Trend Micro Inc.

Yi-Fen Chen

Yung-Chang Liang

Shuosen Robert Liu

Chih-Ming Chen

Andrew S Lee

Handong Wu

En-Yi Liao

Kai Yu

Andrew Kyle Purtell

Raimund Alexander Genes

Alendry Ivan Macalintal

Chenghuai Lu

Said Kaki

Feike Hayo Hacquebord

An endpoint computer in an enterprise network is configured to detect computer security threat events, such as presence of a computer virus. Upon detection of a threat event, the endpoint computer generates computer security threat data for the threat event. The threat data may include user identifiable data that can be used to identify a user in the enterprise network. The endpoint computer encrypts the user identifiable data prior to sending the threat data to a smart protection network or to an enterprise server where threat data from various enterprise networks are collected for analysis. The endpoint computer may also encrypt an identifier for the threat data and provide the encrypted identifier to the smart protection network and to an enterprise server in the enterprise network. The enterprise server may use the encrypted identifier to retrieve the threat data from the smart protection network to generate user-specific reports.

Computer security threat data collection and aggregation with user privacy protection

A machine in the form of a computer is configured to run virtual machines. A virtual machine migrated from another computer is run in the computer. A security profile of the migrated virtual machine in the computer indicates a configuration setting of another network component in another computer network. A network profile in the computer indicates a configuration setting of a network component in the current computer network. The security profile of the migrated virtual machine is automatically updated to reflect the configuration setting of the network component in the current computer network to provide computer security function in the current computer network.

Migration of computer security modules in a virtual machine environment

In one embodiment, a network security appliance includes a logic circuit, a network processing unit, and a general purpose processor to protect a computer network from malicious codes, unauthorized data packets, and other network security threats. The logic circuit may include one or more programmable logic devices configured to scan incoming data packets at different layers of a multi-layer protocol, such as the OSI-seven layer model. The network processing unit may work in conjunction with the logic circuit to perform protocol parsing, to form higher layer data units from the data packets, and other network communications-related tasks. The general purpose processor may execute software for performing functions not available from the logic circuit or the network processing unit. For example, the general purpose processor may remove malicious code from infected data or perform malicious code scanning on data when the logic circuit is not configured to do so.

Method and apparatus for securing a computer network by multi-layer protocol scanning

In one embodiment, an antivirus mechanism (e.g., antivirus program) in a computer initiates shielding procedures in response to a triggering event indicative of a presence of a virus in the computer, the virus being of a type not recognized by the antivirus program. The shielding procedures advantageously protect important components of the computer while the antivirus program does not have the requisite antidote to directly deal with the virus.

System and method for securing computers against computer viruses

A web threat protection system may receive candidate uniform resource locators (URLs) from several URL sources. The candidate URLs may be received in a submission database. At least a portion of the candidate URLs is selected for further investigation by sending crawlers to retrieve objects from the selected URLs. The retrieved objects may be analyzed to determine whether they are malicious or good (i.e., not malicious). The result of the analysis may be used to build a security states database that includes security information of the selected URLs. Good URLs may be included in a safe URL sphere, which may be used to navigate to good websites on the Internet.

Discovering malicious locations in a public computer network

In one embodiment, a technique for controlling traffic in a computer network includes modifying a packet generated by a first computer. The packet may be intended for a second computer, but is modified to be redirected to a third computer. The packet may be processed in the third computer prior to being forwarded from the third computer to the second computer. The packet may be scanned for viruses at the third computer, for example. Among other advantages, the technique allows for scanning of early generated packets, redirection of selected packets, and routing of packets from a computer in general.

Growing community of inventors

Pasadena, CA, United States of America

Yi-Fen Chen