Veritas Technologies LLC

Symantec Corporation

Vishal Bajpai

Preeti Agarwal

Deepak Patil

Pradip Kulkarni

Bhushan Sudhakar Pandit

Michael Pukish

Wasim Ilkal

Venkatesh Chakravarthy

Ajit Hanumant Kirkole

Namita S Agrawal

The disclosed computer-implemented method for identifying suspicious controller area network messages may include (i) monitoring, for a predetermined period of time, messages sent by an electronic control unit that comprise a controller area network identifier for at least one controller area network device, (ii) observing, in the messages, a set of corresponding patterns that each comprise a content pattern and a timing pattern, (v) detecting a message that comprises the controller area network identifier, wherein a content pattern of the message and a timing pattern of the message do not match any pair of corresponding patterns in the set of corresponding patterns, and (vi) determining that the message is suspicious based at least in part on content pattern of the message and the timing pattern of the message not matching any pair of corresponding patterns in the set. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying suspicious controller area network messages

The disclosed computer-implemented method for detecting suspicious microcontroller messages may include (1) observing a typical interval at which messages are sent over a network by a microcontroller, (2) identifying a message sent over the network by the microcontroller, (3) determining that the interval between the message and the previous message sent by the microcontroller does not comprise the typical interval, and (4) categorizing the message as a suspicious message in response to determining that the interval does not comprise the typical interval. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting suspicious microcontroller messages

A system and method for detecting an invalid packet on a Controller Area Network (CAN) bus having a plurality of CAN nodes coupled thereto is provided. The method may include monitoring a CAN identifier (CAN ID) of each packet sent by each CAN node. The method may also include determining whether to detect the validity using a time threshold, historical data, or an acknowledgement (ACK) bit. For example, when the CAN ID is unknown, the method may include the use of validity detection process based upon the ACK Slot bit. Accordingly, the method may include detecting the validity of each packet using the selected method determined. In addition, the method may include storing the detected validity in a database having a listing for valid packets (white list) and a listing for invalid packets (black list). Moreover, the method may include disabling the invalid packets.

System and method for identifying an invalid packet on a controller area network (CAN) bus

Various systems and methods precalculate client-side deduplication signatures. For example, one method can identify a data object to be included in a backup and then calculate a signature of a data object prior to the start of a backup operation to create the backup. The signature identifies the data object within a deduplicated data store configured to store a backup of the data object. The signature can be calculated in response to detecting that a current usage level of system resources (e.g., such as a current processor utilization) of a client computing device is less than a threshold usage level.

Precalculation of signatures for use in client-side deduplication

A computer-implemented method for reclaiming storage space in deduplicating data systems may include (1) storing at least one non-synthesized backup image within a deduplicating data system by storing at least one data segment of the non-synthesized backup image within a container of deduplicated data segments that is used by the deduplicating data system, (2) storing at least one synthesized backup image within the deduplicating data system by referencing at least one previously stored data segment within the container that is also referenced by a previous backup image within the deduplicating data system, (3) determining that no non-synthesized backup images still reference the container, and (4) removing the data segment of the non-synthesized backup image from the container of deduplicated data segments in response to determining that no non-synthesized backup images still reference the container. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for reclaiming storage space in deduplicating data systems

Various automated data flow tracking techniques can involve obtaining metadata identifying the data items from multiple data sources and using that information to identify the relationships among the data items. This information can then be provided to users. For example, a method can involve receiving a query; accessing metadata, which identifies data items generated by multiple data sources; identifying a set of responsive data items from among the available data items; identifying one or more relationships between the data items in the set of responsive data items, and responding to the query with information identifying the set of responsive data items and the one or more relationships.

Automated data flow tracking

A computer-implemented method for leveraging data-deduplication capabilities of file systems may include (1) detecting a backup operation that backs up at least one data segment maintained by a file system capable of performing data deduplication on a computing device, (2) querying the file system for file-system data that includes (i) the data segment to be backed up during the backup operation, (ii) at least one unique identifier that identifies the data segment, and (iii) at least one file-specific segment map that identifies a position of the data segment relative to at least one other data segment within a file, (3) receiving the file-system data from the file system in response to the query, and then (4) providing the file-system data to a deduplication server to facilitate backing up the file based at least in part on the file-system data. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for leveraging data-deduplication capabilities of file systems

A computer-implemented method for accessing multiple data-protection applications from a single interface. The method may include providing, in a portion of a web browser, a graphical toolbar interface for interfacing with a plurality of data-protection applications. The graphical toolbar interface may comprise at least one user input region for receiving input from a user and at least one data-display region for displaying representations of data received from the plurality of data-protection applications. The method may also include receiving, at the user input region, a request directed to at least one data-protection application of the plurality of data-protection applications and sending the request to the at least one data-protection application.

Systems and methods for accessing multiple data-protection applications from a single interface

Techniques for detecting advanced security threats may be realized as a method for detecting a security threat including generating a resource at a client, implementing the resource on the client, monitoring system behavior of the client having the resource implemented thereon, determining whether a security event involving the implemented resource has occurred based on the monitored system behavior, and generating a report when it has been determined that the security event has occurred.

Techniques for managing deduplication of data

A computer-implemented method for preserving deduplication efforts after backup-job failures may include (1) identifying a deduplicated data system that reduces redundant data storage by storing and referencing a plurality of deduplicated data segments and reclaims storage space by deleting unreferenced data segments from the deduplicated data system, (2) identifying a backup job that backs up data to the deduplicated data system, causes the deduplicated data system to store at least one new data segment available to be referenced within the deduplicated data system, and fails after the deduplicated data system stores the new data segment within the deduplicated data system causing the new data segment to be unreferenced within the deduplicated data system, and (3) causing the deduplicated data system to retain the new data segment until the backup job is retried despite the new data segment being unreferenced. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Roseville, MN, United States of America

Vishal Bajpai