Mcafee, Inc.

Fortinet, Inc.

Networks Associates, Inc.

Eric David O'Brien

David Spencer Tyree

Sudhir Gandhe

Kurt D'Mello

James Robert Tryon, Jr

Tommy Olaus Johnson

Douglas Stone Kilpatrick

A system, method and computer program product are provided for scanning data received from a computer network. Included is a central processing unit for processing data. Coupled between the central processing unit and a network is a network processor. Such network processor is capable of scanning data received from the network based on an update. Such network processor is further capable of receiving the update via the network.

Security network processor system and method

A machine-actionable memory comprises one or more machine-actionable records arranged according to a data structure. Such a data structure may include links that respectively map between: a RID field, the contents of which denote an identification (ID) of a remediation (RID); at least one TID field, the contents of which denotes an ID of at least two technologies (TIDs), respectively; and at least one ACTID field, the contents of which denotes an ID of an action (ACTID). A method, of selecting a remediation that is appropriate to a technology present on a machine to be remediated, may include: providing such a machine-actionable memory; and indexing into the memory using a given RID value and a given TID value to determine values of the at-least-one ACTID corresponding to the given RID value and appropriate to the given TID value.

Determining technology-appropriate remediation for vulnerability

A machine-actionable memory comprises one or more machine-actionable records arranged according to a data structure. Such a data structure may include links that respectively map between a remediation, at least one action, and at least two vulnerabilities. A method of selecting a remediation, that is appropriate to a vulnerability which is present on a machine to be remediated, may include: providing a machine-actionable memory as mentioned above; and indexing into the memory using: a given vulnerability identifier to determine (A) at least one of a remediation mapped thereto and (B) at least one action mapped to the given vulnerability identifier; and/or a given remediation to determine at least two vulnerabilities mapped thereto.

Data structure for vulnerability-based remediation selection

A system, method, and computer program product for scanning downloaded files providing improved performance relative to conventional download scanning techniques by performing the download and scanning functions in parallel and random order, thus improving overall performance. A method of scanning a requested file for a computer malware comprising the steps of: receiving a request from a user system to transfer a file from a server. Starting to transfer said file, and at the same time, handing a partial copy of the file to computer malware scanning software, receiving requests from the computer malware scanning software for data comprising additional arbitrary portions of the requested file, transferring only the requested portion of the file and supplying the requested data to the computer malware scanning software until the malware scanning software can produce a clean/infected indication. Then completing the transfer of the entire file from the server and handing it off to the user system in parallel.

Reducing HTTP malware scanner latency using HTTP range queries for random access

A system and method for dynamically processing a network event using an action set in a distributed computing environment are described. The occurrence of a network event is sensed via a sensor thread through receipt of a message indicating a network event occurrence, the message including event data pertinent to the network event. A generate daemon via a generate thread is launched responsive to a notification from the sensor process. An event mapping is retrieved by the generate daemon. The event mapping corresponds to the network event and identifies an action set. A generated action set is generated from the event mapping by the generate daemon and the generated action set is enqueued onto an event queue within which can be queued a plurality of generated action sets which each correspond to an instance of an action set. A process daemon is launched via a process thread responsive to a notification from the generate daemon. The generated action set is retrieved from the event queue by the process daemon and the generated action set is processed by causing the execution of at least one action embedded therein.

Modular framework for dynamically processing network events using action sets in a distributed computing environment

A system and a method for dynamically sensing an asynchronous network event within a modular framework for network event processing are described. An occurrence of asynchronous network events is sensed on one or more network event sensors. Each such sensor implements a common interface via which the sensor can be connected to the modular framework. At least one port over which can be received a message from a network agent indicating the occurrence of a network event is passively monitored. The message includes event data pertinent to the network event. The message is received over the at least one port via a listener thread and staged into a holding structure within which can be placed a plurality of received messages. Each received message is iteratively removed from the holding structure via a handler thread. An action set mapping corresponding to each received message is retrieved and an action set is generated from the action set mapping via a generator process. The generated action set is enqueued onto an event queue. Each generated action set is processed by invoking a process method on the generated action set next identified for processing within the event queue. The process method is repeated for any further generated action sets in the event queue.

System and method for dynamically sensing an asynchronous network event within a modular framework for network event processing

A system and a method for configuring an action set for use in dynamically processing network events in a distributed computing environment are described. A graphical user interface associated with an action set is presented. An action set is stored into a database. At least one network event and at least one sensor are associated responsive to a user selection indicated on the graphical user interface. At least one action is embedded into the action set responsive to a user selection indicated on the graphical user interface. The association for the at least one network event and the embedding of the at least one action are stored into a mapping table.

Growing community of inventors

Leesburg, VA, United States of America

Eric David O'Brien