Mcafee, Inc.

Musarubra US LLC

Michael G Bishop

Nicholas Liebmann

Derek Patton Pearcy

Jessica J Gaskins

Paul Nicholas Gartside

Jessica A Heinrich

Peter Neal

Justin Cragin

Martina Borkowsky

Raoul Tiddy

Cristian Fiorentino

Michael Driscoll

Igor G Muttik

Simon R Hunt

Martin Stecher

Alexander James Hinchliffe

Alexander J Hinchliffe

Christopher C Williams

Raoul J Tiddy

A system for securing electronic devices includes a processor, non-transitory machine readable storage medium communicatively coupled to the processor, security applications, and a security controller. The security controller includes computer-executable instructions on the medium that are readable by the processor. The security application is configured to determine a suspicious file from a client using the security applications, identify whether the suspicious file has been encountered by other clients using the security applications, calculate a time range for which the suspicious file has been present on the clients, determine resources accessed by the suspicious file during the time range, and create a visualization of the suspicious file, a relationship between the suspicious file and the clients, the time range, and the resources accessed by the suspicious file during the time range.

Advanced threat protection cross-product security controller

A method for applying policies to an email message includes receiving, by an inbound policy module in a protected network, message metadata of an email message. The method also includes determining, based on the message metadata, whether receiving the email message in the protected network is prohibited by at least one metadata policy. The method further includes blocking the email message from being forwarded to the protected network if receiving the email message in the protected network is prohibited by the metadata policy. In specific embodiments, the method includes requesting scan results data for the email message if receiving the email message in the protected network is not prohibited by one or more metadata policies. In further embodiments, the method includes receiving the scan results data and requesting the email message if receiving the email message in the protected network is not prohibited by one or more scan policies.

Cloud email message scanning with local policy application in a network environment

A system for securing electronic devices includes a processor, non-transitory machine readable storage medium communicatively coupled to the processor, and a security controller. The security controller includes computer-executable instructions on the medium that are readable by the processor. The security controller is configured to determine a suspicious file from a client using security applications, identify whether the suspicious file has been encountered by other clients using the security applications, calculate a time range for which the suspicious file has been present on the clients, determine resources accessed by the suspicious file during the time range, and create a visualization of the suspicious file, a relationship between the suspicious file and the clients, the time range, and the resources accessed by the suspicious file during the time range.

Disclosed are systems and methods to perform coordinated blocking of source addresses, such as an Internet Protocol (IP) addresses, across a plurality of network appliances (e.g., gateways). In one disclosed embodiment the method and system temporarily alter a configuration of one or more network appliances (based on user defined configuration parameters) to allow communication from a 'blocked' IP address for a period of time. A network appliance can then 'receive' an email and perform analysis and provide results of the analysis to a reputation service. Thereby, the temporarily allowed communication can be used to learn information about a threat which would not have been available if all communication from that IP address had actually been blocked at the network appliance.

Distributed system and method for tracking and blocking malicious internet hosts

A system allows just-in-time checking of information about an email in which a hyperlink is embedded. Upon receipt of the email containing the hyperlink, the resource locator of the hyperlink is modified to allow checking the reputation of the email upon traversal of the hyperlink. At traversal of the hyperlink, the current reputation of the resource locator and the current reputation of the email are both determined, and one or more actions are performed responsive to the determination.

Just-in-time, email embedded URL reputation determination

A system, method, and computer program product are provided for applying a rule to associated events. In use, a plurality of events is associated based on at least one identifier. Additionally, at least one rule is applied to the associated events. Further, a reaction is performed based on the application of the at least one rule.

System, method, and computer program product for applying a rule to associated events

A method includes detecting a portion of data on an electronic device, determining a first representation of the malware status of the data, quarantining the data for a period of time, estimating whether the data is associated with malware by comparing the first and second representation, and, based on the estimation, releasing the data from quarantine. The first representation indicates that the malware status of the data is not certain to be safe and the malware status of the data is not certain to be malicious.

Dynamic quarantining for malware detection

A system, method, and computer program product are provided for preventing data leakage utilizing a map of data. In use, information describing data stored on at least one system is received. To this end, a map of the data is generated, utilizing the information. Further, data leakage is prevented, utilizing the map.

Growing community of inventors

Thame, United Kingdom

Michael G Bishop