Agere Systems Inc.

Trend Micro Inc.

Ncipher Corporation Limited

Britestream Networks, Inc.

Layer N Networks, Inc.

Leslie Zsohar

Craig Botkin

David Sonnier

Wei Lu

Sean W McGee

Randal Mullin

Victor A Bennett

David Allen Brown

David B Kramer

Brandon Niemczyk

Shannon E Lawson

Edward A Wartha

Josiah Dede Hagen

Jonathan Edward Andersson

Randall Findley

Shoufu Luo

Peter Andriukaitis

Jonathan James Oliver

Chia-Yen Chang

Wen-Kwang Tsao

Daniel B Reents

Robert Bradford Cohen

Michael Moriarty

Oscar R Mitchell

Jayson Pryde

Rajat Datta

Michael W Hathaway

Greg North

Richard Goble

Joseph Cepe

Paul Christian D Pajares

Chiaming Chiang

Maria Estella Manly Reyes

Michael A Roche

Eleanor Coy

James Garrett

A computer system generates a hierarchical evolutionary tree of digests of sample files. The digests are generated using a locality sensitive hashing function. The digests are grouped into several clusters, and the clusters are grouped into several nodes. The nodes are connected in hierarchical order to generate the hierarchical evolutionary tree. A digest of a file being evaluated for malware is generated using the locality sensitive hashing function. The digest is put in a cluster of the hierarchical evolutionary tree having digests that are most similar to the digest relative to digests of other clusters of the hierarchical evolutionary tree. The digest is identified to be of the same malware family as the digests of the cluster.

Detection and identification of malware using a hierarchical evolutionary tree

Examples relate to extracting data from network communications. In one example, a programmable hardware processor may: receive a first set of network packets; store each network packet included in the first set in a first storage device; identify, from each network packet included in a subset of the first set of network packets, data included in the network packet, the data meeting at least one condition defined by first programmable logic of the programmable hardware processor; and for each network packet included in the subset: extract, from the network packet, data of interest; and store, in a second storage device, i) the extracted data of interest, and ii) an identifier associated with the network packet.

Extracting data from network communications

In one embodiment, local begin and end tags are detected by a network security device to determine a local context of a network traffic flow, and a local feature vector is obtained for that local context. At least one triggering machine learning model is applied by the network security device to the local feature vector, and the result determines whether or not deeper analysis is warranted. In most cases, very substantial resources are not required because deeper analysis is not indicated. If deeper analysis is indicated, one or more deeper machine learning model may then be applied to global and local feature vectors, and regular expressions may be applied to packet data, which may include the triggering data packet and one or more subsequent data packets. Other embodiments, aspects and features are also disclosed.

Methods and apparatus for intrusion prevention using global and local feature extraction contexts

Examples of implementations relate to metadata extraction. For example, a system of privacy preservation comprises a physical processor that executes machine-readable instructions that cause the system to normalize a network traffic payload with a hardware-based normalization engine controlled by a microcode program; parse the normalized network traffic payload, as the network traffic payload passes through a network, by performing a parsing operation of a portion of the normalized network traffic payload with a hardware-based function engine of a plurality of parallel-distributed hardware-based function engines controlled by the microcode program; and provide the hardware-based function engine with a different portion of the normalized network traffic payload responsive to an indication, communicated through a common status interface, that the different portion of the normalized network traffic payload is needed to complete the parsing operation.

Metadata extraction

Examples relate to organizing and storing network communications. In one example, a programmable hardware processor may: receive a first set of network packets; identify, for each network packet included in the first set, a network flow, each network flow including at least one related packet; store each network packet included in a subset of the first set in a first data storage device; for each network packet included in the subset, organize the network packet according to the network flow identified for the network packet; identify, from the network flows, a set of network flows that each have at least one characteristic of interest; and store, in a second data storage device, each network packet included in each network flow of the set of network flows.

Organizing and storing network communications

A network or other type of processor operates to switch packets from an incoming cell stream to an outgoing cell stream. Each received and transmitted cell in a cell stream includes portions of packets, or complete packets or both. Packets are reassembled from incoming cells, and outgoing cells may be created from portions of packets, complete packets or both. The packets in the outgoing cells may be from incoming packets, switched reassembled packets or both. Each incoming and outgoing cell is associated with one virtual channel, and each virtual channel for an outgoing cell may be different from the virtual channel corresponding to the incoming cell or cells from which a packet was reassembled. Switched packets also may have their conversation identifications changed. Partial packets or partial cells that are awaiting completion are retained such that switching capabilities associated with the virtual channel and channel identification modifications may be used.

Processor for packet switching between cell streams with optional virtual channel and channel identification modification

An information-processing method for application-specific processing of messages. A message is received. Whether the message is in a selected application format is ascertained. If not, the message is routed to a next location. If so, the message is routed to a selected application processor, processed by the processor, and routed to the next location.

Application-specific information-processing method, system, and apparatus

A system and method for processing server-to-client and client-to-server data communications using data processing devices (DPDs) in a small-area system, such as a local area network or smaller system. The DPDs act as proxies for the servers to which the transmissions are directed. The DPDs are connected to each other in a small-area system using interconnect devices, preferably forming a bidirectional ring network, so that received transmissions can be passed among the DPDs to the appropriate DPD. The resulting system allows the DPDs to perform processing on the incoming data communications, offloading this task from the destination servers. While the preferred embodiment is specifically drawn to DPDs that perform encryption/decryption, the disclosed system may implement any number of data processing applications on data that is being transmitted between clients and servers.

System and method for small-area system data processing

A state decision subsystem (SDS) including an inload module, a simple programmable entity (SPE), at least one SPE memory, an unload module, and a coherency module. The inload module reads state information from a memory subsystem&#x2014;the state information corresponding to TCP packets that are to be processed. In addition, the inload module writes contexts to the SPE memory. Each context includes both a TCP packet and its corresponding state information. The SPE reads each context from the SPE memory, processes the context, and writes the processed context to the SPE memory. The processed context includes both a processed TCP packet and its corresponding processed state information. Furthermore, the unload memory reads the processed context and writes the processed state information to the memory subsystem. Finally, the coherency module compares contents of the inload module and the unload module, and if the contents of each correspond to the same TCP connection, the coherency module replaces the state related content of the inload module with the state related content of the unload module.

High-throughput state management for TCP

A memory architecture design and strategy is provided using memory devices that would normally be considered disadvantageous, but by accommodating the data input, output, and other peripheral controller services, overall performance in this mode is optimized. The surprising result is that even though the choice of memory is inappropriate for the task based on the precepts of the prior art, the overall memory system is effective. Bank switching in DDR-SDRAM can be utilized to achieve technological feasibility without resorting to, for example, SRAM.

Device and method for small discontiguous accesses to high-density memory devices

A fast pattern processor having an internal function bus and an external function bus. In one embodiment, a fast pattern processor includes: (1) an internal function bus, (2) an external function bus, (3) a context memory having a block buffer and a argument signature register wherein the block buffer includes processing blocks associated with a protocol data unit (PDU), (4) a pattern processing engine, associated with the context memory, that performs pattern matching and (5) a function interface system having (5A) a controller arbitration subsystem and (5B) a dispatch subsystem.

Fast pattern processor including a function interface system

A processor includes scheduling circuitry for scheduling data blocks for transmission from a plurality of transmission elements. The scheduling circuitry has at least one time slot table accessible thereto, and is configured for utilization of the time slot table in scheduling the data blocks for transmission. The time slot table includes a plurality of locations, with each of the locations corresponding to a transmission time slot and being configurable for storing identifiers of at least two of the transmission elements. In an illustrative embodiment, a given one of the locations in the time slot table stores in a first portion thereof an identifier of a first one of the transmission elements that has requested transmission of a block of data in the corresponding time slot, and stores in a second portion thereof an identifier of a second one of the transmission elements that has requested transmission of a block of data in the corresponding time slot. Furthermore, additional transmission elements generating colliding requests for the given location can be linked between the first and second transmission elements using a linking mechanism. The use of multi-entry time slot table locations to accommodate collisions between transmission element requests considerably facilitates the maintenance of desired traffic shaping requirements.

Processor with dynamic table-based scheduling using multi-entry table locations for handling transmission request collisions

Growing community of inventors

Austin, TX, United States of America

Leslie Zsohar