Sophos Limited

Santosh Subramanya

Shankar Jayaraman

Guy Roberts

Mukesh Kumar

Sean Patrick McDonald

Dhwanit Shah

Guruskanthan Viswanathan

Rahul Pandey

Sajimon Kurien

Systems and methods for scanning network activity. The methods include receiving at an interface connection data regarding a plurality of network connections, wherein the connection data includes a signature used to classify each of the plurality of network connections; determining, using one or more processors executing instructions stored on memory to provide a signature analysis engine configured to analyze the connection data, the signature is prohibitively prone to misclassifying network activity as malicious, wherein the determination is based on the analysis of the connection data; and implementing a signature policy to prevent the signature from misclassifying network activity as malicious.

Signature quality evaluation

Methods and systems for detecting threats using threat signatures loaded in a computing device. The methods include receiving a first plurality of threat signatures at a computing device, at least one threat signature of the first plurality of threat signatures having been assigned a score based on at least one metadata attribute having been added to the at least one threat signature; receiving a selection of a second plurality of threat signatures from the first plurality of threat signatures to load into random access memory (RAM) of the computing device, wherein at least one threat signature of the selected plurality of threat signatures is selected based on its assigned score; scanning network traffic accessible by the computing device using the at least one threat signature of the selected plurality of threat signatures; detecting a threat in the network traffic based on the scanning using the at least one threat signature of the selected plurality of threat signatures; and performing a remedial action upon detecting the threat in the network traffic.

Scored threat signature analysis

Systems and methods for monitoring a file download. The methods include communicating, using a first device, a request to download a file from a source; receiving at the first device a first plurality of packets related to the file; modifying the first plurality of packets to create a second plurality of packets; and communicating the second plurality of packets to a second device configured to reassemble the second plurality of packets, extract the file from the reassembled second plurality of packets, and obtain behavioral data associated with the file. The methods further include receiving at the first device the behavioral data associated with the file, and implementing a download decision based on the behavioral data associated with the file, wherein the implemented download decision indicates at least whether the first device downloads the file.

Systems and methods for monitoring a file download

Growing community of inventors

Bengaluru, India

Santosh Subramanya