Fireeye, Inc.

Qualcomm Incorporated

Cisco Technology, Inc.

Ramesh Radhakrishnan

Ashar Aziz

Osman Abdoul Ismael

Jayaraman Manni

Adrian Drzewiecki

Muhammad Amin

Ramanathan Balachander

Paul Aerick Lambert

Alon Shlomo Bernstein

Arun G Khanna

Wei-Lung Lai

Kushal A Patel

Ender Ayanoglu

Ozgur Gurbuz

Keyvan Moataghed

Cindy Chan

Haresh M Kubhani

A system is provided with one or more virtual machines and a replayer. The virtual machine(s) are configured to mimic operations of a first device. The replayer is configured to mimic operations of a second device. Herein, the replayer receives a portion of network data under analysis, dynamically modifies the portion of the network data, and transmits the modified portion of the network data to at least one virtual machine of the one or more virtual machines in accordance with a protocol sequence utilized between the first device and the second device.

System and method for virtual analysis of network data

A system is provided with an interface and controller. The interface is configured to receive packets transmitted over a network between a first device and a second device. Transmitted over the network in accordance with a packet protocol, the packets include at least one packet transmitted from the first device and at least one packet transmitted from the second device. Coupled to the interface, the controller is configured to determine whether a plurality of packets have suspicious characteristics of malware and transmit the suspicious packets to an analysis environment. The analysis environment is configured to receive the plurality of packets that have suspicious characteristics of malware, modify at least a portion of these suspicious packets, and transmit at least the modified portion of the plurality of packets that have suspicious characteristics of malware to a virtual machine in accordance with a sequence of the packet protocol.

System and method for analyzing packets

A system is provided with a controller and a device configured to receive and output network data from a communication network to the controller. Accordingly, the controller is configured to (i) receive the network data from the device, (ii) conduct heuristic analysis on the network data, (iii) identify at least a portion of the network data as suspicious upon determining by the heuristic analysis of a likelihood that at least the portion of the network data including malware, (iv) simulate transmission of the suspicious network data to at least one virtual machine of a plurality of virtual machines that is selected or configured using at least one software profile, and (v) analyze effects of the suspicious network data on the at least one virtual machine.

System and method for analyzing suspicious network data

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller coupled to the tap. The controller is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if the network data is suspicious, flag the network data as suspicious based on the heuristic determination, and concurrently simulate transmission of the network data to a plurality of destination devices.

Virtual machine with dynamic data flow analysis

A dynamic signature creation and enforcement system can comprise a tap configured to copy network data from a communication network, and a controller coupled to the tap. The controller is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if the network data is suspicious, flag the network data as suspicious based on the heuristic determination, simulate transmission of the network data to a destination device to identify unauthorized activity, generate an unauthorized activity signature based on the identification, and transmit the unauthorized activity signature to a digital device configured to enforce the unauthorized activity signature.

Dynamic signature creation and enforcement

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller. The controller is coupled to the tap and is configured to receive the copy of the network data from the tap, analyze the copy of the network data to flag the network data as suspicious, and simulate transmission of the network data to a destination device.

Policy based capture with replay to virtual machine

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller. The controller is coupled to the tap and is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to flag the network data as suspicious, and simulate transmission of the network data to a destination device.

Heuristic based capture with replay to virtual machine

Methods and systems are presented for establishing communications in a wireless local area network involving obtaining at least one channel-specific measurement for each of a plurality of frequency channels, automatically selecting one of the plurality of frequency channels as a selected frequency channel by taking into account the at least one channel-specific measurement for each of the plurality of frequency channels, configuring a present access point (AP) device to transmit and receive data on the selected frequency channel, and configuring a present station (STA) device to transmit and receive data on the selected frequency channel, wherein the present AP device and the present STA device are capable of communicating data within a wireless local area network.

Radio resource management for wireless local area networks

Methods and systems are presented for establishing communications in a wireless local area network involving obtaining at least one measurement of load for each of a plurality of access point (AP) devices, automatically selecting one of the plurality of AP devices as a selected AP device by taking into account the at least one measurement of load for each of the plurality of AP devices, and associating a station (STA) device with the selected AP device, wherein the selected AP device and the STA device are capable of communicating data within a wireless local area network. Also, at least one measurement of signal strength as measured at the STA device for each of the plurality of AP devices may be obtained, and automatic selection of one of the plurality of AP devices may further take into account the at least one measurement of signal strength for each AP device.

Capacity management for wireless local area networks

The subject invention relates to methods and systems for determining wireless network service characteristics involving receiving at an access point (AP) a request from a station (STA) for wireless network access, obtaining a first identifier specifying a wireless local area network (WLAN) to which the STA is to be connected, obtaining a second identifier from an authentication process relating to the STA, determining a service profile for the STA based on the first identifier and the second identifier, wherein the service profile specifies a value for each of a plurality of service attributes, and establishing a connection for wireless communications between the STA and the AP based on the service profile, wherein the connection is characterized by the value specified for each of the plurality of service attributes.

Subscriber management and service profiles

Frame Relay connectivity is provided via point to multipoint networks. Frame Relay access can thus be readily provided via point to multipoint networks such as data over cable networks and wireless networks. The end user obtains Frame Relay quality-of-service features via the point to multipoint network. The network service provider gains an additional method of access to the Frame Relay wide area network (WAN). Frame Relay quality of service information is translated into parameters appropriate for use with point to multipoint protocols so that point to multipoint network bandwidth may be properly measured.

Frame relay over point to multipoint links

Systems and methods for retransmitting unsuccessfully transmitted data across a communication link. The retransmission mechanism may be applied to point to multipoint networks including wireless networks. Each packet is encapsulated in an ARQ frame and assigned a sequence number for the purpose of coordinating acknowledgments and retransmissions. Information as to which packets require retransmission is communicated in the form of a bitmap where each bit indicates an acknowledgment status for a given packet. Any missing packets in the received sequence are assumed to require retransmission.

Growing community of inventors

Saratoga, CA, United States of America

Ramesh Radhakrishnan