3com Corporation

Cyphort Inc.

James S Binder

Glenn William Connery

Ali Golshan

RamKrishna Vepa

W Paul Sherer

James Ruane

Gary Michael Jaszewski

Roman Baker

Thomas Albert Maufer

Sameer Nanda

Robert Pickering

Systems and methods for virtualized malware enabled detection are described. In some embodiments, a method comprises intercepting an object provided from a first digital device, determining one or more resources the object requires, instantiating a virtual environment with the one or more resources, processing the object within the virtual environment, tainting operations of the object within the virtual environment, monitoring the operations of the object, identifying an additional resource of the object while processing that is not provided in the virtual environment, re-instantiating the virtual environment with the additional resource, monitoring the operations of the object while processing within the re-instantiated virtual environment, identifying untrusted actions from the monitored operations, and generating a report identifying the operations and the untrusted actions of the object.

Systems and methods for virtualized malware detection

Systems and methods for virtualization and emulation assisted malware detection are described. In some embodiments, a method comprises intercepting an object; instantiating and processing the object in a virtualization environment; tracing operations of the object while processing within the virtualization environment; detecting suspicious behavior associated with the object; instantiating an emulation environment in response to the detected suspicious behavior; processing, recording responses to, and tracing operations of the object within the emulation environment; detecting a divergence between the traced operations of the object within the virtualization environment to the traced operations of the object within the emulation environment; re-instantiating the virtualization environment; providing the recorded response from the emulation environment to the object in the virtualization environment; monitoring the operations of the object within the re-instantiation of the virtualization environment; identifying untrusted actions from the monitored operations; and generating a report regarding the identified untrusted actions of the object.

Systems and methods for virtualization and emulation assisted malware detection

A method for detecting reachability of client computers communicatively coupled in a computer network to a server computer. A plurality of identifier tags are resident in the memory of the server. The server generates a data packet comprising an I.C.M.P. echo packet and selects a first identifier tag from among the plurality of identifier tags resident in memory, the first identifier tag being chosen to correspond to a first client computer. The server inserts the first identifier tag into the proper data segment of the echo packet and forwards the packet to the first client. After a predetermined time awaiting a responsive ping from the client, the server determines if the client is tag-compliant or non tag-compliant.

Tag echo discovery protocol to detect reachability of clients

A method to send and receive data packets over a network of computer systems (e.g., a plurality of virtual local area networks &lsqb;VLANs&rsqb; compliant with the IEEE 802.1Q standard) using a server computer system adapted to have a plurality of network interface cards (NICs) coupled thereto. An outgoing data packet is addressed using a first media access control (MAC) address, wherein the first MAC address is a virtual MAC address representing the plurality of NICs. A NIC is selected from the plurality of NICs using a load balancing scheme. The functionality of the selected NIC is verified using a fault tolerance scheme. The first MAC address in the outgoing data packet is replaced with a second MAC address, wherein the second MAC address represents the selected NIC. The outgoing data packet is then transmitted using the selected NIC. For an incoming data packet received at one of the plurality of NICs, the existing MAC address in the incoming data packet is replaced with the first MAC address. Thus, the present embodiment of the present invention provides a high performance method that supports multiple VLANs and elegantly combines a load balance scheme and a fault tolerance scheme into a software element implemented on a server computer system.

Combining virtual local area networks and load balancing with fault tolerance in a high performance protocol

A method by which a pair of communicating network equipment drivers can determine if the equipment they control such as a network adapter or a switch port are directly connected by a single network cable, is applicable to network protocols which include a link active signaling technique as part of the physical layer specification. The method includes determining whether the link is in a first state in which there is only one device coupled to the link without intervening devices which are members of a particular class, or in a second state in which there may be more than one device coupled to the link without intervening devices which are members of the particular class. If the link is in the first state, then a physical layer test involving the physical layer link active signaling mechanism is executed to ensure that the responding device is coupled to the same link without intervening devices that are not members of the particular class.

Method for determining whether two pieces of network equipment are directly connected

A method is provided for sending data from a data source executing a network protocol such as the TCP/IP protocol stack, which includes a process for generating headers for packets according to the network protocol. The method includes sending such data on a network through a smart network interface. The network protocol defines a datagram in the data source, including generating a header template and supplying a data payload. The datagram is supplied to the network interface. At the network interface, a plurality of packets of data are generated from the datagram. The plurality of packets include respective headers, such as TCP/IP headers, based on the header template, and include respective segments of the data payload. The network interface supports packets having a pre-specified length, and the data payload is greater than the pre-specified length, such as two to forty times larger or more. Thus, the higher layer processing specifies a very large datagram, which is automatically segmented at the network interface layer, instead of at the TCP layer.

Growing community of inventors

San Jose, CA, United States of America

James S Binder