Sonicwall Inc.

Dell Software Inc.

Mymail, Ltd.

Other

Ewinwin, Inc.

John Everett Gmuender

Boris Yanovsky

Roman Yanovsky

Shunhui Zhu

Michael B Massing

Huy Minh Nguyen

Thomas E Raffill

Aleksandr Dubrovsky

Zhong Chen

Ilya Minkin

Thomas Drennan Selgas

Iosif Harutyunov

Joseph H Levy

Zhuangzhi Duo

David M Telehowski

Justin Michael Brady

Alex M Dubrovsky

Akbal Singh Karlcut

Nikolay V Popov

Alexander Shor

Manish Mathur

Scott D Eikenberry

Manish Marthur

Igor Korsunsky

MichaelCarl Y Uy

Michael Carl Y Uy

Atul Dhablania

Soumyadipta Das

Miao Mao

Truong T Nguyen

Atul Dahablania

Olivier Matthey

Scott K Eikenberry

Some embodiments of reassembly-free deep packet inspection (DPD on multicore hardware have been presented. In one embodiment, a set of packets of one or more files is received at a networked device from one or more connections. Each packet is scanned using one of a set of processing cores in the networked device without buffering the one or more files in the networked device. Furthermore, the set of processing cores may scan the packets substantially concurrently.

DFA state association in a multi-processor system

A method for packet processing on a multi-core processor. According to one embodiment of the invention, a first set of one or more processing cores are configured to include the capability to process packets belonging to a first set of one or more packet types, and a second set of one or more processing cores are configured to include the capability to process packets belonging to a second set of one or more packet types, where the second set of packet types is a subset of the first set of packet types. Packets belonging to the first set of packet types are processed at a processing core of either the first or second set of processing cores. Packets belonging to the second set of packet types are processed at a processing core of the first set of processing cores.

Packet processing on a multi-core processor

Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows one or more processors executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware can be detected using exception handling to track memory allocations of the program code included in the received data set.

Just in time memory analysis for malware detection

A method and apparatus for identifying data patterns of a file are described herein. In one embodiment, an exemplary process includes, but is not limited to, receiving a data packet of a data stream containing a file segment of a file originated from an external host and destined to a protected host of a local area network (LAN), the file being transmitted via multiple file segments contained in multiple data packets of the data stream, and performing a data pattern analysis on the received data packet to determine whether the received data packet contains a predetermined data pattern, without waiting for a remainder of the data stream to arrive. Other methods and apparatuses are also described.

Method and apparatus to perform multiple packet payloads analysis

Reassembly-free deep packet inspection on multi-core hardware

Some embodiments of an efficient string search have been presented. In one embodiment, a string of bytes representing content written in a non-delimited language is received, wherein the content has been classified into a predetermined category. In a single pass through the string of bytes, a set of N-grams is searched for simultaneously. Statistical information on occurrences of the N-grams, if any, in the string of bytes is collected. In some embodiments, a model is generated based on the statistical information, where the model is usable by a content filter to classify content.

Efficient string search

A method and apparatus for resource locator identifier rewrite have been presented. A security device receives from a resource host over a non-secure hypertext transfer protocol (HTTP) session a response to a request received from a client over a secure HTTP session. The response includes a uniform resource locator (URL) that is supposed to be for a resource host, but the URL does not designate a secure resource access protocol and the resource host requires the secure resource access protocol. The URL is located in the response and modified to designate the secure resource access protocol. After modification, the response is transmitted via the secure resource access protocol session to the client.

Method and apparatus for resource locator identifier rewrite

A local gateway device receives email across the internet from a sender of the email and forwards it across the internet to an email filtering system. The email filtering system analyzes the email to determine whether it is spam, phishing or contains a virus and sends it back to the local gateway device along with the filtered determination. The local gateway device forwards the received email and the filtered determination to a local junk store which handles the email appropriately. For example, if the email has been determined to be spam, phishing or containing a virus, the junk store can quarantine the email and if the email has been determined to be non-spun and/or not phishing and/or not containing a virus, the junk store can forward the email to a local mail server for delivery.

Net-based email filtering

Some embodiments of on-the-fly pattern recognition with configurable bounds have been presented. In one embodiment, a pattern matching engine is configured based on user input, which may include values of one or more user configurable bounds on searching. Then the configured pattern matching engine is used to search for a set of features in an incoming string. A set of scores is updated based on the presence of any of the features in the string while searching for the features. Each score may indicate a likelihood of the content of the string being in a category. The search is terminated if the end of the string is reached or if the user configurable bounds are met. After terminating the search, the scores are output.

On-the-fly pattern recognition with configurable bounds

The present invention comprises a method of and apparatus for simplifying the process of access to a network for a roaming computer user, divides the responsibility of servicing a given user wanting to access the network between multiple parties and minimizes the possibility of improper dissemination of email header data as well as improper use of network resources (including server systems) by non-clients.

Dynamically modifying a toolbar

The present invention relates to a system, method, and non-transitory storage medium executable by one or more processors at a multi-processor system that improves load monitoring and processor-core assignments as compared to conventional approaches. A method consistent with the present invention includes a first data packet being received at a multi-processor system. After the first packet is received it may be sent to a first processor where the first processor identifies a first processing task associated with the first data packet. The first data packet may then be forwarded to a second processor that is optimized for processing the first processing task of the first data packet. The second processor may then process the first processing task of the first data packet. Program code associated with the first processing task may be stored in a level one (L1) cache at the first processor.

Adaptive core grouping

Described herein is a method for accessing a digital network. For example, the method may include receiving a message from a network access device at a first Internet service provider, and sending at least a portion of the received message through a network to an access service provider. The method may also include receiving the portion of the message at the access service provider, and sending network access data, based at least partially in response to receiving the portion of the message at the access service provider, to the network access device. The network access data may include log-in information and an identified Internet service provider. A communication may be received at the identified Internet service provider that originated from the network access device based at least partially on the network access data obtained from said access service provider. A temporarily assigned network address may be assigned to the network access device.

Method for accessing a digital network by way of one or more Internet service providers

According to embodiments of the invention, a first wireless access point discovers a second wireless access point, the first wireless access point tunes its radio and privacy settings, without user input, based upon parameters automatically exchanged in response to the discovery of the second wireless access point, and a secure direct wireless connection is established between the first and second wireless access points using the radio and privacy settings. Adding the first wireless to an existing mesh network includes a determination of the best available direct wireless connection.

Wireless extender secure discovery and provisioning

Growing community of inventors

San Jose, CA, United States of America

John Everett Gmuender