Symantec Corporation

Matthew Elder

Darrell Kienzle

Nathan Evans

Ryan Kumar Persaud

Brian Hernacki

Pratyusa Kumar Manadhata

William Gauvin

Adam Schepis

Azzedine Benameur

Brian T Witten

Robert Walters

A computer-implemented method for estimating ages of network devices may include (1) identifying at least one networked device that may be attached to a network, (2) identifying a media access control address of the networked device, the media access control address comprising an organizational unique identifier, (3) querying an organizational-unique-identifier database with the organizational unique identifier and receiving, in response, device-age information relating to an estimated age of the networked device and (4) determining the estimated age of the networked device based at least in part on the device-age information. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for estimating ages of network devices

A computer-implemented method for obscuring network services may include (1) identifying a local network comprising at least one client and at least one host, where the host provides a service that is not bound to any routable address on the local network and the client is expected to send messages to the service, (2) provisioning the client with a proxy that intercepts the messages directed to the service by the client, identifies the host that provides the service, and adds at least one layer of encryption to the messages, (3) configuring the proxy to route the messages through an onion routing network within the local network that comprises at least one onion routing node, and (4) configuring the onion routing network to remove the at least one layer of encryption from the messages before forwarding the messages. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for obscuring network services

Embodiments of the present invention are directed to a method and system for automated risk analysis. The method includes accessing host configuration information of a host and querying a vulnerability database based on the host configuration information. The method further includes receiving a list of vulnerabilities and accessing a plurality of vulnerability scores. The list of vulnerabilities corresponds to vulnerabilities of the host. Vulnerabilities can be removed from the list based on checking for installed fixes corresponding to vulnerability. A composite risk score can then be determined for the host and each software product of the host based on the plurality of vulnerability scores. An aggregate risk score can then be determined for the host and each software product of the host based on the plurality of vulnerability scores.

System and method for vulnerability risk analysis

A computer-implemented method for discovering network topologies. The method may include (1) receiving, on a host system within a network, a switch-protocol message that includes a switch identifier, a port identifier, and/or a root path cost, (2) identifying a set of switches within the network based on the switch-protocol message, (3) determining how the set of switches are connected based on the switch-protocol message, and (4) mapping a topology of the network based on determining how the set of switches are connected. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for discovering network topologies

A system and method for determining the model information of a device. A mapping database that maps a plurality of network device identifiers of a set of devices to model information of the devices may be automatically created. A request to determine model information of an unknown based on a network device identifier of the unknown device may then be received. The database may be analyzed to determine the model information of the unknown device. For example, the model information of the unknown device may be determined by extrapolating it based on the network device identifier of the device and the database information.

Determining model information of devices based on network device identifiers

A computer-implemented method for mapping network topologies may include (1) identifying a network including a plurality of network switches and a plurality of host systems, (2) identifying a host system within the plurality of host systems connected to the network via a network switch within the plurality of network switches, (3) refreshing an address of the host system within the network switch, (4) allowing the address of the host system to expire from each network switch within the plurality of network switches except the network switch, (5) transmitting a probing frame from a probing host system within the plurality of host systems to the address of the host system, (6) identifying a subset of host systems within the plurality of host systems that received the probing frame, and then (7) mapping a topology of the network based on the identified subset. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for mapping network topologies

Detection of network devices (e.g., stealth devices) and mapping network topology are performed via network introspection by collaborating endpoints/nodes. The method includes receiving (e.g., by a node on a network) an assignment to be a supernode that will manage multiple agents of a subnetwork within an overall network. This assigned supernode instructs two or more of the agents to perform a set of network traffic fingerprinting tests of the subnetwork by passing information across the subnetwork to each other. The supernode receives results of the tests from the clients and detects one or more intermediate devices located between the clients based on an effect of the intermediate devices on the information passed between the clients. The supernode can further map the topology of the subnetwork (including the detected devices) which can be used in mapping the overall network topology.

Detecting network devices and mapping topology using network introspection by collaborating endpoints

Various embodiments of a method and an apparatus for identifying invariants to detect software tampering is disclosed. In one embodiment, a method of identifying invariants associated with a software package comprises applying a machine learning technique to a plurality of images associated with a software package to identify a memory location within the plurality of images to be a candidate invariant, wherein the plurality of images comprises images of memory used during execution of the software package and determining an invariant based on the candidate invariant.

Method and apparatus for identifying invariants to detect software tampering

Computer-implemented methods, apparati, and computer-readable media for thwarting computer attacks. A method embodiment of the present invention comprises the steps of examining () a digital certificate () presented by a server computer (); compiling () a set of suspicion indications () gleaned from said examining step (); and feeding () said suspicion indications () to a consequence engine ().

Growing community of inventors

Germantown, MD, United States of America

Matthew Elder