Networks Associates Technology, Inc.

Trend Micro Inc.

Andrew Kyle Purtell

Stephen Schwab

Roger Knobbe

Andrew S Lee

Handong Wu

Yi-Fen Chen

Raimund Alexander Genes

Alendry Ivan Macalintal

Chenghuai Lu

Feike Hayo Hacquebord

A web threat protection system may receive candidate uniform resource locators (URLs) from several URL sources. The candidate URLs may be received in a submission database. At least a portion of the candidate URLs is selected for further investigation by sending crawlers to retrieve objects from the selected URLs. The retrieved objects may be analyzed to determine whether they are malicious or good (i.e., not malicious). The result of the analysis may be used to build a security states database that includes security information of the selected URLs. Good URLs may be included in a safe URL sphere, which may be used to navigate to good websites on the Internet.

Discovering malicious locations in a public computer network

Two or more computers acting as firewalls share network state data to enhance throughput performance. A firewall creates a separate common TCP control block (CCB) for each group of TCP connections through the firewall having common endpoints. The CCB is a shared data structure comprising a single microstate shared across the group of TCP connections. Each such individual TCP connection has a TCP control block, which instead of a microstate, contains a pointer to the appropriate CCB. Preferably, each firewall receives CCBs from its peers and stores them. Each firewall preferably adjusts data traffic passing through it based on the CCBs stored within it. By adjusting traffic to reduce or eliminate congestion, throughput is enhanced.

System for sharing network state to enhance network throughput

A device that passively monitors arriving and departing data packets on one or more networks, correlates arriving data packets with departing data packets, and calculates a latency estimate based on the confidence of the correlation. The device detects and copies data packets arriving at a network device and the data packets departing from the same network device. A timestamp is stored for each arriving or departing data packet. Latency across a network device can be determined based on the timestamps for correlating data packets. Additionally, latency across a network device per protocol layer can also be calculated. Varying levels of confidence of a latency estimation depend on the operation necessarily performed on the data packet by the network device and the protocol level at which correlation between the arriving and departing data packets can be achieved.

Method and apparatus for passively calculating latency for a network appliance

Growing community of inventors

Northridge, CA, United States of America

Andrew Kyle Purtell