Sophos Limited

Creo, LLC

Robert Wendell Cook

Andrew James Thomas

Kenneth D Ray

Mark David Harris

Simon Neil Reed

Neil Robert Tyndale Watkiss

Dmitri Samosseiko

Daniel Salvatore Schiappa

Harald Schütz

John Edward Tyrone Shaw

Anthony John Merry

Biju Ramachandra Kaimal

Venkata Suresh Reddy Obulareddy

Daniel John Blondal

Mayur Premi

Ramesh Kamath

Matthew Charles Setzer

Alexander Ianchici

Madan Mohan Nayak

Cory Michael Roy

Dave Hylands

In order to use zero trust network resources distributed across multiple gateways, an agent is deployed on an endpoint of an enterprise network. The agent maps requests for specific applications to corresponding gateways. The agent may also multiplex or otherwise aggregate communications among different network applications and gateways in order to provide seamless, transparent access to the distributed resources at a single endpoint, and/or within a single interface.

Distributed zero trust network access

Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

Normalized indications of compromise

Using indications of compromise for reputation based network security

Labeling objects on an endpoint for encryption management

Threat detection using a time-based cache of reputation information on an enterprise endpoint

Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted untrusted processes or corporate private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

In embodiments of the present invention improved capabilities are described for the detection of uncategorized web-based proxy sites, where an action may be provided in association with access to restricted network locations. In a step A, a network location access request may be received from a computing facility. In a step B, a URL database may be assessed that contains categorized URLs and it may be determined that a URL associated with the network location access request is previously uncategorized URL. In a step C, it may be determined that the URL associated with the network location access request includes a secondary URL. In a step D, the URL database may be accessed that contains categorized URLs and it may be determined that the client is restricted from accessing the secondary URL. In a step E, the action may be provided in association with the network location access request as a previously uncategorized proxy website when steps B, C, and D are all met.

Managing use of proxies to access restricted network locations

A raster image processing system ( ) for producing the appropriate number and set of halftoned color separations for a select output device ( ) is disclosed. The raster image processing system ( ) includes a processing unit ( ), an interpreter ( ) and a color combiner ( ). The interpreter ( ) and color combiner ( ) are application processes that are controlled by software running on the processing unit ( ). The processing unit ( ) identifies the number and set of colorants used to describe input image data and the number and set of halftoned color separations that a select output imaging device ( ) is capable of rendering. The interpreter ( ) converts the input data describing an image that is composed of &ldquo;N&rdquo; colorants into &ldquo;N&rdquo; halftoned color separations. The color combiner ( ) thereafter converts the N halftoned color separations into &ldquo;M&rdquo; halftoned color separations that are ideally suited for the particular output device ( ) chosen by a user of the system. The color combiner ( ) performs this conversion by utilizing digital filtering and combining processes.

System and method for producing halftoned color separations for an output imaging device

Growing community of inventors

Vancouver, Canada

Robert Wendell Cook