Computer Associates Think, Inc.

Ca, Inc.

Paul Gassoway

Lingling Liu

John L Gargiulo

Methods and systems for maintaining computer security are provided. The method for maintaining security of a computer system comprises determining an initial system certainty value for the computer system, providing access to a database of signatures, each signature including a signature certainty value, receiving data, comparing the received data with the database of signatures, increasing the system certainty value if the received data does not match a signature in the database, decreasing the system certainty value if the received data matches a signature in the database and filtering the data based on the system certainty value and the signature certainty value of a signature matching the received data.

Method and systems for computer security

The present disclosure is directed to a method and system for detecting malware using a remote server. In accordance with a particular embodiment of the present disclosure a hash value for a file is generated. The hash value is transmitted to a remote server. A notification is received from the remote server indicating whether the file comprises malware. At least one operation on the file is prevented if the notification indicates the file comprises malware.

Method and system for detecting malware using a remote server

A system and method are provided for detecting kernel level rootkits including scanning a kernel memory using a kernel level detector. The kernel level detector includes kernel level code executing in kernel space. The kernel memory is compared to at least one rootkit signature file to determine if a rootkit signature corresponding to the rootkit signature file is present in the kernel memory.

Discovery of kernel rootkits with memory scan

A method for detecting malicious packets includes comparing a sequence number of an input packet with sequence numbers of one or more previously input packets and detecting a malicious packet when the sequence number of the input packet matches at least one of the sequence numbers of the previously input packets.

Systems and methods for detecting denial of service attacks

A method for key distribution includes steps or acts of: deprecating a first key on a server; receiving a request from a client wherein the client request includes the deprecated key; verifying the client request by using the deprecated key provided in the client request to decrypt the client request; and sending a communication to the client advising that the first key has been updated. An additional step of sending instructions to the client on obtaining the updated key may also be provided. Additionally, instructions on obtaining the updated key may be sent to the client.

Propagating keys from servers to clients

A method for maintaining computer security comprises receiving an incoming email destined for an email server, determining whether the received incoming email is infected with malicious code and blocking the incoming email determined to be infected with malicious code from reaching the email server.

Systems and methods for computer security

The present invention is directed to a method and system for protecting data. In accordance with a particular embodiment of the present invention a new file is created. Key information is retrieved for the file from a keyserver. The key information includes, a key, a key identifier, and encryption algorithm information. The file is encrypted using the encryption algorithm. The key identifier is stored in a data repository. The data repository relates the key identifier to the encrypted file.

Method and system for protecting data

A method for maintaining computer security, includes providing a database of known good software, opening a file, identifying the file being opened, determining whether an entry exists in the database of known good software for the identified file and performing at least one of allowing and preventing the opening of the file from continuing based on the result of the determination.

Methods and systems for computer security

A method for maintaining computer security includes detecting a connection failure, storing information relating to the connection failure, determining a number of connection failures and determining whether a machine is infected with malicious code based on the determined number of connection failures.

The invention provides a method of disabling malicious or unwanted software on a computer system using a plurality of rules, wherein the plurality of rules automatically disable functions originating from malicious software. In one embodiment, the method includes detecting a function that is attempting to act on an object within the computer system and identifying one or more rules from the plurality of rules that apply to the object. The function may then be automatically disabled when the identified rules indicate that the function should be disabled.

System and method for using rules to protect against malware

The present disclosure is directed to a method and system for detecting malware using a secure operating system mode. In accordance with a particular embodiment of the present disclosure a file is received. The file is stored in a secure directory. At least one operation is prevented on the file. A secure operating system mode is started to detect whether the file comprises malware.

Method and system for detecting malware using a secure operating system mode

A method for discovering computers connected to a computer network, including receiving a packet containing address information of a computer connected to the computer network that sent the packet, extracting the address information from the packet, and adding the address information to a database of discovered computers connected to the computer network.

Systems and methods for discovering machines

A method for blocking the execution of prohibited files, includes requesting execution of a file to be executed, identifying the file to be executed, comparing the identified file to be executed to a list of files that are prohibited and executing the identified file to be executed when the identified file to be executed does not match a file listed in the list of files that are prohibited.

Systems and methods for excluding user specified applications

A method for combating malicious programs including monitoring network traffic from one or more devices, analyzing the network traffic to determine the presence of a malicious program in the one or more devices and disabling transmission of the network traffic for those of the one or more devices determined to have the malicious program present.

Growing community of inventors

Norwood, MA, United States of America

Paul Gassoway