Mcafee, Inc.

Musarubra US LLC

Mcafee Ireland Holdings Limited

Ofir Arkin

Sven Schrecker

Robin Malcolm Keir

Joel Robert Spurlock

Steven L Grobman

James Michael Hugard, Iv

Joshua Cajetan Rebelo

John Douglas Teddy

Carl D Woodward

Cedric Cochin

James Douglas Bean

Steve Grobman

Raj Samani

Robin Keir

James Michael Iv Hugard

James Michael Hugard Iv

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; and instructions encoded within the memory to instruct the processor to: provide a data exchange layer (DXL) software interface, the DXL software interface to communicatively couple to an enterprise service bus (ESB) and to provide DXL messaging services via the ESB; communicatively couple to a DXL broker via the DXL software interface; via the DXL broker, subscribe to a DXL location services topic; receive via the DXL broker a location services query; and responsive the location services query, provide logical location data for one or more network devices.

Location services on a data exchange layer

A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide 'content-less' malware detection, i.e., detecting a process as being an 'anomaly' not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) 'trusted' application behaviors, i.e., the trusted applications' 'phenotypes' and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e., &#x201c;application phenotypes&#x201d;)&#x2014;and later compare the processes executed on a user device to the stored behavioral models to determine whether the actual measured behavior reflects a &#x201c;good&#x201d; application, or if it differs from the stored behavioral models to a sufficient degree and with a sufficient degree of confidence, thus indicating a potentially malicious application or behavior.

Application phenotyping

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a network interface to communicatively couple to an enterprise service bus (ESB); instructions encoded within the memory to provide a data exchange layer (DXL) application programming interface (API), the DXL API to provide communication with a plurality of other DXL endpoints via a DXL broker; and instructions encoded within the memory to provide an asset management engine to: subscribe to a DXL location services topic via the DXL broker; receive a DXL location services query from a DXL endpoint via the DXL broker; and publish network location data via the DXL broker.

In an example, a security-connected platform is provided on a data exchange layer (DXL), which provides messaging on a publish-subscribe model. The DXL provides a plurality of DXL endpoints connected via DXL brokers. DXL endpoints communicate via DXL messages divided by topics. An asset management engine may be provided to use DXL messaging to query DXL endpoints so as to logically and physically map a network.

In an example, a security-connected platform is provided on a data exchange layer (DXL), which provides messaging on a publish-subscribe model. The DXL provides a plurality of DXL endpoints connected via DXL brokers. In one case, DXL endpoints designated as producers are authorized to produce certain types of messages, including security-related messages such as object reputations. Other DXL endpoints are designated as consumers of those messages. A domain master may also be provided, and may be configured to provide physical and logical location services via an asset management engine.

Security-connected framework

A method is provided in one example embodiment and includes receiving a traffic flow at a tamper resistant environment from an application, where the tamper resistant environment is separated from a host operating system. The method also includes applying a security token to the traffic flow and sending the traffic flow to a server. In specific embodiments, a security module may add information about the application to traffic flow. A trapping module may monitor for a memory condition and identify the memory condition. The trapping module may also, responsive to identifying the memory condition, initiate a virtual environment for the application, and check the integrity of the traffic flow.

System and method for an endpoint hardware assisted network firewall in a security environment

A pluggable asset detection engine is used to identify devices within a network. The pluggable asset detection engine includes a set of pluggable discovery sensors and is adapted to identify particular address information of a particular computing device within a network, using a first pluggable discovery sensor in the set of discovery sensors, and send an identification of the particular address information of the particular computing device to an asset management system for inclusion of the particular address information in an asset repository managed by the asset management system.

Asset detection system

A first Internet protocol version 6 (IPv6) address of a particular computing device within a network is identified using a first passive discovery sensor performing a first discovery task. A second discovery task is caused to be performed using the first IPv6 address and an attribute of the particular computing device is identified from results of the second discovery task. The first IPv6 address and attribute of the particular device is added to a repository maintaining a record of detected IPv6 addresses within the network. In some instances, a first passive discovery sensor can be one of an event-based discovery sensor, a latent-type discovery sensor, and an indirect-type discovery sensor.

Network address repository management

A plurality of system entities described in an asset repository are identified, the asset repository defining a particular hierarchical organization of the plurality of system entities within a computing environment. A particular system entity in the plurality of system entities is tagged with a particular tag. The particular system entity is associated with a particular security policy based on the particular system entity being tagged with the particular tag. The particular security policy is applied to system entities in the asset repository tagged with one or more tags in a particular set of tags including the particular tag.

System asset repository management

There are provided a system and a method of determining a physical connectivity of a new node connected to a dynamic communication network comprising a plurality of connecting nodes each comprising a plurality of ports. The method comprises: (a) responsive to automatically discovering a new node connected to the dynamic communication network, obtaining address data characterizing a network address of said discovered new node; (b) querying all known connecting nodes and generating a port dataset representing all ports thereof which have registered address data characterizing the network address of said discovered new node; (c) defining, by analyzing the generated port dataset, a port and respective connecting node which said discovered new node is directly connected to.

Method and system for determining physical connectivity in a dynamic network

Method and system for restricting a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes. Each of the first node and the one or more other nodes has a respective translation table that maps an IP address to a respective physical address of all nodes with which the first node and the one or more other nodes have communicated. Embodiments of the invention describe obtaining communicated data including address resolution messages and accessing an address resolution table representative of address resolution activity in the network. Responsive to the communicated data indicating that the first node is communicating with other nodes, restricting the first node from communicating by generating and conveying a restricting address resolution message using information stored in the address resolution table, the restricting address resolution message including a substitute physical address.

Growing community of inventors

Petah Tikva, Israel

Ofir Arkin