Bitsight Technologies, Inc.

Cisco Technology, Inc.

Massachusetts Institute of Technology

Digital Equipment Corporation

Raptor Systems, Inc.

At&t Bell Laboratories

Cabletron Systems, Inc.

Alan Joseph Kirby

Stephen Wayne Boyer

Nagarjuna Venna

David Feinzeig

John Matthew Truelove

Philip John Steuart Gladstone

Radia Joy Perlman

Charles W Kaufman

Jeffrey Albin Kraemer

Philip J S Gladstone

Floyd J Backes

Jeffrey A Kraemer

Ashok P Nadkarni

Adel A Saleh

Mikhail Cherepov

Robert G Gallager

Venkat Raghavan Rangamani

Brian F Costello

Philip J Gladstone

Vincent W Chan

David C Waterman

Dan L Grecu

Among other things, traces are received of activities of an online user who is associated with an entity. By analysis of the traces a security state of the entity is inferred. Also, a map is generated between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets At least part of the generating of the map is done automatically. A user can he engaged to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

Methods for using organizational behavior for risk ratings

Among other things, traces are received of activities of an online user who is associated with an entity. By analysis of the traces a security state of the entity is inferred. Also, a map is generated between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets. At least part of the generating of the map is done automatically. A user can be engaged to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

Human-assisted entity mapping

Security risk management

A computer-implemented system, method and apparatus for operating a reference monitor simulator is operable to recreate the operations performed by a reference monitor on a computer system. In one configuration, the system defines at least one security rule specifying whether to allow or deny a request to access at least one resource under a given set of circumstances and supplies at least one request to access a resource. The system further applies the at least one security rule in response to the at least one request to access a resource to determine whether to allow or prevent the at least one request.

Methods and apparatus providing a reference monitor simulator

Conventional matching approaches to virus detection are ineffective pending deployment of a signature to match a newly discovered virus. In contrast, a behavioral based (subject) approach addresses the so-called 'day zero' problem of object matching approaches. An integrated approach combines the behavioral remedy against unknown transmissions with the signature matching of known harmful transmission to provide the reliability and stability of signature based approaches with the real time responsiveness of the behavioral approach. A behavior monitoring module analyzes actions via behavioral heuristics indicative of actions performed by known harmful transmissions. The behavioral monitoring correlates the actions performed to determine an undesirable object. A signature generator computes a realtime signature on the suspect object. The signature generator accumulates successive realtime signatures in this manner for comparison with subsequent incoming transmissions, thus combining the subject based behavioral aspects of virus detection with the deterministic aspects of the object approach.

System and methods for integration of behavioral and signature based security

An automated method and apparatus for creating a security policy for one or more applications is provided. The method includes exercising the features of the one or more applications to generate behavioral data, applying a heuristic to aggregate the behavioral data into a subset of representative actions, and organizing the representative actions according to a structure defined by a template into a security policy for the one or more applications. The security policy may be downloaded to one or more workstations for deployment, and provides a safeguard to protect a computer system against cyber-terrorism.

Methods and apparatus for automated creation of security policy

A high speed optical communication and data transfer network comprises fiber optic links interconnecting a plurality of hybrid electronic-optical switch devices, each hybrid switch circuit including an electronic switch, electronic switch controller and optical switch. The hybrid switch circuits and nodes on the periphery of the core network communicate amongst each other over a first dedicated wavelength. Optical signals on the first dedicated wavelength are converted to electronic signals which are monitored by the electronic controller in each hybrid switch circuit. Routing in the network is optimized by transmitting lower volume data traffic on the first dedicated wavelength which is typically slower due to optical/electronic signal conversions and which uses more resources. Higher capacity data transfers are achieved by transmitting data on an assigned carrier wavelength over an established flow path among the optical switches of multiple hybrid switch circuits. Based on high and low volume data traffic, the method and apparatus discussed herein advantageously supports direct and indirect optical data transmissions with as few overall intermediate optical-to-electrical or electrical-to-optical conversions as possible.

Hybrid electronic/optical switch system

The invention features receiving encrypted network packets sent over a network at a network interface computer, and passing the encrypted network packets to a computer on an internal network. The invention also features receiving encrypted network packets at a first computer over a network from a second computer, examining a field in each network packet to determine which of a plurality of encryption algorithms was used to encrypt the network packet, and decrypting the network packet in accordance with the determined encryption algorithm. The invention further features receiving network packets sent over a network, determining which virtual tunnel each network packet was sent over, and routing each network packet to a destination computer in accordance with the determined virtual tunnel. The invention features encrypting network packets at a computer connected to an internal network, passing the encrypted network packet over the internal network to a public network interface computer, and passing the encrypted network packet over a public network connected to the network interface computer.

Transferring encrypted packets over a public network

Passage of packets or messages is controlled between a device and a network via a virtual connection or flow which conforms to a predefined communication protocol. In connection with processing a packet or message that triggers a step in managing the virtual connection or flow, predefined authorization rules are applied to determine whether to permit the step to occur. In connection with processing a packet or message that does not trigger a step in managing the virtual connection or flow, the packet or message is permitted to pass directly via the virtual connection or flow, without applying the predefined authorization rules.

Controlling passage of packets or messages via a virtual connection or

Back door packet communication between a workstation on a network and a device outside the network is identified by detecting packets that are associated with communication involving devices outside the network, and identifying packets, among those detected packets, that are being sent or received by a device that is not authorized for communication with devices outside the network.

Detecting unauthorized network communication

An apparatus for forwarding a data packet from a first link to a second link is disclosed. The apparatus is coupled with a plurality of computer networks through ports on the apparatus. The apparatus maintains a spanning tree list indicating which of the apparatus ports are active. The apparatus receives a packet, and determines if the packet was received from a port that is active. If the packet was received from a port that is not active, the packet is discarded. If the packet is not discarded, the data link source address of the packet is stored in a database within the apparatus for the computer network coupled with the port from which the packet was received. The apparatus then decides, responsive to a contents of a data link destination address field in the packet, whether to forward the packet as a bridge or to forward the packet as a router. If the apparatus forwards the packet as a router, the apparatus sends a redirect message to update the data link layer destination address used by the originating station to contain the data link layer address of the destination station where the destination station is on a link remote from the link of the originating station. For the subsequent packets the apparatus then behaves as a bridge by forwarding the subsequent packets based upon parsing of only the Data Link Header. For forwarding of subsequent packets, the apparatus is advantageously fast, in accordance with bridge operation.

Router using multiple hop redirect messages to enable bridge like data

Growing community of inventors

Hollis, NH, United States of America

Alan Joseph Kirby