Symantec Corporation

Gerry Egan

Sourabh Satish

Michael Spertus

Abubakar A Wawda

Carey S Nachenberg

Petrus Johannes Viljoen

Robert Walters

Adam Bromwich

Computer-implemented methods and systems for creating or updating approved-file and trusted-domain databases and verifying the legitimacy of files are disclosed. A method for creating or updating an approved-file database may include intercepting a first file, identifying a source domain associated with the first file, identifying a trusted-domain database, determining whether a database record for the source domain associated with the first file exists within the trusted-domain database, creating a hash value for the first file if a database record for the source domain associated with the first file exists within the trusted-domain database, and storing the hash value for the first file in an approved-file database. Methods and systems for verifying the legitimacy of a file and for creating or updating a trusted-domain database are also disclosed.

Methods and systems for creating and updating approved-file and trusted-domain databases

A computer-implemented method for directing application updates may include (1) identifying information that indicates a rate at which an earlier version of an application is exploited in attacks on computing system security, (2) identifying additional information that indicates a rate at which a later version of the application is exploited in attacks on computing system security, (3) determining how updating the application from the earlier version to the later version will impact computing system security by comparing the rate the earlier version of the application is exploited with the rate at which the later version of the application is exploited, and (4) directing a computing system with a determination about updating an installation of the earlier version of the application to the later version of the application based on determining how updating the application will impact computing system security. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for directing application updates

Method for monitoring an online identity of a user on a network is described. In one example, data exchanged between a browser client on a device associated with the user and the network is monitored. Creation or use of an online identity by the user is detected within the data. The online identity is associated with a host site. The host site may be any of a plurality of point of presence sites. A notification of the online identity is generated for presentation to a custodian of the user. The notification may then be sent to the custodian.

Method and apparatus for monitoring an online identity of a user on a network

User-generated web content is received prior to posting by a client system, such as a web content hosting system. The user-generated web content is executed in a virtual environment and monitored for malicious behavior. Execution of the web content in the virtual environment forces code in the web content to run such that the actions the code takes, especially malicious behavior, are not obfuscated. If malicious behavior is detected, the user-generated web content is blocked from posting to the web content hosting system. Alternatively, when malicious behavior is not detected, the user-generated web content is permitted to be posted to the web content hosting system.

Growing community of inventors

Santa Monica, CA, United States of America

Gerry Egan