Microsoft Technology Licensing, LLC

Fast Simon, Inc.

Alexandra Faynburd

Efim Hudis

John Eugene Neystadt

Yair Helman

Adar Greenshpon

One embodiment included a non-transitory machine-readable medium containing instructions that when executed carry out a method of searching for a search term. The method uses, instead of an index database of search terms, an index database section of only search terms that have the prefix of the search term, such that execution can occur on an improved processing system that is relatively small. The index database section is arranged as a prefix database of terms that start with the prefix, e.g., a trie, a radix trie, or a ternary search tree of the terms. The method may be implemented as a serverless function triggered by a user entering a search term or part thereof.

Serverless search using an index database section

An automated collection of forensic evidence associated with a security incident is provided by an arrangement in which different security products called endpoints in an enterprise network are enabled for sharing security-related information over a common communication channel using an abstraction called a security assessment. A security assessment is generally configured to indicate an endpoint's understanding of a detected security incident that pertains to an object in the environment which may include users, computers, IP addresses, and website URIs (Universal Resource Identifiers). The security assessment is published by the endpoint into the channel and received by subscribing endpoints. The security assessment triggers the receiving endpoints to go into a more comprehensive or detailed mode of evidence collection. In addition, any forensic evidence having relevance to the security incident that may have already been collected prior to the detection will be marked for retention so that it is not otherwise deleted.

Automated collection of forensic evidence associated with a network security incident

Compromised host computers in an enterprise network environment comprising a plurality of security products called endpoints are detected in an automated manner by an arrangement in which a reputation service provides updates to identify resources including website URIs (Universal Resource Identifiers) and IP addresses (collectively 'resources') whose reputations have changed and represent potential threats or adversaries to the enterprise network. Responsively to the updates, a malware analyzer, which can be configured as a standalone endpoint, or incorporated into an endpoint having anti-virus/malware detection capability, or incorporated into the reputation service, will analyze logs maintained by another endpoint (typically a firewall, router, proxy server, or gateway) to identify, in a retroactive manner over some predetermined time window, those client computers in the environment that had any past communications with a resource that is newly categorized by the reputation service as malicious. Every client computer so identified is likely to be compromised.

Growing community of inventors

Haifa, Israel

Alexandra Faynburd