Symantec Corporation

Veritas Technologies LLC

Preeti Agarwal

Vishal Bajpai

Rohit Bhagwat

Zhipeng Zhao

Michael Pukish

Chaopin Zhu

The disclosed computer-implemented method for detecting suspicious microcontroller messages may include (1) observing a typical interval at which messages are sent over a network by a microcontroller, (2) identifying a message sent over the network by the microcontroller, (3) determining that the interval between the message and the previous message sent by the microcontroller does not comprise the typical interval, and (4) categorizing the message as a suspicious message in response to determining that the interval does not comprise the typical interval. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting suspicious microcontroller messages

Methods, computer program products, computer systems, and the like, which protect messages in an electronic messaging system, are disclosed. The methods, computer program products, computer systems, and the like include detecting an occurrence of an event, and, in response to the detecting the occurrence of the event, scanning a message. The occurrence of the event indicates that the message should be scanned. The message includes recipient information, which identifies a recipient of the message, and is stored in a message store. The message has been received at a message destination associated with the recipient. The scanning uses a malware definition. The scanning is performed prior to the message being retrieved from the message store in response to a request by the recipient to retrieve the message from the message store. The event is other than the request by the recipient to retrieve the message from the message store.

Prioritizing the scanning of messages using the reputation of the message destinations

A system and method for detecting an invalid packet on a Controller Area Network (CAN) bus having a plurality of CAN nodes coupled thereto is provided. The method may include monitoring a CAN identifier (CAN ID) of each packet sent by each CAN node. The method may also include determining whether to detect the validity using a time threshold, historical data, or an acknowledgement (ACK) bit. For example, when the CAN ID is unknown, the method may include the use of validity detection process based upon the ACK Slot bit. Accordingly, the method may include detecting the validity of each packet using the selected method determined. In addition, the method may include storing the detected validity in a database having a listing for valid packets (white list) and a listing for invalid packets (black list). Moreover, the method may include disabling the invalid packets.

System and method for identifying an invalid packet on a controller area network (CAN) bus

Various systems and methods precalculate client-side deduplication signatures. For example, one method can identify a data object to be included in a backup and then calculate a signature of a data object prior to the start of a backup operation to create the backup. The signature identifies the data object within a deduplicated data store configured to store a backup of the data object. The signature can be calculated in response to detecting that a current usage level of system resources (e.g., such as a current processor utilization) of a client computing device is less than a threshold usage level.

Precalculation of signatures for use in client-side deduplication

The disclosed computer-implemented method for identifying message payload bit fields in electronic communications may include (i) monitoring messages transmitted via a network, (ii) selecting a plurality of messages transmitted via the network, each of the plurality of messages comprising an identical message identifier corresponding to a specified message type having a payload, (iii) determining for each bit position in the payload of the specified message type, a quasi-entropy value based on a proportion of occurrences of a first bit value and a proportion of occurrences of a second bit value at each corresponding bit position in the plurality of messages, and (iv) identifying at least one of a near-random bit field, a periodic bit field, and a constant bit field within the specified message type based on the determined quasi-entropy values. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying message payload bit fields in electronic communications

A computer-implemented method for leveraging data-deduplication capabilities of file systems may include (1) detecting a backup operation that backs up at least one data segment maintained by a file system capable of performing data deduplication on a computing device, (2) querying the file system for file-system data that includes (i) the data segment to be backed up during the backup operation, (ii) at least one unique identifier that identifies the data segment, and (iii) at least one file-specific segment map that identifies a position of the data segment relative to at least one other data segment within a file, (3) receiving the file-system data from the file system in response to the query, and then (4) providing the file-system data to a deduplication server to facilitate backing up the file based at least in part on the file-system data. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Pune, India

Preeti Agarwal