Microsoft Technology Licensing, LLC

Rajesh K Dadhia

Pradeep Bahl

Michael Todd Kramer

Efim Hudis

Mihai Costea

Anil Francis Thomas

Yigal Mordechai Edery

Fabien J Royer

Scott Field

Joseph M Joy

Anders Samuelsson

Gerardo Diaz Cuellar

Sean B House

Sukvinder S Gill

Yigal Edery

Techniques for aggregating a knowledge base of a plurality of security services or other event collection systems to protect a computer from malware are provided. In embodiments, a computer is protected from malware by using anti-malware services or other event collection systems to observe suspicious events that are potentially indicative of malware. A determination is made as to whether a combination of the suspicious events is indicative of malware. If the combination of suspicious events is indicative of malware, a restrictive security policy designed to prevent the spread of malware is implemented.

Aggregating the knowledge base of computer systems to proactively protect a computer from malware

Tools and techniques for dynamically computing reputation scores for objects are described herein. The tools may provide machine-readable storage media containing machine-readable instructions for receiving requests to dynamically compute reputation scores for the objects, for instantiating protected virtual environments in which to execute the objects, and for computing the reputation score based on how the object behaves when executing within the virtual environment.

Dynamically computing reputation scores for objects

In accordance with the present invention, a system, method, and computer-readable medium for aggregating the knowledge base of a plurality of security services or other event collection systems to protect a computer from malware is provided. One aspect of the present invention is a method that proactively protects a computer from malware by using anti-malware services or other event collection systems to observe suspicious events that are potentially indicative of malware; determining if the suspicious events satisfy a predetermined threshold; and if the suspicious events satisfy the predetermined threshold, implementing a restrictive security policy designed to prevent the spread of malware.

Among other things, one or more systems and/or methods for a network aware firewall are disclosed. A method comprises accessing a first network connection from a client computer system and determining whether the first network connection is a first network type or a second network type. The method further comprises dynamically modifying security parameters associated with a firewall local to the client computer system in response to determining whether the network connection is the first network type or the second network type.

Network aware firewall

A Network State Database (NSD) can comprise information regarding the network-centric state of one or more computing devices connected to a network. The information contained in the NSD can be passively received by the NSD, or it can be actively obtained by the NSD. Additionally the NSD can comprise either a centralized collection of information, or a distributed collection of information independently maintained and conceptualized as a single entity. The information of the NSD can be used by a Network Risk Management Service (NRMS) to appropriately respond and protect the network. The NRMS can provide relevant information from the NSD to subscribers, which can independently act to protect the network. The NRMS can likewise itself instruct computing devices regarding an appropriate action, or it can itself instruct the performance of such action.

Real-time network malware protection

Management of security firewall settings in a networked computing environment is described. One example embodiment includes applying security settings and exceptions to the security settings based on network class for network communication, and upon detection of an event, revoking at least one exception for at least one network in a specified class.

Selective auto-revocation of firewall security settings

Architecture for facilitating access of remote system software functionality by a host machine for the redirection of incoming and/or outgoing host traffic through the remote system for protection services to the host machine. The host machine can gain the benefits of effective protection software such as firewall, intrusion protection software, and anti-malware services, of the remote machine. The host machine can choose to exercise traffic redirection when there is a risk of being compromised, and then revert back to direct communications when the risk has been averted. The host machine takes advantage of the resources available on the remote machine in substantially realtime with minimal disruption to the host and/or the remote machine operations. This facilitates widespread and temporary protection of network systems for a more secure working environment and improved customer experience.

Dynamic security shielding through a network resource

A system and method for a network aware firewall is disclosed. The method includes accessing a first network connection from a client computer system and determining whether the first network connection is public or private. The method further includes dynamically modifying security parameters associated with a firewall local to the client computer system in response to determining whether the network connection is public or private.

A method and system for dynamically protecting against exploitation of a vulnerability is provided. The dynamic protection system identifies the security level of an instance of an application that is to execute on a computer system. If the security level of the instance of the application is not appropriate, the dynamic protection system places a limitation on the execution of the instance of that application.

Method and system for dynamic system protection

A new network load balancing/firewall node for use in a system including multiple network load balancing/firewall nodes is disclosed. The network load balancing/firewall applies bi-directional load balancing affinity with regard to requests from external clients and corresponding responses from internal network servers. An external network load balancing adapter executes a load-balancing algorithm to determine whether a received client request is accepted by the network load balancing/firewall node. A firewall utility processes the received client request and maintains state information associated with the received client request. An internal network load balancing adapter ensures that the same network load balancing/firewall node accepts a response from an internal network server corresponding to the received client request.

Growing community of inventors

Redmond, WA, United States of America

Rajesh K Dadhia