University of North Carolina at Chapel Hill

Vmware, Inc.

Microsoft Technology Licensing, LLC

Srinivas Krishnan

Fabian Newman Monrose

Rishi Bidarkar

Sunil Satnur

Vikram Makhija

Kevin Zachary Snow

Albert Gordon Greenberg

Ming Zhang

David A Maltz

Banit Agrawal

Phillip Andrew Porras

Teryl Paul Taylor

Abhishek Kumar Singh

Parantap Lahiri

John E McHugh

Andrew Maxwell White

Michael Donald Bailey

Methods, systems, and computer readable media for rapid filtering of opaque data traffic are disclosed. According to one method, the method includes receiving a packet containing a payload. The method also includes analyzing a portion of the payload for determining whether the packet contains compressed or encrypted data. The method further includes performing, if the packet contains compressed or encrypted data, at least one of sending the packet to an opaque traffic analysis engine for analysis, discarding the packet, logging the packet, or marking the packet.

Methods, systems, and computer readable media for rapid filtering of opaque data traffic

Methods, systems, and computer readable media for detecting a compromised computing host are disclosed. According to one method, the method includes receiving one or more domain name system (DNS) non-existent domain (NX) messages associated with a computing host. The method also includes determining, using a host score associated with one or more unique DNS zones or domain names included in the one or more DNS NX messages, whether the computing host is compromised. The method further includes performing, in response to determining that the computing host is compromised, a mitigation action.

Methods, systems, and computer readable media for detecting a compromised computing host

According to one aspect, the subject matter described herein includes a method for efficient computer forensic analysis and data access control. The method includes steps occurring from within a virtualization layer separate from a guest operating system. The steps include monitoring disk accesses by the guest operating system to a region of interest on a disk from which data is copied into memory. The steps also include tracking subsequent accesses to the memory resident data where the memory resident data is copied from its initial location to other memory locations or over a network. The steps further include linking operations made by the guest operating system associated with the disk accesses with operations made by the guest operating system associated with the memory accessed.

Methods, systems, and computer readable media for efficient computer forensic analysis and data access control

According to one aspect, the subject matter described herein includes a method for detecting injected machine code. The method includes extracting data content from a buffer. The method also includes providing an operating system kernel configured to detect injected machine code. The method further includes executing, using the operating system kernel, the data content on a physical processor. The method further includes monitoring, using the operating system kernel, the execution of the data content to determine whether the data content contains injected machine code indicative of a code injection attack.

Methods, systems, and computer readable media for detecting injected machine code

A source device obtains a data packet that includes both a destination address and a payload. The source device selects an exit point address of multiple exit point addresses corresponding to the destination address based on one or more policies. The source device encapsulates the data packet with a header that includes the selected exit point address, and the encapsulated data packet is provided to the backbone network. The encapsulated data packet is routed through the backbone network based on the exit point address, and an edge router of the backbone network identifies an interface of the edge router that corresponds to the exit point address. The header is removed from the encapsulated data packet, and the data packet is added to a buffer of the interface for routing to one or more other devices outside of the backbone network.

Backbone network with policy driven routing

Methods, systems, and computer programs for measuring performance of remote video delivery are presented. The method embeds at a server computer a marker in selected frames of a video stream. The marker includes a preconfigured sequence of pixels and is followed by a frame number encoded in the pixel data. The method then finds a first marker at a client computer to determine the location of the markers in a display. Once the location of the markers is determined, markers in following frames are detected with their corresponding frame numbers. The method stores the arrival times and frame numbers for each detected marker. The stored arrival times and frame numbers can be used for statistical performance analysis of remote video delivery.

Measuring remote video playback performance with embedded encoded pixels

Methods, systems, and computer programs for measuring performance of virtual desktop services offered by a server computer are presented. The method includes receiving an action request at the server computer, where the server computer is configured to generate display views for the requesting client. The method further embeds, at the server computer, a first encoded area into a first image frame that is communicated to a client computer when acknowledging receipt of the action request. After the action associated with the action request is completed, the method embeds a second encoded area into a second image frame that is communicated to the client computer. Action performance time is stored in memory, where the action performance time is based on the time difference between arrivals of the first and second image frames at the client computer. The stored timing information is used to generate statistical performance data.

Measuring client interactive performance using a display channel

Methods, systems, and computer programs for measuring performance of virtual desktop services offered by a server computer are presented. The method includes receiving from a client computer an action request to be executed at the server computer, where the server computer is configured to generate display views for the requesting client. The method further embeds, at the server computer, a first encoded pixel into a first image frame that is communicated to the client computer when acknowledging receipt of the action request. Further, the method embeds a second encoded pixel into a second image frame that is communicated to the client computer after completion of the action associated with the action request. Action performance time is stored in memory, where the action performance time is the time between arrivals of the first and second image frames at the client computer. The stored timing information is used to generate statistical performance data.

Growing community of inventors

Carrboro, NC, United States of America

Srinivas Krishnan