Symantec Corporation

Darrell Kienzle

Matthew Elder

Nathan Evans

Michael Andrew Hart

Peter Ashley

Ryan Kumar Persaud

William E Sobel

Brian Hernacki

Michael Spertus

Pratyusa Kumar Manadhata

Hans Van Rietschote

William Gauvin

Adam Schepis

Anthony T Orling

Slava Kritov

Robert Walters

James Croall

Paul Swinton

A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided.

Detection of malware using time spans and periods of activity for network requests

A computer-implemented method for estimating ages of network devices may include (1) identifying at least one networked device that may be attached to a network, (2) identifying a media access control address of the networked device, the media access control address comprising an organizational unique identifier, (3) querying an organizational-unique-identifier database with the organizational unique identifier and receiving, in response, device-age information relating to an estimated age of the networked device and (4) determining the estimated age of the networked device based at least in part on the device-age information. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for estimating ages of network devices

System to identify machines infected by malware applying linguistic analysis to network requests from endpoints

Embodiments of the present invention are directed to a method and system for automated risk analysis. The method includes accessing host configuration information of a host and querying a vulnerability database based on the host configuration information. The method further includes receiving a list of vulnerabilities and accessing a plurality of vulnerability scores. The list of vulnerabilities corresponds to vulnerabilities of the host. Vulnerabilities can be removed from the list based on checking for installed fixes corresponding to vulnerability. A composite risk score can then be determined for the host and each software product of the host based on the plurality of vulnerability scores. An aggregate risk score can then be determined for the host and each software product of the host based on the plurality of vulnerability scores.

System and method for vulnerability risk analysis

A computer-implemented method for discovering network topologies. The method may include (1) receiving, on a host system within a network, a switch-protocol message that includes a switch identifier, a port identifier, and/or a root path cost, (2) identifying a set of switches within the network based on the switch-protocol message, (3) determining how the set of switches are connected based on the switch-protocol message, and (4) mapping a topology of the network based on determining how the set of switches are connected. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for discovering network topologies

A system and method for determining the model information of a device. A mapping database that maps a plurality of network device identifiers of a set of devices to model information of the devices may be automatically created. A request to determine model information of an unknown based on a network device identifier of the unknown device may then be received. The database may be analyzed to determine the model information of the unknown device. For example, the model information of the unknown device may be determined by extrapolating it based on the network device identifier of the device and the database information.

Determining model information of devices based on network device identifiers

A computer-implemented method for mapping network topologies may include (1) identifying a network including a plurality of network switches and a plurality of host systems, (2) identifying a host system within the plurality of host systems connected to the network via a network switch within the plurality of network switches, (3) refreshing an address of the host system within the network switch, (4) allowing the address of the host system to expire from each network switch within the plurality of network switches except the network switch, (5) transmitting a probing frame from a probing host system within the plurality of host systems to the address of the host system, (6) identifying a subset of host systems within the plurality of host systems that received the probing frame, and then (7) mapping a topology of the network based on the identified subset. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for mapping network topologies

Detection of network devices (e.g., stealth devices) and mapping network topology are performed via network introspection by collaborating endpoints/nodes. The method includes receiving (e.g., by a node on a network) an assignment to be a supernode that will manage multiple agents of a subnetwork within an overall network. This assigned supernode instructs two or more of the agents to perform a set of network traffic fingerprinting tests of the subnetwork by passing information across the subnetwork to each other. The supernode receives results of the tests from the clients and detects one or more intermediate devices located between the clients based on an effect of the intermediate devices on the information passed between the clients. The supernode can further map the topology of the subnetwork (including the detected devices) which can be used in mapping the overall network topology.

Detecting network devices and mapping topology using network introspection by collaborating endpoints

A method of monitoring events in a network associated with a node. An agent collects event information associated with the monitored activities, based on a set of collection rules. A determination is made whether a portion of the collected event information complies or potentially complies with one of a set of patterns. An agent selects event information from the collection based on the determination, and makes the selected event information available to a manager associated with the node and other nodes in the network. The agent manager receives event information from a plurality of agents. A triggering event is identified, as a function of the set of patterns, based on the event information. The agent manager sends at least one request to a selected set of the agents for additional event information when a triggering event is identified.

On-box active reconnaissance

Computer-implemented methods, apparati, and computer-readable media for thwarting computer attacks. A method embodiment of the present invention comprises the steps of examining () a digital certificate () presented by a server computer (); compiling () a set of suspicion indications () gleaned from said examining step (); and feeding () said suspicion indications () to a consequence engine ().

Validation of secure sockets layer communications

A system for efficient backups using dynamically shared storage pools in peer-to-peer networks comprises one or more processors and memory coupled to the processors. The memory stores instructions executable by the processors to implement a backup manager configured to dynamically subdivide a storage pool into one or more portions of storage currently designated for local backup data and one or more portions of storage currently designated for peer-to-peer (P2P) backup data. In response to local backup data received from a backup client, the backup manager may store the local backup data in a portion of the storage pool that is currently designated for local backup data. The backup manager may then generate a P2P version of the local backup data, e.g., by encrypting and/or redundancy encoding the local backup data, and transmit parts of the P2P version to each of one or more peer devices in the P2P network.

Efficient backups using dynamically shared storage pools in peer-to-peer networks

An electronic message manager () examines () incoming electronic messages and determines () whether an incoming electronic message comprises at least one suspect link associated with a remote system. In response to the determination () that the incoming message comprises at least one suspect link, the electronic message manager () replaces () each suspect link with a redirection link. In response to a user attempting () to connect to the remote system by clicking on the redirection link, the electronic message manager directs the user to a remote analysis site for deciding () whether that incoming message comprises a phishing message.

Growing community of inventors

Vienna, VA, United States of America

Darrell Kienzle