Microsoft Technology Licensing, LLC

Jeffrey S Williams

Efim Hudis

Arthur Zavalkovsky

Khaja Ehteshamuddin Ahmed

Lior Arzi

Edward Wilkins Hardy

Igal Figlin

Robert Eric Fitzgerald

Adrian Mihail Marinescu

Cormac E Herley

Scott David Hoogerwerf

Tony Lee

Jennifer Lemond

Ronald A Franczyk

John E Araya

Jennifer R LeMond

Brian W Keogh

Aaron Michael Hulett

Stanislav Nurilov

A network security system employing multiple levels of processing to identify security threats. Multiple host machines may each contain an agent that detects possibilities of security threats based on raw data sensed locally at that host. The hosts may share information obtained from local analysis and each host may use information generated at one or more other hosts, in combination with information generated locally, to identify a security concern, indicating with greater certainty that a security threat exists. Based on security concerns generated by multiple hosts, a security threat may be to indicated and protective action may be taken.

Network intrusion detection with distributed correlation

A system and method that facilitates and effectuates detection of malware secreted and/or hidden in plain sight on a machine. The system and method in order to achieve its aims generates a list of all loaded modules, identifies from the list a set of modules common to more than a threshold number of processes, and eliminates from the list those modules included in an authentication list. The resultant list is prioritized based, in one instance, on the number of occurrences a particular module makes in the resultant list, and thereafter the list is distributed analyst workstations.

Spyware detection mechanism

Methods for identifying potentially harmful, malicious, or unwanted content based upon associations with known offenders are provided. Executable content associated with a domain is identified. The executable content URL and the domain are compared to URLs/domains known to be associated with malicious content. If the URL and/or the domain has been identified as associated with offending code, the remaining domain contents and any available associated information are examined to identify any referencing domains, referenced domains, linking domains, affiliated entities, etc. Each identified domain, affiliate, etc. is subsequently examined in a similar manner to identify any domain, entity, etc. having an association with malicious content. Each identified domain, entity, etc. is assigned a suspicion level based upon proximity to the source of the offending code. If desired, relationships among the domains, entities, and the like may be relationally mapped to render associations easier to identify.

Identifying potentially offending content using associations

A network security system employing multiple levels of processing to identify security threats. Multiple host machines may each contain an agent that detects possibilities of security threats based on raw data sensed locally at that host. The hosts may share information obtained from local analysis and each host may use information generated at one or more other hosts, in combination with information generated locally, to identify a security concern, indicating with greater certainty that a security threat exists. Based on security concerns generated by multiple hosts, a security threat may be indicated and protective action may be taken.

A method is disclosed that includes detecting a network entity and determining a type of the detected network entity. The method includes retrieving firewall configuration information based on at least the type of the network entity. Based on the firewall configuration information, a configuration of a firewall at a host is automatically and dynamically modified.

Dynamic firewall configuration

Growing community of inventors

Seattle, WA, United States of America

Jeffrey S Williams