Symantec Corporation

Symantec Operating Corporation

Geodesic Systems, Incorporated

Veritas Operating Corporation

Ca, Inc.

Michael Spertus

Christopher D Metcalf

Charles Fiterman

Gustavo Rodriguez-Rivera

William E Sobel

Carey S Nachenberg

Sourabh Satish

Kevin Alejandro Roundy

Mark Kevin Kennedy

Michael Andrew Hart

Hans Van Rietschote

Timothy Michael Naftel

Richard Schooler

Slava Kritov

Gadi Wolfman

Gerry Egan

David A Stuckmann

Gustavo Rodriguez Rivera

Shaun P Cooley

Keith Newstadt

Brian Hernacki

Kirk L Searls

Adam Glick

Spencer Dale Smith

Daniel Kats

Kuldeep Sureshrao Nagarkar

Abubakar A Wawda

Acar Tamersoy

Brian T Witten

Patrick Gardner

Darrell Kienzle

Jim Polubinski, Jr

Nitin Suresh Supekar

Anthony T Orling

Robert Walters

Brian Day

Daryl Hoyt

Peter Linhardt

Denis Serenyi

Sanjay Ramchandra Kale

Kenneth Berryman

Tim Naftel

Carey S Nachenburg

Abhay Harishchandra Marode

Richard Gough

Charles Fitterman

The disclosed computer-implemented method for detecting security incidents may include (i) collecting, by a security server, security information describing security events detected on at least one client device, (ii) generating, based on the collected security information, a mathematical graph that includes a set of nodes designating machine-windows of data and a set of nodes designating detected security events, (iii) executing a random-walk-with-restart algorithm on the generated mathematical graph to sort the set of nodes designating machine-windows of data in terms of relevance to a set of ground truth nodes that indicate confirmed security threats, and (iv) performing a remedial security action to protect a user in response to detecting a candidate security threat based on sorting the set of nodes designating machine-windows of data by executing the random-walk-with-restart algorithm. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting security incidents

The disclosed computer-implemented method for remediating computer reliability issues may include (1) obtaining a computer-generated log line that potentially includes information pertaining to a cause of a reliability issue experienced by a device, (2) determining that a product-specific schema has not been created for a product that generated the computer-generated log line, (3) in response to determining that a product-specific schema has not been created for the product, matching values of the computer-generated log line to fields within one or more established schemas that are not specific to the product, (4) identifying an entry, within the one or more established schemas, that corresponds to the computer-generated log line, and (5) remediating the device based on information associated with the entry within the one or more established schemas. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for remediating computer reliability issues

The disclosed computer-implemented method for anonymizing log entries may include (1) detecting a data pattern in a group of log entries documenting events performed by at least one process executing on at least one device, (2) identifying, in the data pattern, at least one data field in the log entries that contains variable data, (3) evaluating the data field containing variable data to determine whether the data field contains sensitive data, and (4) in response to determining whether the data field contains sensitive data, applying a data-anonymization policy to the data field to anonymize the log entries. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for anonymizing log entries

Computer-implemented methods and systems for creating or updating approved-file and trusted-domain databases and verifying the legitimacy of files are disclosed. A method for creating or updating an approved-file database may include intercepting a first file, identifying a source domain associated with the first file, identifying a trusted-domain database, determining whether a database record for the source domain associated with the first file exists within the trusted-domain database, creating a hash value for the first file if a database record for the source domain associated with the first file exists within the trusted-domain database, and storing the hash value for the first file in an approved-file database. Methods and systems for verifying the legitimacy of a file and for creating or updating a trusted-domain database are also disclosed.

Methods and systems for creating and updating approved-file and trusted-domain databases

A method for inferring real world identities is provided. The method includes receiving an authenticated copy of a document, the document having identification information and the document subject to a security check. The method includes providing evidence that an owner of the authenticated copy of the document passed the security check validating the identification information contained in the document. The method includes asserting that a device is associated with a real-world identity corresponding to the identification information listed in the authenticated copy of the document, in response to a determination that the owner of the authenticated document entered the secured area. At least one method operation is executed through a processor.

Method and apparatus for inferring realworld identities

Techniques are disclosed for detecting security incidents based on low confidence security events. A security management server aggregates a collection of security events received from logs from one or more devices. The security management server evaluates the collection of security events based on a confidence score assigned to each distinct type of security event. Each confidence score indicates a likelihood that a security incident has occurred. The security management server determines, based on the confidence scores, at least one threshold for determining when to report an occurrence of a security incident from the collection of security events. Upon determining that at least one security event of the collection has crossed the at least one threshold, the security management server reports the occurrence of the security incident to an analyst.

Detection of security incidents with low confidence security events

A method, apparatus and system for using login information includes an account where login information is used to access the account, a login information usage data for storing the login information used on the account and a manager application coupled to the accounts through a network. The manager application is configured to access the login information and determine at least one potentially or actually compromised account, determine login information related to the at least one potentially or actually compromised account, determine at least one other account having similar login information and notify a user regarding a potential threat to the at least one other account.

Method, apparatus and system for protecting identity information

Techniques for detecting an intranet spoofing attack are disclosed. In one embodiment, the techniques may be realized as a system and method for detecting an intranet spoofing attack. For example, the system may comprise one or more processors communicatively coupled to a network. The one or more processors may be configured to: identify an attempt to access an intranet website at a user device; determine that the intranet website is a spoofed intranet website; and perform an action in response to the determination of the spoofed intranet website to protect user.

Techniques for detecting an intranet spoofing attack

A computer-implemented method for discouraging polymorphic malware may comprise: 1) receiving a request to register a file in a registration database, 2) applying a registration tax to the file, 3) determining, based on whether the registration tax for the file has been satisfied, whether to register the file in the registration database, and then 4) determining, based at least in part on whether the file has been registered in the registration database, whether to add the file to an approved-file database. A method for determining whether to allow files on a computing device to execute using such an approved-file database is also disclosed. Corresponding systems and computer-readable media are also disclosed.

Systems and methods for discouraging polymorphic malware

Method for monitoring an online identity of a user on a network is described. In one example, data exchanged between a browser client on a device associated with the user and the network is monitored. Creation or use of an online identity by the user is detected within the data. The online identity is associated with a host site. The host site may be any of a plurality of point of presence sites. A notification of the online identity is generated for presentation to a custodian of the user. The notification may then be sent to the custodian.

Method and apparatus for monitoring an online identity of a user on a network

A method for using virtualization to implement information rights management. The method may include: 1) intercepting, at a virtualization module, a request from an application to access data; 2) querying an information-rights-management database for a virtualization policy associated with the access request; 3) receiving, at the virtualization module, the virtualization policy from the information-rights-management database; and 4) controlling access to the data by applying the virtualization policy to the access request in a manner that is transparent to the application. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for using virtualization to implement information rights management

One method of testing multi-threaded code involves accessing a first set of instructions which are configured to be executed, in execution order, as a thread of a multi-threaded process. A memory space is modified, based upon the first set of instructions. The modified memory space represents one or more values that are generated by executing the first set of program instructions in a different order than execution order. The memory space is processed by a second set of program instructions, which is configured to be executed as a second thread of the multi-threaded process.

Memory order tester for multi-threaded programs

A method and apparatus for preventing accidental disclosure of confidential information via visual representation objects is described. In one embodiment, the method includes establishing pattern information with respect to confidential information, wherein the confidential information is used to authenticate users, monitoring a visual representation object having an input focus associated with a user interface, wherein the visual representation object receives input data, comparing the input data with the pattern information to identify at least one unobscured portion of the confidential information and producing indicia of detection of the at least one unobscured portion of the confidential information on the visual representation object.

Method and apparatus for preventing accidential disclosure of confidential information via visual representation objects

A reputation server is coupled to multiple clients via a network. Each client has a security module that detects malware at the client. The security module computes a hygiene score based on detected malware. The security module provides the hygiene score and an identifier of a visited web site to a reputation server. The security module also provides identifiers of files encountered at specified web sites to the reputation server. The reputation server computes secondary hygiene scores for web sites based on the hygiene scores of the clients that visit the web sites. The reputation server further computes reputation scores for files based on the secondary hygiene scores of sites that host the files. The reputation server provides the reputation scores to the clients. A reputation score represents an assessment of whether the associated file is malicious.

Web site computer security using client hygiene scores

Method and apparatus for monitoring identity misrepresentation by a user on a network are described. In one example, validated identity information for the user is received from a trusted source. Data exchanged between a network client on a device associated with the user and the network is monitored. An identity misrepresentation by the user is detected based on the validated identity information. A notification of the identity misrepresentation is sent to the trusted source.

Method and apparatus for monitoring identity misrepresentation by a user on a network

Growing community of inventors

Chicago, IL, United States of America

Michael Spertus