Emc IP Holding Company LLC

Fireeye, Inc.

Kevin J Arunski

Sashka T Davis

Sean Cunningham

Zulfikar A Ramzan

Joseph Nardone

Scott Moore

Robert Dana

Joseph Faber

Abram Q Thielke

Ed G Quackenbush

Kevin T Douglas

Matthew D Tharp

A method includes obtaining an array of sorted identifiers to be stored in a designated portion of a memory of a given computing system, determining a segment size for splitting elements of the array into a plurality of segments, splitting the array into the plurality of segments based at least in part on the determined segment size, and compressing the plurality of segments to create a plurality of compressed segments. The method also includes generating a balanced binary search tree comprising a plurality of nodes each identifying a range of elements of the array corresponding to a given one of the segments and comprising a pointer to a given compressed segment corresponding to the given segment. The method further includes maintaining the balanced binary search tree and the compressed segments in the designated portion of the memory, and processing queries to the array utilizing the balanced binary search tree.

Generating compressed representations of sorted arrays of identifiers

A method includes extracting variable length strings from text data, associating the extracted strings with indexes in an indexing structure that maintain identifiers for instances of the strings in the text data, selecting a set of the strings having corresponding indexes whose size exceeds a threshold size value, and determining whether to merge a first index corresponding to a first string with a second index corresponding to a second string, the second string being a sub string of the first string, wherein the determination is based at least in part on a comparison of a first size of the first index and a second size of the second index. The method further includes merging the first index with the second index to create a merged index in the indexing structure responsive to the determination, and processing queries to the text data utilizing the indexing structure with the merged index.

Reducing storage required for an indexing structure through index merging

A method includes monitoring user behavior in an enterprise system, identifying a given user of the enterprise system associated with a given portion of the monitored user behavior, determining a predicted impact of compromise of the given user on the enterprise system, generating a risk score for the given user based on the predicted impact of compromise and the given portion of the monitored user behavior, and identifying one or more remedial actions to reduce the risk score for the given user. The method also includes implementing, prior to detecting compromise of the given user, at least one of the remedial actions to modify a configuration of at least one asset in the enterprise system, the at least one asset comprising at least one of a physical computing resource and a virtual computing resource in the enterprise system.

Risk score generation utilizing monitored behavior and predicted impact of compromise

A method includes obtaining data from a plurality of data sources associated with an n-gram indexing data structure and storing at least a portion of the obtained data in a first storage, the stored data comprising one or more n-gram strings. The method also includes estimating frequencies of occurrence of respective ones of the n-gram strings in the stored data, the estimated frequency of occurrence of a given n-gram string being based at least in part on a size of a given n-gram index in the n-gram indexing data structure corresponding to the given n-gram string. The method further includes, in response to detecting one or more designated conditions, selecting a portion of the stored data based at least in part on the estimated frequencies and moving the selected portion of the stored data from the first storage to a second storage having different read and write access times.

Movement of stored data based on occurrences of one or more n-gram strings in the stored data

A method includes determining a set of sizes for size bucket indexes of an indexing structure, and indexing a plurality of records into the size bucket indexes. The indexing comprises, for a given record, rounding a size of the given record to a nearest one of the determined set of sizes and placing the given record in a size bucket index associated with the nearest one of the determined set of sizes. The method also includes receiving one or more queries to the plurality of records, a given one of the queries specifying a record size. The method further includes processing the given query utilizing the indexing structure by mapping the specified record size to at least a given one of the size bucket indexes and returning one or more records from the given size bucket index.

Indexing structure with size bucket indexes

A method includes obtaining messages associated with assets in an enterprise system, splitting each of the messages into a set of tokens, determining a count of a number of occurrences of each of the tokens, and assigning weights to the tokens based at least in part on the counts of the number of occurrences of the tokens. The method also includes determining a score for each of the messages based at least in part on a combined sum of the weights for the set of tokens of that message, generating a summary of the messages by selecting a subset of the messages for based at least in part on the scores. The method further includes identifying remedial actions to be applied to assets in the enterprise system based at least in part on the summary of the messages, and implementing at least one of the identified remedial actions.

Generating summaries of messages associated with assets in an enterprise system

A method includes initializing an addressable array indexing data structure comprising addresses for respective strings having a first length, the addressable array indexing data structure comprising two or more levels of character arrays with each level being associated with a corresponding character position in the strings having the first length. The method also includes extracting variable length strings from one or more records in a data set, and populating entries in the addressable array indexing data structure for extracted strings having the first length with addresses for indexes corresponding to those strings, wherein addresses for strings having the first length are generated by selecting a character value from a character array at each of the levels in the addressable array indexing data structure. The method further includes receiving, from client devices, queries to the records in the data set, and processing the queries utilizing the addressable array indexing data structure.

Addressable array indexing data structure for efficient query operations

A computerized method to identify potentially malicious code in a network is described. Herein, information associated with a threat is analyzed to yield intelligence that includes instructions or indicators related to the threat. Based on the intelligence, a determination is made as to an endpoint device, which includes an endpoint agent, is to (i) receive at least one of the instructions or the indicators, (ii) conduct an examination of memory of the endpoint device for data corresponding to any of the instructions or the indicators, and (iii) obtain results of the examination. Verification information, including at least a portion of the results of the examination by the endpoint device and an identifier for the endpoint device, is gathered and correlated to determine whether such information corresponds to a verified threat. Thereafter, a notification, including a portion of the verification information, is sent to identify the verified threat.

System and method for verifying a cyberthreat

A system and method to detect and contain threatening executable code by employing a threat monitor, verifier, endpoint agent, and a security information and event management module. The system and method determine whether a threat has persisted or executed, and allow that information to be communicated back to the detection mechanism (or other system) such that a user (or machine) may make a decision to take further action such as to contain the threat quickly and/or permit the system to do so automatically. The system further generates a report by a threat monitor, the report includes information on the one or more threats resulting from the analyzing of the portion of the network data; analyzing the information within the report by a verifier to yield intelligence that includes at least one of instructions or indicators related to the identified one or more threats and determining, gathering and correlating verification information from the endpoint agent to determine whether the verification information corresponds to a verified threat, the verification information includes at least a portion of the results of the examination and an identifier for the endpoint device; and sending a notification including a portion of the verification information to identify the verified threat.

System and method employing structured intelligence to verify and contain threats at endpoints

A system and method to detect and contain threatening executable code by employing a threat monitor, verifier, endpoint agent, and a security information and event management module. The system and method are a departure from and an improvement over conventional systems in that, among other things, the system and method allow an investigator to determine whether a threat has persisted or executed, and allow that information to be communicated back to the detection mechanism (or other system) such that a user (or machine) may make a decision to take further action such as to contain the threat quickly and/or permit the system to do so automatically.

Growing community of inventors

Sterling, VA, United States of America

Kevin J Arunski