Symantec Corporation

Nortonlifelock Inc.

Jim Casaburi

Alan Gilbert

Steven P Stockman

William Allen

Matthew Conover

Sanjay Sawhney

Susanta Kumar Nanda

Kent E Griffin

Haridharan Nattamai Gangadharan

Ryan McGann

As described, embodiments presented herein provide techniques for detecting malware on computing devices connected to a local network segment by observing the traffic flows of such devices and generating signatures characterizing such traffic flows. Doing so allows instances of malware to be detected on a variety of devices which can be connected to a computing network, but which lack the capability of directly detecting and preventing malware applications from infecting such devices.

Malware detection and alerting for network connected devices based on traffic flow analysis on local network

The disclosed computer-implemented method for protecting against unauthorized network intrusions may include (1) identifying a signal received by one or more antennas of a network from a transceiver of a device attempting to access the network, (2) detecting one or more signal strengths of the signal received by the antennas of the network in connection with the attempt to access the network, (3) determining, based at least in part on the signal strengths of the signal, that the attempt to access the network is potentially malicious, and then in response to determining that the attempt to access the network is potentially malicious, (4) initiating at least one security measure to address the potentially malicious attempt to access the network. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting against unauthorized network intrusions

Techniques for spare storage pool management are disclosed. In one particular embodiment, the techniques may be realized as a method for spare storage pool management comprising receiving spare storage configuration information for a storage drive pool comprising a plurality of storage drives, maintaining spare storage mapping information to spare storage within the storage drive pool based at least in part on the spare storage configuration information, monitoring spare storage within the storage drive pool for detecting block failures within the storage drive pool, detecting a failure of a block in a first storage drive of the plurality of storage drives, and updating the spare storage mapping information associated with the failed block in the first storage drive to map to a spare block in a second storage drive of the plurality of storage drives.

Techniques for spare storage pool management

A computer-implemented method for detecting malicious browser-based scripts may include (1) identifying an attempt by a web browser to access sensitive information stored on a server, (2) identifying a web browser script installed in the web browser, (3) calculating a signature hash for the web browser script, (4) querying, using the signature hash, a browser script signature database that associates web browser script signature hashes with script security indicators, (5) receiving, in response to querying the browser script signature database, a script security indicator associated with the signature hash, and (6) applying, based on the script security indicator associated with the web browser script, a script security policy associated with the web browser script. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting malicious browser-based scripts

A computer-implemented method for securing Internet access on restricted mobile platforms may include identifying an attempt by a mobile computing system to establish a virtual private network connection with a security server and, in response to identifying the attempt, (1) assigning an Internet Protocol address to the mobile computing system and (2) identifying a security filter customized to filter communications for an account associated with the mobile computing system. The method may also include (1) receiving, via the virtual private network connection, a request for an Internet resource and (2) providing, via the virtual private network connection, a response to the request to the mobile computing system based at least in part on the security filter. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for securing internet access on restricted mobile platforms

A computer-implemented method for mitigating mobile device loss may include (1) identifying historical data specifying a plurality of past locations of a mobile computing device, (2) identifying a current location of the mobile computing device, (3) determining that the current location deviates from an expected location based on the historical data, and (4) performing a security measure on the mobile computing device in response to determining that the current location deviates from the expected location. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for mitigating mobile device loss

A computer-implemented method for preventing mobile device loss may include 1) identifying historical data specifying a plurality of past locations of a plurality of mobile computing devices, 2) identifying a current location of a mobile computing device within the plurality of mobile computing devices, 3) determining that the current location deviates from an expected location based on the historical data, and 4) performing a security measure on the mobile computing device in response to determining that the current location deviates from the expected location. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing mobile device loss

A computer-implemented method for data loss prevention on mobile computing systems may include (1) identifying a mobile computing system configured to execute only one application at a time as a foreground application, (2) determining that the mobile computing system has begun executing a sensitive application as the foreground application, (3) identifying a first enumeration of screenshots stored on the mobile computing system when the mobile computing system began executing the sensitive application as the foreground application, (4) identifying a second enumeration of screenshots stored on the mobile computing system, (5) determining that at least one new screenshot was taken on the mobile computing system while the sensitive application was the foreground application by detecting a difference between the first enumeration and the second enumeration, and (6) performing a security action upon detecting the difference. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Rancho Palos Verdes, CA, United States of America

Jim Casaburi