At+t Corp.

At&t Intellectual Property I, L.p.

Lucent Technologies Inc.

Other

Daniel F Hurley

Earle H West, Iii

Willa Kay Ehrlich

Carl Brian Rexroad

Ronald Myron Wexler

William H Simpson

David Gross

Anestis Karasaridis

David Hoeflin

Danielle Liu

Vishwa M Prasad

George B Bodem

Michael Singer

Jacob John Hastreiter, Jr

Jeanette LaRosa

James Boxmeyer

Myra E Agostino

Rajendra Datar

A system for detecting a remotely controlled e-mail spam host. The system includes an E-mail spammer detection unit and a host traffic profiling unit. The E-mail spammer detection unit identifies E-mail Spammers based on SMTP traffic characteristics. The host profiling unit extracts traffic components from the plurality of Internet traffic associated with an E-mail Spammer; interprets the extracted traffic components and determines whether the E-mail Spammer is a compromised host. The system may also include a botnet controller detection unit that analyzes traffic associated with compromised E-mail Spammers and identifies the botnet Controller remotely controlling the compromised E-mail Spammer.

System and method for detecting remotely controlled E-mail spam hosts

A method and apparatus for analyzing traffic arriving at and/or departing from a traffic aggregate defined as a given IP-related protocol, a given port associated with a given protocol, an IP address or subset of IP addresses, or by other traffic aggregation, during a given time interval, to determine whether there is a significant increase or decrease in traffic aggregate's traffic volume as compared to the traffic aggregate's expected traffic volume are disclosed. In one embodiment, the present method defines a traffic share ratio threshold associated with a given protocol or a given protocol port or a given IP address or a given subset of IP addresses or other traffic aggregation using said collected volumetric traffic data. The present method also defines a current traffic share, a baseline traffic share and a traffic share ratio to be evaluated for the said traffic aggregate. In turn, the present method raises an alarm if the traffic aggregate's traffic share ratio to be evaluated exceeds or falls below the traffic share ratio threshold defined for the traffic aggregate.

Method and apparatus for volumetric thresholding and alarming on internet protocol traffic

A method and apparatus for generating a reconnaissance index for a communications network is described. In one embodiment, scan detection data is initially received. A number of scan flows and a number of unique source Internet protocol (SIP) addresses initiating said number of scan flows is then identified from said scan detection data. Afterwards, a reconnaissance index is generated by utilizing said number of scan flows and said number of unique SIP addresses.

Method and apparatus for generating a reconnaissance index

A participant ( ) in electronic commerce can validate his/her own certificate ( ) by accessing an authority ( ) that checks whether the participant's certificate is valid. If the certificate is valid, the authority embeds with the participant's terminal ( ) a block of data, in the form of a Cookie ( ) that includes a plurality of attributes indicative of the certificate, for example, the certificate's date of expiration. When accessing a secure application ( ), the participant presents both the certificate and the authenticating Cookie, obviating the need for a real-time inquiry to the authority, unless the Cookie is stale or missing.

Method and apparatus for authenticating participants in electronic commerce

A dye-donor element for thermal dye transfer comprising a support having on one side thereof a dye layer and on the other side a slipping layer comprising a binder containing polyalkylsilsesquioxane particles wherein less than about 8% of the particles have a diameter of &gt;0.8 .mu.m.

Slipping layer for dye-donor element used in thermal dye transfer

A graphic program configuration system is described that allows a user to create complete computer programs. In particular, the present invention improves on the prior art by providing a system and process that permits a subprogram to have an arbitrary number of outlets that may be defined at program configuration time by stimulating the subprogram to create new outlets that facilitate connecting the subprogram to other subprograms. In particular embodiments of the invention the names for the new outlets may either a) be obtained by virtue of the attempted connection of a subprogram to other subprograms or b) be provided direct entry of the outlet name by a user of the program configuration system, e.g., by typing the outlet names on the keyboard. Additionally, in accordance with an aspect of the invention, outlets can be augmented to have one or more constraining parameters that can be used to ensure that only appropriate relationships are established by connections. Such constraining parameters include: a) number of connections allowed, b) types of connections allowed, c) destination object class, and d) destination object operations required. Thus, a non-programmer or a person with only rudimentary programming skills can configure a collection of one or more subprograms into a complete computer program.

Method and apparatus for configuring computer programs from available

Method and apparatus for configuring computer program from available

Growing community of inventors

Marlboro, NJ, United States of America

Daniel F Hurley