Raytheon Oakley Systems, Inc.

Oakley Networks

James E Clingenpeel

Brent E Henry

Andy Vincent Lawrence

David I Marsh

Embodiments of the invention provide novel systems, methods and software for searching and/or analyzing text, based on a list of one or more keywords of interest. In a set of embodiments, a first computer generates a regular expression satisfied by a particular keyword of interest as well as a hash value corresponding to the keyword. In some embodiments, the regular expression and the hash value are transmitted to a second computer, which identifies a set of text associated with a particular event and/or evaluates the set of text against the regular expression. If the text satisfies the regular expression, the second computer might generate a text hash from the text. This text hash can be compared with the hash from the package, and if there is a match, the event might be identified as requiring monitoring, collection and/or further analysis.

Keyword obfuscation

Embodiments of the invention provide systems, software and methods for monitoring events on a computer. In a set of embodiments, a monitoring application monitors events on a monitored computer. Each of the monitored events may be analyzed, and based on the analysis, some or all of the monitored events may be collected. A variety of rules may be used in analyzing events. In some cases, collected events can be queued, for example, by storing a representation of each collected event in an event cache. When connectivity with a monitoring computer is available, a connection with the monitoring computer may be established, and/or the queued events may be transmitted to the monitoring computer. In a particular set of embodiments, the monitoring application is designed to avoid detection by a user of the monitored computer.

Event monitoring and collection

Embodiments of the invention provide methods, systems, software and data structures for monitoring, analyzing, storing and/or collecting events on a monitored computer. In a set of embodiments, a monitoring process monitors one or more applications for events occurring in those application. The monitoring process, in some cases, runs in common a thread of execution with one or more of the applications. If the monitoring process detects an event, it might notify an event capture process, which might capture the event. In some embodiments, an analysis process might determine whether the event should be collected, and if so, maintain a representation of the event (perhaps in a specialized data structure). In other embodiments, a data management process is configured to store information about one or more events in an event cache, which might comprise a plurality of file streams and/or metafile streams, enabling efficient storage of information about events.

Growing community of inventors

Salt Lake City, UT, United States of America

James E Clingenpeel