Hewlett-packard Development Company, L.p.

Other

Andrew Patrick Norman

Jonathan Griffin

Matthew Murray Williamson

Matthew Williamson

John Melvin Brawn

Liqun Chen

Chris I Dalton

Aled Justin Edwards

Christopher L Dalton

Richard Smith

John P Scrimsher

Michael Child

A method of restricting transmission of data packets from a host entity in a network, including: transmitting outgoing packets to destination hosts whose identities are contained in a record stored in a working set of host identity records; over the course of repeated predetermined time intervals, restricting, to a predetermined number, destination hosts not identified in the working to which packets may be transmitted; upon transmission of a packet to a host whose identity is not contained in a record in the working set, adding a record containing the host's identity to the working set and attributing a time to live to the record; deleting each record from the working set whose time to live has expired.

Propagation of malicious code through an information technology network

One embodiment of an apparatus for monitoring from a first location in a computer network traffic emanating from a source at a second location in the network, the apparatus comprising means at the first location for detecting traffic emanating from the source and means for monitoring the number, per unit time, of distinct destinations of the traffic that lie outside a first set specifying familiar destinations of the traffic. This monitoring process can trigger various responses such as the isolation of the source from the network. Other systems and methods are also provided.

Methods of, and apparatus for, monitoring traffic emanating from a source in a network

A method of operating a computing entity in a network having a log mapping computing entity network addresses to vulnerabilities, the method comprising the steps of: using the entity's network address, searching the log to establish what vulnerabilities the entity has; and if the log indicates the entity has a vulnerability, sending data identifying a user of the entity to an administrator of the network.

Network management

A method of identifying a software vulnerability on a computer system is disclosed in which the computer system has software stored thereon and is connected to a management system over a computer network. The method comprises the steps of: applying an interrogation program to the software, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; in the event that the software vulnerability is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived the identification of the computer system; and sending the management information to the management system.

Method of identifying software vulnerabilities on a computer system

Requests to send data from a first host within a network of hosts are monitored against a record of destination hosts who have been sent data in accordance with a predetermined policy. Destination host identities not the record are stored in a buffer. The buffer size is monitored to establish whether requests from the first host are pursuant to viral activity therein.

Propagation of viruses through an information technology network

A computing platformprovides multiple computing environmentseach containing a guest operating systemprovided by a virtual machine applicationOptionally, each computing environmentis formed in a compartmentof a compartmented host operating system. A trusted deviceverifies that the host operating systemand each guest operating systemoperates in a secure and trusted manner by forming integrity metrics which can be interrogated by a user. Each computing environment is isolated and secure, and can be verified as trustworthy independent of any other computing environment.

Multiple trusted computing environments

A method of operating a first host within a network of a plurality of hosts. Over the course of a first time interval, requests received at the first host from a second host to send data to destination hosts are monitored. Identities of destination hosts monitored during the first time interval are compared with destination host identities in a record. Then, either data relating to requests which identify a destination host not in the record are stored in a storage buffer. Or the passage of data from the second host to the destination host within the network is limited over the course of the first time interval, so that during the first time interval the second host is unable to send data to more than a predetermined number of hosts not in the record.

A method and apparatus for controlling communications in a data network comprises detecting a request to initiate communication between a data processor and the network and determining if the communication request is abnormal and if so, controlling the data processor to degrade the resulting communication.

Network connection control

Propagation of viruses in a network having a plurality of hosts is restricted. Network activity of a first host of the plurality is monitored, and a first record established which is at least indicative of identities of hosts within the network contacted by a first host. Contact of the first host to other hosts within the network is limited over the course of a first time interval, so that during the first time interval the first host is unable to contact more than a predetermined number of hosts not in the first record. The method further includes an additional selection process for determining hosts of the plurality the first host is allowed to contact.

A method of identifying a software vulnerability in computer systems in a computer network includes a multiple level scanning process controlled from a management system connected to the network. The management system runs a root scanner which applies an interrogation program to remote systems having network addresses in a predefined address range. When a software vulnerability is detected, the interrogation program causes the respective remote system to scan topologically local systems, the remote system itself applying a second interrogation program to the local systems to detect and mitigate the vulnerability using an associated mitigation payload. Whilst that local scanning process is in progress, the root scanner can be applied to remote systems in other predefined address ranges.

Signal level propagation mechanism for distribution of a payload to vulnerable systems

A method of hindering the propagation of a computer virus on a computer network is disclosed. The computer network comprises a plurality of addressable connections capable of receiving data from at least one computer system, and a detection computer arranged to detect the presence of a computer virus. The method comprises: operating the detection computer to monitor the plurality of addressable connections thereby to detect the presence of a computer virus on at least one of the addressable connections; in the event that a computer virus is detected, identifying the at least one computer system that sent the computer virus to the at least one addressable connection; and sending virus remediating means to the at least one identified computer system, the virus remediating means being arranged at least to hinder the operation of the computer virus. A computer program and computer system for hindering the propagation of a computer virus is also disclosed.

Growing community of inventors

Bristol, United Kingdom

Andrew Patrick Norman