登录页面等手段收集用户名和密码的行为。

尚无补丁或特征库可用的新型漏洞或攻击手法。

An attack that uses large language models to mass-produce highly natural, personalized phishing emails free of grammatical errors.

A phishing technique using fake customer-support accounts on social media to approach complaining users and steal their information.

A technique that lures victims into running malware themselves using enticing bait such as infected USB drives or free downloads.

A technique that mimics a well-known brand's logo, design, and domain to deceive users with emails or sites that look authentic.

A common BEC variant in which an attacker impersonates a CEO or top executive to instruct finance staff to make urgent wire transfers.

A phishing technique that copies a legitimate previously delivered email and resends it with attachments or links swapped for malicious ones.

A phishing technique that tricks users into granting permissions to a malicious OAuth app, enabling data access without stealing passwords.

An attack where adversaries monitor an ongoing business email conversation and inject themselves to alter payment details or commit fraud.

An attack using AI-generated fake audio or video to impersonate executives in calls or voice messages to induce wire transfers or data leaks.

An attack where adversaries steal credentials to seize a legitimate email account and abuse it for internal impersonation or fraud.

A common BEC social-engineering scam that impersonates an executive to urgently ask an employee to buy gift cards and send the codes.

An attack using visually identical Unicode characters (e.g., Cyrillic 'a' vs Latin 'a') to create fraudulent domains that look legitimate.

A general class of attacks that masquerade as trusted persons, brands, or organizations so victims believe requests are legitimate.

A BEC-style financial fraud that sends fake or altered invoices to redirect payments to attacker-controlled accounts.

An attack vector delivering malware or malicious macros hidden in email attachments such as documents or archives that infect upon opening.

Spam email carrying malicious attachments or links, sent in bulk and serving as a primary vector for malware infections.

A BEC scam that impersonates an employee to ask HR or payroll to change direct-deposit details, diverting wages to an attacker's account.

An attack that redirects users to fraudulent websites via DNS poisoning or host-file manipulation even when they enter a legitimate address.

A cybercrime business model that sells phishing infrastructure, kits, and hosting as a subscription service, lowering the barrier to attacks.

A pre-built package bundling fake login pages and collection scripts so non-experts can quickly deploy phishing sites.

A social-engineering technique where an attacker fabricates a plausible scenario or false identity to gain a victim's trust and extract information.

A social-engineering technique that offers a service or benefit, such as fake tech support, in exchange for credentials or access.

An email attack that inserts malicious links or attachments into an existing reply chain from a compromised account so recipients open them without suspicion.

An extortion scam email that threatens to release supposed compromising sexual material unless the victim pays money such as Bitcoin.

A phishing attack delivered via SMS text messages using malicious links or fraudulent prompts to deceive users.

The manipulation of human psychology and trust, rather than technical vulnerabilities, to induce information disclosure or security bypass.

Unsolicited bulk email sent without recipient consent, often abused as a vector for phishing or malware distribution.

An attack that floods a victim's inbox with massive email volume in a short time to bury legitimate security or fraud-alert notifications, often as a precursor to follow-on scams.

A physical social-engineering technique of following an authorized person into a restricted area without credentials, also known as piggybacking.

An attack that replies into an existing conversation thread from a compromised mailbox to insert malicious content while exploiting established trust.

Registering misspelled variants of popular domains to capture users who make typing errors and redirect them to malicious sites.

A technique abusing open-redirect vulnerabilities on trusted sites so links appear legitimate but forward victims to malicious destinations.

A social-engineering attack that uses phone or voice calls to deceive victims into divulging personal or financial information.

A fraud technique where AI clones a target's voice from short samples to impersonate family or superiors and demand urgent money transfers.

A targeted attack that compromises websites frequently visited by a target group to infect their visitors.

An Office or PDF document manipulated with macros, exploits, or embedded objects to execute malware merely upon opening.

A form of spear phishing that targets high-profile executives such as CEOs or CFOs to exploit their authority and access to funds.

通过DNS记录声明允许代表某域名发送邮件的邮件服务器的认证机制。

为邮件附加加密签名以验证其内容未被篡改的认证机制。

依据SPF/DKIM的验证结果强制执行策略(拒绝/隔离)并接收报告的标准协议。

在邮件经过中继服务器转发时,保留并重新签名认证结果以便传递下去的验证链机制。

指向某域名收件邮件服务器的DNS记录;内联网关类方案会改动这条记录。

A standard that displays a brand's verified logo next to authenticated messages in the inbox for domains passing DMARC, with the logo validated via DNS and a Verified Mark Certificate.

A protocol that binds TLS certificates or public keys to DNS names using DNSSEC-protected TLSA records, enabling verification of server certificates for protocols such as SMTP without relying solely on CAs.

An identifier used to distinguish among multiple DKIM keys for a domain; the corresponding public key is published at the DNS location selector._domainkey.domain.

A periodic XML report sent by receiving servers to a domain owner, summarizing statistics on SPF, DKIM, and DMARC authentication results for the domain's mail.

The core DMARC requirement that the domain authenticated by SPF or DKIM match the domain in the message's From header, evaluated in strict or relaxed mode.

Extensions that add digital signatures to DNS responses to provide data integrity and origin authentication, preventing DNS spoofing and cache poisoning and underpinning DANE.

A TLS property using ephemeral per-session keys so that even if a long-term private key is later compromised, previously recorded encrypted traffic cannot be decrypted.

A mechanism letting a domain publish, over HTTPS, a policy requiring TLS encryption and certificate validation for inbound SMTP connections, defending against downgrade and man-in-the-middle attacks.

An open standard for email encryption derived from PGP (RFC 4880 and successors) that defines message and key formats so implementations like GnuPG can interoperate.

A public-key cryptography program for encrypting and signing email and files, using a web-of-trust model to validate keys.

The envelope sender (MAIL FROM) address of an email, where bounce messages are returned, and whose domain is the basis for SPF verification and DMARC alignment.

A standard for end-to-end signing and encryption of email messages using X.509 certificate-based public-key cryptography, providing message integrity, authentication, and confidentiality.

The standard internet protocol for transmitting email between mail servers and from clients to servers; plaintext by default, it is secured with STARTTLS or SMTPS.

A method of encrypting SMTP with TLS from the start of the connection (implicit TLS, typically port 465), encrypting from the outset rather than via the opportunistic upgrade of STARTTLS.

A DNS TXT record listing a domain's authorized sending mail servers, beginning with v=spf1 and composed of mechanisms like include, a, mx, ip4 and qualifiers such as -all.

A command that opportunistically upgrades an existing plaintext protocol connection to a TLS-encrypted one, used in SMTP, IMAP, and POP3 to secure the transport while keeping standard ports.

A standard that lets domains using MTA-STS or DANE receive daily aggregate reports from sending mail servers about TLS negotiation successes and failures.

A digital certificate issued by an authority that verifies a brand's trademark rights to a logo, used in BIMI to display a validated logo in the inbox.

部署在MX记录前端、在邮件送达前进行过滤的传统内联式方案。

通过API接入M365/Workspace,在邮件送达后进行扫描与修复的现代化方案(无需更改MX记录)。

将所有邮件的副本发送至安全系统,以实现不中断业务的监控与审计。

在隔离环境中运行可疑附件或链接,以观察其恶意行为的动态分析技术。

从附件中剥离宏等主动内容元素,并安全重构后再行传递的技术。

使数据始终处于其所在司法辖区的法律与管控之下,通常通过本地部署或区域内部署实现。

Collateral spam in which bounce messages or auto-replies to spam with forged sender addresses flood innocent third parties.

A security control that inserts a warning banner at the top of messages from outside the organization to raise user awareness.

A core ICES capability that automatically retracts or removes messages already delivered to inboxes once they are found malicious, via API (clawback).

A mail server control that limits SMTP connection or send rates per source IP or domain to mitigate spam, abuse, and overload.

An availability and disaster-recovery capability ensuring users can send and receive email even during a primary mail system outage.

A technology that inspects outbound email content to detect, block, or encrypt unauthorized transmission of sensitive data.

A gateway solution that automatically encrypts outbound email according to policy to protect sensitive information.

A feature that holds suspected spam, malware, or phishing email in a separate quarantine area instead of the inbox for admin or user review.

A technology that detonates suspicious attachments or URLs in an isolated virtual environment to dynamically analyze malicious behavior.

A capability that temporarily stores mail on a backup server when the destination is down and re-delivers it after recovery to prevent loss.

A technique that temporarily rejects email from unknown senders, relying on legitimate MTAs to retry, thereby filtering out spambots.

An email retrieval protocol that keeps messages on the server and allows synchronized access across multiple devices.

The two email security deployment models: inline, which sits in the mail flow to block in transit, versus API-based, which integrates with mailbox APIs to act post-delivery.

A queue within an MTA that temporarily holds email that cannot be delivered immediately and manages retries.

Software that delivers email received from an MTA into the recipient's mailbox.

A server that receives outgoing mail from clients, applies authentication and policy checks, and hands it to an MTA, typically over port 587.

Software that transfers and routes email between mail servers using SMTP.

Client software that lets users compose, read, and manage email, commonly known as an email client.

An email retrieval protocol that downloads messages from the server to a local client, typically removing them from the server.

A reputation-based blocklist of IP addresses known to send spam, queried via DNS to reject mail.

A filtering technique that uses reputation scores based on the historical behavior of sending IPs or domains to block or allow mail.

A designated external relay server through which a mail server routes all outbound email instead of delivering directly to destinations.

The process by which one mail server forwards email through another, which if misconfigured can be abused as an open relay.

An attack technique that exploits differing interpretations of message-end sequences between sending and receiving servers to inject spoofed email.

Encrypting an SMTP connection via the STARTTLS command to protect message content in transit.

An SMTP submission port using implicit TLS where encryption applies from the start of the connection.

The standard SMTP submission port used by authenticated clients to submit mail, distinct from port 25 used for relaying.

A protection that re-evaluates a link's safety at the moment a user clicks it, catching URLs weaponized after delivery.

A mail flow policy rule that evaluates conditions on email and automatically applies actions such as blocking, redirecting, adding headers, or encryption.

A technique that rewrites links in email to point to a security proxy so their safety is checked in real time at click time.

对安全事件与日志进行汇总、关联分析的平台(如Splunk、Sentinel等)。

对告警响应动作进行自动化编排的体系。

提示发生入侵的痕迹线索(如恶意IP、域名、文件哈希等)。

将判定为高风险的邮件从收件箱中隔离(移动或封锁)的补救措施。

在密码之外要求额外认证要素,以缓解账户被接管风险的机制。

A targeted adversary that uses sophisticated techniques to maintain stealthy, long-term access. It is often associated with nation-state actors.

The desensitization of analysts caused by an overwhelming volume of alerts, leading to missed critical threats. It is a major challenge in SOC operations.

A chronological record of activities and changes within a system. It is essential for accountability and post-incident investigation.

A defensive team responsible for protecting assets and detecting and responding to attacks. They are the core staff of SOC operations.

The mandatory process of informing regulators and affected individuals when a data breach occurs. It is required under regulations such as GDPR and data protection laws.

The documented chronological handling of digital evidence to ensure its integrity. It is essential for legal admissibility.

The communication channel and infrastructure attackers use to remotely control compromised systems. It is used for data exfiltration and issuing further commands.

A specialized organization that receives, coordinates, and responds to security incidents. They operate at national, sector, and organizational levels.

A dedicated team responsible for handling security incidents within an organization. It performs detection, analysis, recovery, and post-incident activities.

A model defined by Lockheed Martin describing the stages of a cyberattack. It breaks an attack into seven phases from reconnaissance to actions on objectives.

The unauthorized transfer of data from inside an organization to an external destination. It is often the ultimate goal of an attack.

A field combining forensic investigation with incident response. It simultaneously determines root cause and drives rapid remediation.

The discipline of collecting, preserving, and analyzing digital evidence to determine the cause and course of an incident. It emphasizes legal admissibility.

A solution that continuously monitors endpoint activity to detect, investigate, and respond to threats. It uses behavioral analysis to identify advanced attacks.

An alert that incorrectly flags benign activity as a threat. Excessive false positives cause analyst fatigue and alert dismissal.

The European Union's regulation on personal data protection and processing. It includes breach notification obligations and strong penalties.

An integrated approach to managing an organization's governance, risk management, and regulatory compliance. It aligns security decisions with business objectives.

The structured process of detecting, containing, eradicating, and recovering from security incidents. Its goal is to minimize damage and restore normal operations.

Indicators that reveal an attacker's intent and behavioral patterns. They focus on detecting an attack in progress before compromise completes.

An international standard for information security management systems (ISMS). It requires risk-based controls and continual improvement.

A technique where an attacker expands access from a compromised system to others within the network. It is used to reach target assets.

The practice of collecting, storing, analyzing, and retaining system and application logs. It underpins detection, forensics, and compliance.

The average time taken to detect a security incident after it occurs. It is a key metric for SOC detection performance.

The average time taken to respond to and remediate an incident after detection. It measures response efficiency.

A globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It serves as a common framework for detection and defense.

A solution that analyzes network traffic to detect and respond to anomalous behavior and threats. It excels at identifying lateral movement and stealthy attacks.

A cybersecurity management framework from the U.S. NIST organized around Identify, Protect, Detect, Respond, and Recover functions. It provides a common language for risk management.

A security standard that organizations handling payment card data must comply with. It governs the storage, transmission, and processing of cardholder data.

Techniques that allow an attacker to maintain access across reboots or credential changes. It is one of the key tactics in MITRE ATT&CK.

A standardized set of procedures for responding to a specific type of incident. It forms the basis for SOAR automation.

An attack technique for gaining higher privileges from a lower-privileged context. It is a key step toward system control and persistence.

An exercise that has offensive (red team) and defensive (blue team) collaborate to improve detection and response. It integrates feedback from both sides.

An offensive team that emulates real adversaries to test an organization's defenses. It exposes gaps in detection and response.

A step-by-step guide documenting operational tasks or response procedures. It ensures consistency and repeatability.

A centralized team and facility that continuously monitors, detects, and responds to security events. It combines analysts, processes, and technology to manage threats.

A generic, vendor-agnostic format for log-based detection rules. It allows a rule to be written once and converted for multiple SIEM platforms.

An AICPA audit report attesting to a service organization's adherence to trust principles such as security, availability, and confidentiality. It is widely used by SaaS firms to demonstrate trustworthiness.

A standardized language for representing structured cyber threat intelligence. It supports consistent sharing of threat information.

A standard protocol used by network devices and systems to send log messages. It is widely used for centralized log collection.

A discussion-based exercise that walks through a hypothetical incident scenario. It surfaces gaps in procedures and communication beforehand.

A concept describing adversary behavior at the levels of tactics, techniques, and procedures. It serves as the basis for threat analysis and detection.

A transport protocol for exchanging STIX-based threat intelligence. It enables automated sharing of threat information.

An individual or group responsible for causing a security incident. They are classified by motivation, capability, and resources.

A rule defining specific malicious patterns or conditions that trigger alerts. It is the basic unit of SIEM and EDR detection logic.

The proactive, hypothesis-driven search for threats that evade existing detection tools. Analysts actively look for signs of compromise.

Collected and analyzed information about threat actors and attacks. It supports defensive decision-making and proactive response.

Technology that learns baselines of normal user and entity behavior to detect anomalies. It is effective at spotting insider threats and account takeover.

A solution that unifies detection and response across endpoints, network, cloud, and email layers. It provides visibility beyond isolated security silos.

A tool and rule language for identifying and classifying malware based on patterns. It is widely used in malware hunting and forensics.

大型语言模型(LLM)以及可自主部署的小型模型(sLLM),用于意图识别与分类。

基于连续值与密集运算的标准神经网络,包括属于此类的Transformer架构LLM(当前主流检测引擎)。

以离散脉冲信号运作的第三代神经网络,具有超低功耗和流式处理优势(尚处研究阶段)。

通过检索外部知识(如威胁情报)来为模型判断提供依据支撑的技术。

由多个专职智能体协同拼接线索、共同判断意图的类分析师式自动化系统。

An input subtly perturbed to be misclassified by a model while appearing normal to humans. A core threat in ML security.

The study of attacks that deceive or subvert machine learning models, and the defenses against them.

An autonomous LLM-based system that invokes tools and reasons over multiple steps to accomplish goals.

The research field of steering AI systems' goals and behavior toward human intent and values. Central to safe LLM operation.

A technique for identifying data or behavior that deviates from normal patterns. Central to intrusion and fraud detection.

A neural network technique that weights the most relevant parts of an input sequence. A key component of the Transformer.

An attack that implants a hidden function in a model so it behaves maliciously only when a specific trigger is present.

A model that assigns inputs to one of a set of predefined categories. Used for spam/ham and malicious/benign decisions.

An evaluation table that cross-tabulates a classifier's predictions versus true labels, showing TP, FP, TN, and FN.

An attack that injects malicious samples into training data to manipulate a model's performance or behavior.

A subfield of machine learning using multi-layer neural networks to learn complex representations. Applied to image- and text-based threat detection.

A dense vector representation that captures the semantic meaning of words or documents. Forms the basis of similarity search and RAG.

Techniques and a field for making AI model predictions interpretable to humans. Important for trusting detection outcomes.

The harmonic mean of precision and recall, summarizing classification performance in a single value.

The rate at which actual negatives are incorrectly classified as positive. Directly linked to alert fatigue in detection systems.

The process of transforming and selecting raw data into features suitable for a model. Greatly impacts detection performance.

The process of further training a pre-trained model on task- or domain-specific data. Used to specialize security classifiers.

A neural architecture where a generator and discriminator compete during training. Used to create deepfakes and synthetic attack data.

An ensemble technique that sequentially combines weak learners to reduce error. Used in detection models such as XGBoost.

Safety controls that inspect and constrain LLM inputs/outputs to block harmful or policy-violating content.

The phenomenon where an LLM plausibly generates false or unsupported content. Treated as a reliability threat.

A technique that bypasses safety guardrails to make an LLM produce prohibited content. Carried out through prompt manipulation.

A branch of AI where systems learn patterns from data to make predictions or classifications without explicit programming. Widely used in security for spam and malware detection.

A privacy attack that infers whether a specific data point was part of a model's training set.

An open protocol that standardizes how LLM applications connect to external tools and data sources.

An attack that manipulates inputs at inference time to evade a detection model. Common in malware detection bypass.

An attack that replicates a target model's functionality or parameters through repeated query-response probing.

A privacy attack that reconstructs sensitive training inputs by analyzing a model's outputs.

A probabilistic classifier based on Bayes' theorem assuming feature independence. A standard for early spam filtering.

The AI field enabling computers to understand and generate human language. Applied to phishing text analysis.

A computational model of interconnected nodes inspired by biological neurons. Forms the basis of pattern recognition and anomaly detection.

When a model fits the training data too closely and fails to generalize to new data.

An OWASP list cataloging the ten most critical security risks for large language model applications.

Precision is the fraction of positive predictions that are correct; recall is the fraction of actual positives detected. Key evaluation metrics.

A machine learning algorithm that ensembles many decision trees for prediction. Frequently used for malicious traffic classification.

An adversarial evaluation that deliberately probes an AI model for vulnerabilities and harmful outputs.

Learning an action policy by optimizing for reward signals. Researched for automated defense and penetration simulation.

A reinforcement learning method that aligns models using human preference feedback as reward. Used to suppress harmful LLM outputs.

The area under the true-positive-rate vs false-positive-rate curve across thresholds, measuring classifier performance.

Learning an input-output mapping from labeled data. Used for label-based detection such as spam/ham classification.

A classification algorithm that finds a hyperplane maximizing the margin between classes. Used in classic spam filters.

The preprocessing step of splitting text into smaller units called tokens for model input.

A machine learning approach that reuses knowledge learned on one task for a related task. Useful in data-scarce security domains.

A neural network architecture based on the self-attention mechanism, the core of modern LLMs. Excels at processing sequential data.

Learning structure or patterns from unlabeled data. Used in clustering-based anomaly detection.

A database that stores embedding vectors and performs approximate nearest-neighbor search. Used in RAG and semantic search.

对数据进行加密并勒索赎金的恶意软件;RaaS(勒索软件即服务)是将其以订阅制形式对外贩卖的犯罪生态。

利用实时代理拦截登录会话令牌,从而绕过MFA的一种快速蔓延中的钓鱼手法。

反复发送MFA推送验证请求,诱使用户在疲劳之下无意间批准的攻击手法。

利用AI合成的语音或视频,常用于伪造高管的声音或面容,以强化BEC和语音钓鱼攻击的效果。

向AI模型注入隐藏指令,诱使其做出偏离预期意图行为的攻击手法(LLM时代出现的新型威胁)。

员工在未经批准的AI工具中输入敏感信息而产生的数据泄露风险。

"永不信任,始终验证"——依据身份与上下文而非网络位置来管控访问权限的安全模型。

通过入侵受信任的合作伙伴、软件或更新渠道,一次性波及大量目标的攻击手法。

终端检测与响应(EDR),以及将其能力扩展至邮件、云端、网络层面的检测响应方案(XDR)。

检测并阻止敏感信息通过邮件、上传等途径外泄的控制机制。

由内部人员(无论恶意还是疏忽)导致的信息泄露或损害;被劫持的账户也会表现出与内部人员相似的行为。

能够抵御钓鱼和中间人攻击(AiTM)的认证方式(通行密钥、FIDO2安全密钥),代表了无密码化的发展方向。

专门从事出售入侵后所获访问权限给其他攻击者(如勒索软件团伙)的犯罪专业化环节。

持续发现并管理暴露在外部的资产、域名与服务,以缩小攻击路径的一项安全活动。

A sophisticated, prolonged, and stealthy intrusion by a well-resourced adversary to achieve specific goals. Often conducted by nation-state groups.

A network of compromised devices remotely controlled by an attacker. It is used for DDoS, spam, and cryptomining.

An attack that systematically tries all possible passwords or key combinations to break authentication. Weak passwords are especially vulnerable.

A security broker that sits between users and cloud services to enforce policy and provide visibility. It helps control shadow IT.

An attack that automatically tries leaked username-password pairs against other services to hijack accounts. It exploits password reuse.

A tool that continuously assesses and remediates misconfigurations and compliance gaps in cloud environments. It reduces risk from improper configuration.

An attack that tricks an authenticated user into executing unintended requests. It performs actions using the victim's privileges.

An attack that floods a target service with traffic from many devices to disrupt it. It undermines availability.

An encryption method where only the sender and recipient can decrypt the message. Even intermediary servers cannot read the content.

A security device or software that allows or blocks network traffic based on defined rules. It protects internal networks from external threats.

A framework for identifying users and managing their access to resources. It encompasses authentication and authorization.

Security systems that detect (IDS) or actively block (IPS) malicious activity on networks or hosts. They operate on signatures or anomaly detection.

A tool that secretly records a user's keystrokes. It is used to steal passwords and sensitive information.

A technique that abuses legitimate tools already present on a system, such as PowerShell, to evade detection. It operates without dropping extra malware.

A general term for malicious software designed to harm or gain unauthorized access to systems. It includes viruses, worms, and trojans.

An attack where the adversary intercepts or alters communication between two parties. Unencrypted communications are especially vulnerable.

An authorization protocol that lets users delegate limited access to third-party apps without sharing passwords. It operates using tokens.

A security discipline that controls, monitors, and audits access by high-privilege accounts. It mitigates misuse and credential theft.

Cryptographic algorithms designed to resist attacks by quantum computers. Standardization is underway to replace classical public-key schemes.

An asymmetric cryptography scheme using a public-private key pair for encryption and digital signatures. It enables secure communication without prior key exchange.

A stealthy malicious toolset that hides deep in a system to maintain privileged access and evade detection. It conceals activity at the OS level.

An architecture that delivers networking and security functions as a unified cloud service. It combines SD-WAN with zero-trust security.

Malware that covertly monitors activity and exfiltrates collected information. It steals keystrokes, screens, and credentials.

An attack that injects malicious SQL statements into input to manipulate a database. It can lead to data exfiltration or tampering.

An authentication scheme that lets users access multiple applications with a single login. It improves usability and credential management.

A standard protocol that encrypts network communication and provides integrity and authentication. It underpins HTTPS and succeeds SSL.

Malware disguised as legitimate software to trick users into running it. It is used to install backdoors or steal data.

A technology that creates an encrypted tunnel over public networks for secure communication. It is used for remote access and privacy.

Malware that self-replicates and spreads across networks without user interaction. Its rapid propagation can cause widespread damage.

An attack that injects malicious scripts into web pages to run in other users' browsers. It is used for session hijacking and more.