Mcafee, Inc.

Andrew Woodruff

Ned M Smith

Jonathan Lewis Edwards

Aditya Kapoor

Esteban Gutierrez

Ryan L Allphin

Candace M Worley

Gregory William Dalcher

Joel Robert Spurlock

John Douglas Teddy

James Douglas Bean

Jeff Hetzler

Joseph C Lowe

Particular embodiments described herein provide for an electronic device that can be configured to receive untrusted input data at an enclave in an electronic device, isolate the untrusted input data from at least a portion of the enclave, communicate at least a portion of the untrusted data to an integrity verification module using an attestation channel, and receive data integrity verification of the untrusted input data from the integrity verification module. The integrity verification module can perform data integrity attestation functions to verify the untrusted data and the data integrity attestation functions include a data attestation policy and a whitelist.

Data verification using enclave attestation

In an example, a system and method for outbreak pathology inference are described. In certain computational ecosystems, malware programs and other malicious objects may infect a machine, and then attempt to infect additional machines that are 'networked' to the first machine. In some cases, the network may be a physical or logical network, such as an enterprise network. However, 'social networking' may also connect one machine to another, because users may share files or data with one another over social networks. In that case, client devices may be equipped with a telemetry engine to gather and report data about the machine, while a system management server receives reported telemetry. The system management server may use both logical networks and social networks to infer potential outbreak paths and behaviors of malware.

Outbreak pathology inference

An antimalware support system is provided to support one or more host-based antimalware clients. A query is received from a particular host device that identifies a file detected by an antimalware tool local to the particular host device. Reputation data is determined for the file, and a response to the query is sent to the particular host device. The query response includes the reputation data determined for the file.

Server-assisted anti-malware client

A system, method and computer program product are provided for preventing malware infection. In use, mass-mailing-type malware is prevented from sending electronic messages via a network. Malware is also prevented from communicating. Still yet, unrecognized attachments are prevented from opening, and executable files are prevented from being infected via the network.

Rule set-based system and method for advanced virus protection

A system, method and computer program product are provided for scanning for spyware utilizing a virus scanner. In use, at least one computer is scanned for viruses utilizing a virus scanner. Still yet, the computer is further scanned for spyware utilizing the virus scanner. Such computer is scanned for the spyware by scanning a registry associated therewith.

Growing community of inventors

Portland, OR, United States of America

Andrew Woodruff