Emc IP Holding Company LLC

Emc Corporation

Scott Moore

Kevin J Arunski

Sashka T Davis

Zulfikar A Ramzan

Abram Q Thielke

Ed G Quackenbush

Matthew D Tharp

Kevin T Douglas

Brian P Girardi

Edward G Quackenbush

Todd Moore

Etienne Boucher

Scott G Carter

Kenneth Buonforte

Matthew Mannarelli

A method includes monitoring user behavior in an enterprise system, identifying a given user of the enterprise system associated with a given portion of the monitored user behavior, determining a predicted impact of compromise of the given user on the enterprise system, generating a risk score for the given user based on the predicted impact of compromise and the given portion of the monitored user behavior, and identifying one or more remedial actions to reduce the risk score for the given user. The method also includes implementing, prior to detecting compromise of the given user, at least one of the remedial actions to modify a configuration of at least one asset in the enterprise system, the at least one asset comprising at least one of a physical computing resource and a virtual computing resource in the enterprise system.

Risk score generation utilizing monitored behavior and predicted impact of compromise

A method in one embodiment comprises receiving at least one query from a client device, and distributing the at least one query to a plurality of query engines, wherein each of the plurality of query engines processes the at least one query and generates a partial query result. The plurality of query engines correspond to respective unique identifiers, and the partial query results each include the unique identifier of the query engine that generated the partial query result. The method also comprises determining whether the unique identifier of a given query engine is included with more than one partial query result generated in response to the at least one query, and identifying an error in response to an affirmative determination.

Query result overlap detection using unique identifiers

A method includes determining a set of sizes for size bucket indexes of an indexing structure, and indexing a plurality of records into the size bucket indexes. The indexing comprises, for a given record, rounding a size of the given record to a nearest one of the determined set of sizes and placing the given record in a size bucket index associated with the nearest one of the determined set of sizes. The method also includes receiving one or more queries to the plurality of records, a given one of the queries specifying a record size. The method further includes processing the given query utilizing the indexing structure by mapping the specified record size to at least a given one of the size bucket indexes and returning one or more records from the given size bucket index.

Indexing structure with size bucket indexes

A method includes obtaining messages associated with assets in an enterprise system, splitting each of the messages into a set of tokens, determining a count of a number of occurrences of each of the tokens, and assigning weights to the tokens based at least in part on the counts of the number of occurrences of the tokens. The method also includes determining a score for each of the messages based at least in part on a combined sum of the weights for the set of tokens of that message, generating a summary of the messages by selecting a subset of the messages for based at least in part on the scores. The method further includes identifying remedial actions to be applied to assets in the enterprise system based at least in part on the summary of the messages, and implementing at least one of the identified remedial actions.

Generating summaries of messages associated with assets in an enterprise system

An apparatus in one embodiment comprises at least one processing device comprising a processor coupled to a memory. The processing device is configured to determine a plurality of block offsets indicating respective positions of data within a plurality of uncompressed data blocks respectively encoded to have variable sizes, to generate a block index file comprising the plurality of block offsets, a plurality of block positions and a plurality of block sizes respectively corresponding to the plurality of uncompressed data blocks, to compress data from at least one uncompressed data block of the plurality of uncompressed data blocks to at least one compressed data block of a plurality of compressed data blocks, and to utilize the block index file in connection with decompressing the compressed data.

Using variable sized uncompressed data blocks to address file positions when simultaneously compressing multiple blocks

An apparatus in one embodiment comprises a first endpoint device having a processor coupled to a memory. The first endpoint device is adapted for communication with other endpoint devices over a network, and implements a key capture agent configured to interface with an operating system of the first endpoint device. The key capture agent is configured to collect key material associated with a session key utilized to encrypt packets sent by the first endpoint device to a second endpoint device over the network as part of a corresponding session. The key material and an identifier of the corresponding session are transmitted for delivery to a decoder that is not part of the first or second endpoint devices, so as to permit the decoder to be configured to decrypt the encrypted packets in intercepted network traffic. For example, the key capture agent may be configured to transmit the key material.

Decryption and analysis of network traffic using key material collected from endpoint devices of a computer network

A method of visualizing network data includes parsing a collection of packets in accordance with a set of categories related to characteristics of the collection of packets, the categories including listings of categorical elements, wherein at least some of the categorical elements are selectable by a user. When a categorical element is selected by a user, the collection of packets is filtered in accordance with the selected categorical element. Alongside each categorical element is a selectable count value that is indicative of the number of discrete communications sessions in which an associated categorical element is present in the collection of packets. When the count value is selected, a session view or views is/are created for each respective session, with content payload available for review and viewing.

Growing community of inventors

Fredericksburg, VA, United States of America

Scott Moore