Microsoft Technology Licensing, LLC

Finjan, Inc.

Finjan Software, Ltd.

Yigal Mordechai Edery

David R Kroll

Nimrod Itzhak Vered

Shlomo Touboul

Efim Hudis

Nir Nice

Michael Todd Kramer

Oleg Ananiev

John F Wohlfert

Pradeep Bahl

Mihai Costea

Anil Francis Thomas

Vladimir Holostov

Rajesh K Dadhia

Adrian Mihail Marinescu

Anders Bertil Vinberg

Marc E Seinfeld

John Eugene Neystadt

Dennis Scott Batchelder

David B Cross

Yan Belinky

Shimon Yannay

Nirmrod Itzhak Vered

A system provides for monitoring information received, determining whether received information does or is likely to include executable code, and if so, causes as sandboxed package including the received information and mobile protection code (MPC) to be transferred to a destination device of the received information. At a destination device, the sandboxed package is unbundled such that upon initiating the Downloadable, malicious Downloadable operating attempts are received by the MPC causing (predetermined) corresponding operations to be executed in response to the attempts.

Malicious mobile code runtime monitoring system and methods

Protection systems and methods provide for protecting one or more personal computers ('PCs') and/or other intermittently or persistently network accessible devices or processes from undesirable or otherwise malicious operations of Java TN applets, ActiveX&#x2122; controls, JavaScript&#x2122; scripts, Visual Basic scripts, add-ins, downloaded/uploaded programs or other 'Downloadables' or &#x201c;mobile code&#x201d; in whole or part. A protection engine embodiment provides for monitoring information received, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information. An MPC embodiment further provides, within a Downloadable-destination, for initiating the Downloadable, enabling malicious Downloadable operation attempts to be received by the MPC, and causing (predetermined) corresponding operations to be executed in response to the attempts.

Techniques for aggregating a knowledge base of a plurality of security services or other event collection systems to protect a computer from malware are provided. In embodiments, a computer is protected from malware by using anti-malware services or other event collection systems to observe suspicious events that are potentially indicative of malware. A determination is made as to whether a combination of the suspicious events is indicative of malware. If the combination of suspicious events is indicative of malware, a restrictive security policy designed to prevent the spread of malware is implemented.

Aggregating the knowledge base of computer systems to proactively protect a computer from malware

Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and roaming users. The global SCM service integrates the security functionalities&#x2014;such as anti-virus, spyware, and phishing protection, firewall, intrusion detection, centralized management, and the like&#x2014;that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence ('POPs'). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration components, and coupled to hubs which provide configuration management and identity management services such as active directory services.

Enterprise security assessment sharing for consumers using globally distributed infrastructure

Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and off-premise or roaming users. The global SCM service integrates the security functionalities&#x2014;such as anti-virus, spyware, and phishing protection, firewall, intrusion detection, centralized management, and the like&#x2014;that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence ('POPs'). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration components, and coupled to hubs which provide configuration management and identity management services such as active directory services.

Enterprise security assessment sharing for off-premise users using globally distributed infrastructure

Architecture that provides model-based systems management in virtualized and non-virtualized environments. A security component provides security models which define security requirements for services. A management component applies one or more of the security models during the lifecycle of virtual machines and services. The lifecycle can include initial deployment, expansion, moving servers, monitoring, and reporting. The architecture creates a formal description model of how a virtual machine or a service (composition of multiple virtual machines) is secured. The security requirements information can also be fed back to the general management system which uses this information in its own activities such as to guide the placement of workloads on servers can be security related.

Model based systems management in virtualized and non-virtualized environments

Methods, systems, and computer-readable media are disclosed for selecting a set of security offerings. A particular method includes receiving a security need profile associated with a computing environment and receiving security offering information related to a plurality of security offerings. The security offerings of the plurality of security offerings are evaluated with respect to the security need profile. A set of security offerings from the plurality of security offerings are automatically selected.

Selecting security offerings

In accordance with the present invention, a system, method, and computer-readable medium for aggregating the knowledge base of a plurality of security services or other event collection systems to protect a computer from malware is provided. One aspect of the present invention is a method that proactively protects a computer from malware by using anti-malware services or other event collection systems to observe suspicious events that are potentially indicative of malware; determining if the suspicious events satisfy a predetermined threshold; and if the suspicious events satisfy the predetermined threshold, implementing a restrictive security policy designed to prevent the spread of malware.

Services using globally distributed infrastructure for secure content management

A client device transmits requests via a gateway to a server in a network environment. The requests indicate specific portions of a file on a server to be transmitted as part of the download process. The gateway receives into its memory the requested portions of the file and assembles the received portions into an assembly file. The gateway continuously scans the largest contiguous sequence of the portions in the assembly file for viruses while the requested portions of the file are being received and become available before feeding the received portions to the client computer. By scanning the largest consecutive sequence while new portions become available, the time to complete the scan is reduced thereby increasing the throughput of the gateway.

Anti-virus scanning of partially available content

Protection systems and methods provide for protecting one or more personal computers ('PCs') and/or other intermittently or persistently network accessible devices or processes from undesirable or otherwise malicious operations of Java TN applets, ActiveX&#x2122; controls, JavaScript&#x2122; scripts, Visual Basic scripts, add-ins, downloaded/uploaded programs or other 'Downloadables' or &#x201c;mobile code&#x201d; in whole or part. A protection engine embodiment provides, within a server, firewall or other suitable &#x201c;recommunicator,&#x201d; for monitoring information received by the communicator, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information, more suitably by forming a protection agent including the MPC, protection policies and a detected-Downloadable. An MPC embodiment further provides, within a Downloadable-destination, for initiating the Downloadable, enabling malicious Downloadable operation attempts to be received by the MPC, and causing (predetermined) corresponding operations to be executed in response to the attempts, more suitably in conjunction with protection policies.

In accordance with the present invention, a system, method, and computer-readable medium for identifying malware at a network transit point such as a computer that serves as a gateway to an internal or private network is provided. A network transmission is scanned for malware at a network transit point without introducing additional latency to the transmission of data over the network. In accordance with one aspect of the present invention, a computer-implemented method for identifying malware at a network transit point is provided. More specifically, when a packet in a transmission is received at the network transit point, the packet is immediately forwarded to the target computer. Simultaneously, the packet and other data in the transmission are scanned for malware by an antivirus engine. If malware is identified in the transmission, the target computer is notified that the transmission contains malware.

Latency free scanning of malware at a network transit point

Protection systems and methods provide for protecting one or more personal computers ('PCs') and/or other intermittently or persistently network accessible devices or processes from undesirable or otherwise malicious operations of Java&#x2122; applets, ActiveX&#x2122; controls, JavaScript&#x2122; scripts, Visual Basic scripts, add-ins, downloaded/uploaded programs or other 'Downloadables' or &#x201c;mobile code&#x201d; in whole or part. A protection engine embodiment provides, within a server, firewall or other suitable &#x201c;re-communicator,&#x201d; for monitoring information received by the communicator, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information, more suitably by forming a protection agent including the MPC, protection policies and a detected-Downloadable. An MPC embodiment further provides, within a Downloadable-destination, for initiating the Downloadable, enabling malicious Downloadable operation attempts to be received by the MPC, and causing (predetermined) corresponding operations to be executed in response to the attempts, more suitably in conjunction with protection policies.

Growing community of inventors

Pardesia, Israel

Yigal Mordechai Edery