Fireeye, Inc.

Telecommunication Systems, Inc.

Aether Systems Inc.

Zhigu Holdings Limited

Roussillon LLC

Mandiant Corporation

Joseph Nardone

Larry D Mason

Sean Cunningham

Kevin J Arunski

Joseph Faber

Robert Dana

Kevin Arunski

A computerized method to identify potentially malicious code in a network is described. Herein, information associated with a threat is analyzed to yield intelligence that includes instructions or indicators related to the threat. Based on the intelligence, a determination is made as to an endpoint device, which includes an endpoint agent, is to (i) receive at least one of the instructions or the indicators, (ii) conduct an examination of memory of the endpoint device for data corresponding to any of the instructions or the indicators, and (iii) obtain results of the examination. Verification information, including at least a portion of the results of the examination by the endpoint device and an identifier for the endpoint device, is gathered and correlated to determine whether such information corresponds to a verified threat. Thereafter, a notification, including a portion of the verification information, is sent to identify the verified threat.

System and method for verifying a cyberthreat

A system and method to detect and contain threatening executable code by employing a threat monitor, verifier, endpoint agent, and a security information and event management module. The system and method determine whether a threat has persisted or executed, and allow that information to be communicated back to the detection mechanism (or other system) such that a user (or machine) may make a decision to take further action such as to contain the threat quickly and/or permit the system to do so automatically. The system further generates a report by a threat monitor, the report includes information on the one or more threats resulting from the analyzing of the portion of the network data; analyzing the information within the report by a verifier to yield intelligence that includes at least one of instructions or indicators related to the identified one or more threats and determining, gathering and correlating verification information from the endpoint agent to determine whether the verification information corresponds to a verified threat, the verification information includes at least a portion of the results of the examination and an identifier for the endpoint device; and sending a notification including a portion of the verification information to identify the verified threat.

System and method employing structured intelligence to verify and contain threats at endpoints

A system and method to detect and contain threatening executable code by employing a threat monitor, verifier, endpoint agent, and a security information and event management module. The system and method are a departure from and an improvement over conventional systems in that, among other things, the system and method allow an investigator to determine whether a threat has persisted or executed, and allow that information to be communicated back to the detection mechanism (or other system) such that a user (or machine) may make a decision to take further action such as to contain the threat quickly and/or permit the system to do so automatically.

A first database implemented on a remote device such as a handheld computer may be reconciled with a corresponding second database implemented on a host computer during execution of an application program on the handheld device. In addition, the application program may be executed according to program instructions stored in an application program file located in the remote device. The databases may be reconciled by first commencing execution of the application program. Then, during the course of program execution, a synchronization instruction located in said application program file is retrieved. The synchronization instruction is executed by establishing a communications link between the handheld computer and the host computer. Subsequently, any difference between the first database and the second database are reconciled. Furthermore embodiments of the invention contemplate that in addition to reconciling all of the databases located on the handheld and host computers, less than all of the databases may be reconciled to reduce the amount of time required to execute the reconciliation process. In addition, after reconciliation control may be returned to the calling application program, or to another application, as determined by the application designer.

Run-time engine implemented on a computing device allowing synchronization of records during application execution

A first database implemented on a remote device such as a handheld computer may be reconciled with a corresponding second database implemented on a host computer during execution of an application program on the handheld device. In addition, the application program may be executed according to program instructions stored in an application program file located in the remote device. The databases may be reconciled by first commencing execution of the application program. Then, during the course of program execution, a synchronization instruction located in said application program file is retrieved. The synchronization instruction is executed by establishing a communications link between the handheld computer and the host computer. Subsequently, any differences between the first database and the second database are reconciled. Furthermore, embodiments of the invention contemplate that in addition to reconciling all of the databases located on the handheld and host computers, less than all of the databases may be reconciled to reduce the amount of time required to execute the reconciliation process. In addition, after reconciliation control may be returned to the calling application program, or to another application, as determined by the application designer.

A multikeyed table utilizing a number of primary and secondary keys is implementable on a personal digital assistant. The table includes one or more records with each record having a plurality of fields. A number of fields in the records are designated as primary and secondary keys, which in turn are used for sorting and ordering the records. A target position in the multikeyed table may be identified by first receiving target primary and secondary keys from, for example, an application user. Subsequently, an operating system implemented in the personal digital assistant is prompted to select and return one record stored in the table. In response, the record selected by the operating system is received. The record received from the operating system is then compared with the target's primary and secondary keys, after which the target is indicated as having keys greater than, less than, or equal to the keys of the received record. This procedure is repeated until a record with primary and secondary keys equal to the target's primary and secondary keys is located, at which point the returned record is identified as the target position. Alternatively, the procedure is repeated until all records stored in the table have been identified as having primary and secondary keys greater than or less than the target's primary and secondary keys, at which point the target position is identified as falling between a highest record having primary and secondary keys less than the target primary and secondary keys and a lowest record having primary and secondary keys greater than the target primary and secondary keys.

Growing community of inventors

Arlington, VA, United States of America

Joseph Nardone