Mcafee, Inc.

Fraser Peter Howard

Alex J Hinchliffe

Andrew Kemp

Bobby Rai

Joel Robert Spurlock

Craig D Schmugar

Alexander James Hinchliffe

Robert Edward Moore

Igor G Muttik

Mark David Harris

Lee Codel Lawson Tarbotton

Anthony Vaughan Bartram

Anthony Abrahams

Lee Codel Tarbotton

A security policy distribution system encapsulates parameters for a security policy and instructions for applying the parameters to a corresponding security program into a self-contained configuration file. When the self-contained configuration file is executed on behalf of a computer, the corresponding security program on the computer is updated with the parameters, thus distributing the security policy to the computer.

Distribution of security policies for small to medium-sized organizations

A naming system, method and computer program product are provided. In use, unwanted code including at least one attribute is identified. In addition, an encoded name is generated for the unwanted code, where at least a portion of the encoded name represents the at least one attribute of the unwanted code.

System, method and computer program product for generating an encoded name for unwanted code

A system, method and computer program product are provided for detecting unwanted data. A scan for unwanted data is performed to generate results of the scan. A context of the scan is then identified. Further, the presence of unwanted data is conditionally indicated based on both the results of the scan and the context of the scan.

System, method and computer program product for context-driven behavioral heuristics

A peer-to-peer network is monitored for suspicious activity based on patterns of activity. When a particular pattern of suspicious activity is detected, an action associated with the particular pattern is taken. The activity monitored may include network traffic among peers and data sharing on a peer in the network. The action may be to log information about the suspicious activity and/or to send an alert about the suspicious activity.

Desktop security in peer-to-peer networks

A system, method and computer program product are provided for translating between Internet Protocols (IP's). Initially, data is received over the Internet utilizing a first IP. Such data is adapted for being processed by an application program. Next, it is determined whether the application program can process data received over the Internet utilizing the first IP. If it is determined that the application program can not process data received over the Internet utilizing the first IP, the data is converted from the first IP to a second IP that the application program is capable of processing.

System and method for facilitating IPv6 protocol usage by an application program

A computer file may be scanned for suspicious wordsoccurring within suspicious contextsThus, messages embedded by malware authors within their malware may be detected. The detection of such embedded messages may be used to identify otherwise unknown items of malware or as a pre-filtering technique for controlling the use of further scanning techniques.

Identifying malware containing computer files using embedded text

A malware detecting system is described in which a client computersends a file access clearance request to an assessment computerto determine whether or not access is permitted to that file. In this way, the different client computers on a networkmay share their scan results and centralized control may be provided over access permissions to individual files or groups of files.

Centrally managed malware scanning

A source computerstores updated data that is to be distributed to a plurality of destination computers (to). The destination computers (to) are divided into groups sharing a common priority level (). Each of these groups is then associated with a push update task to be executed by the source computer. These push update tasks are then sequentially executed. If a particular group of destination computers exceeds a threshold size, then it may be further divided in accordance with a hierarchy of splitting rules. The push update tasks use multicasting to transfer the update data to the destination computers within their groups in a manner that reduces network traffic.

Updating data from a source computer to groups of destination computers

A computer file may be scanned for suspicious wordsoccurring within suspicious contexts. Thus, messages embedded by malware authors within their malware may be detected. The detection of such embedded messages may be used to identify otherwise unknown items of malware or as a pre-filtering technique for controlling the use of further scanning techniques.

Growing community of inventors

Chipping Norton, United Kingdom

Fraser Peter Howard