Trend Micro Inc.

Entrust Technologies Limited

William Gerald McGee

Anthony Robert Durie

Blake Stanton Sutherland

Paul C Van Oorschot

Glenn C Langford

Antony Robert Durie

Methods and apparatus for optimizing security configurations of a set of computers are disclosed. A set of local servers, each functioning as a deep-security manager supporting a respective subset of the computers, maintains protection software containing filters and rules for deploying each filter. A local server receives updated protection software from a central server. Each local server interrogates each computer of its subset of computers to acquire computer-characterizing data and applies relevant rules to determine an optimal set of filters for each computer. Each rule adaptively determines required characterizing data elements from each computer for determining an optimal security configuration. A local server updates the security configuration of a computer to suit changes in the operational environment of the computer.

Dynamic provisioning of protection software in a host intrusion prevention system

A distributed and coordinated security system providing intrusion-detection and intrusion-prevention for the virtual machines (VMs) in a virtual server is described. The virtualization platform of the virtual server is enhanced with networking drivers that provide a 'fast path' firewall function for pre-configured guest VMs that already have dedicated deep packet inspection security agents installed. A separate security VM is deployed to provide virtual security agents providing deep packet inspection for non pre-configured guest VMs. The network drivers are then configured to intercept the data traffic of these guest VMs and route it through their corresponding virtual security agents, thus providing a 'slow-path' for intrusion detection and prevention.

System and method for intelligent coordination of host and guest intrusion prevention in virtualized environment

Dynamic provisioning of protection software in a host instrusion prevention system

An intrusion prevention/detection system filter (IPS filter) performance evaluation is provided. The performance evaluation is performed at both the security center and at the customer sites to derive a base confidence score and local confidence scores. Existence of new vulnerability is disclosed and its attributes are used in the generation of new IPS filter or updates. The generated IPS filter is first tested to determine its base confidence score from test confidence attributes prior to deploying it to a customer site. A deep security manager and deep security agent, at the customer site, collect local confidence attributes that are used for determining the local confidence score. The local confidence score and the base confidence score are aggregated to form a global confidence score. The local and global confidence scores are then compared to deployment thresholds to determine whether the IPS filter should be deployed in prevention or detection mode or sent back to the security center for improvement.

Methods and system for determining performance of filters in a computer intrusion prevention detection system

An intrusion-prevention server supporting a set of hosts comprises data filters and an engine which uses a set of encoded rules for assigning data filters to hosts according to metadata characterizing the hosts. Each data filter corresponds to at least one intrusion pattern from among a set of intrusion patterns and the data filters are continuously updated as intrusion patterns change. Metadata acquired from a host varies with a changing state of the host. Acquisition of metadata from each host is streamlined to reduce communications between the server and the hosts and to minimize processing effort for both the server and the hosts.

Host intrusion prevention server

A system and method for controlling program execution for a first-party includes providing application registration data, by a second-party (trusted party), wherein the application registration data contains a plurality of first unique application verification data (i.e., data elements), such as a list of hash values. Each unique application verification data element corresponds to at least one of the plurality of approved executable programs. The unique application verification data element is determined as a uniquely associatable data corresponding to each of corresponding executable programs from the plurality of executable programs. Prior to allowing individual program execution by the first-party, the first-party generates a second unique application verification data element, such as a hash value, of an executable file designated for execution on a processing device and compares the generated hash value to the list of hash values. If a match is found, the program is allowed to execute.

Growing community of inventors

Ottawa, Canada

William Gerald McGee