Palo Alto Networks, Inc.

Network Associates, Inc.

Dao-Chen Zheng

Wei Cao

William Redington Hewlett, Ii

Shangde Zhou

Chengi Jimmy Kuo

Jivko Koltchev

Joseph Peter

A URL categorization query is received. The URL categorization query includes at least one URL. The URL is used to determine a set of data distribution keys. A distributed key-value data store is queried using at least one data distribution key included in the determined set of data distribution keys. Categorization information is returned. The returned URL categorization information can be used to enforce policies.

Communicating URL categorization information

A URL and a categorization associated with the URL are received. The received URL comprises a hostname portion and a path portion. The hostname portion of the received URL comprises a plurality of segments separated by one or more delimiters. A key associated with the received URL is determined. An operation is performed on a database using the determined key. Examples of such operations include inserting the categorization into the database, changing a value associated with the key in the database, removing a key-value pair from the database, and querying the database.

Key-value storage for URL categorization

A URL categorization query is received. The URL categorization query includes at least one URL. The URL is used to determine a set of keys. A database is queried using the determined set of keys. Categorization information is returned. The returned URL categorization information can be used to enforce policies.

A URL and a categorization associated with the URL are received. A key associated with the received URL is determined. An operation is performed on a database using the determined key. Examples of such operations include inserting the categorization into the database, changing a value associated with the key in the database, removing a key-value pair from the database, and querying the database.

A method is provided for detecting computer viruses that infect text-based files. In accordance with a preferred embodiment, a collection of virus signatures reflecting sequences of characters or instructions known to be found in such viruses is maintained on a computer system. A virus detection program is also maintained for the purpose of comparing the contents of computer files to the virus signatures. Upon execution of the virus detection program, whitespace within text-based files is transformed such that each sequence of whitespace characters is replaced by a single whitespace character. Virus signatures of viruses known to infect text files are similarly transformed. A transformed text-based file is then searched for at least one of said virus signatures. The user is alerted to a possible virus infection if any of the virus signatures are found in a file. In another preferred embodiment, an additional collection of at least one virus signature containing sequences of characters or instructions known to be found in viruses that infect executable computer files is maintained on the computer system. A transformed text-based file is searched for at least one of the additional virus signature, which are not transformed before the search.

Growing community of inventors

Cupertino, CA, United States of America

Dao-Chen Zheng