Microsoft Technology Licensing, LLC

Edward William Schaefer

Robert Peter Bisso

Michael Todd Kramer

Vladimir Holostov

Jack W Stokes

Roy Varshavsky

Anthony Blumfield

Kira Radinsky

Brett A Tanzer

Christopher De Luca

Selecting one or more applications from the plurality of similar or near redundant applications to activate. A method includes retrieving information about current characteristics of one or more applications. The method further includes retrieving information about a current computing operational landscape. Based on the information about current characteristics of one or more applications and the information about a current computing operational landscape, the method further includes creating a ranking of applications. The rankings are made available to a system with a plurality of applications with similar or near redundant functionality. At the system, one or more of the applications in the plurality of applications are selected to activate based on the ranking of applications.

Application selection using current detection intelligence

Architecture that selects a classification engine based on the expertise of the engine to process a given entity (e.g., a file). Selection of an engine is based on a probability that the engine will detect an unknown entity classification using properties of the entity. One or more of the highest ranked engines are activated in order to achieve the desired performance. A statistical, performance-light module is employed to skip or select several performance-demanding processes. Methods and algorithms are utilized for learning based on matching the best classification engine(s) to detect the entity class based on the entity properties. A user selection option is provided for specifying a maximum number of ranked, classification engines to consider for each state of the machine. A user can also select the minimum probability of detection for a specific entity (e.g., unknown file). The best classifications are re-evaluated over time as the classification engines are updated.

Realtime multiple engine selection and combining

A method and system for detecting and managing potential malware utilizes a preliminary signature to scan content and detect potential malware content based upon characteristics that match the preliminary signature. The detected content is detained for a predetermined period of time. If an updated signature is not received, the detained content may be purged, released or quarantined, based upon predetermined content policy. If an updated signature is received, the detained content is released from detention and rescanned with the updated signature. The content is then treated in accordance with the content policy, and again, can be purged, released, or quarantined.

Malware detention for suspected malware

Techniques for optimizing distributed anti-virus (AV) scanning are described. In one implementation, a message is received into a multi-node network that includes a plurality of distributed scanning tools. An acceptable scanning policy threshold is determined that is representative of a plurality of individual scanning policy configurations of the plurality of scanning tools. A determination is made whether the message has previously been scanned to the acceptable scanning policy threshold based on a single valued element. If the message has been previously scanned, the message is allowed to be communicated. Otherwise, the message is scanned at the acceptable scanning policy threshold. If the scanning is successful, then the message is marked as having been scanned, and is allowed to be communicated. If the scanning is unsuccessful, the message is prevented from being communicated.

Growing community of inventors

Lake Ronkonkoma, NY, United States of America

Edward William Schaefer