Sourabh Satish

A computer-implemented method for enabling community-tested security features for legacy applications may include: 1) identifying a plurality of client systems, 2) identifying a legacy application on a client system within the plurality of client systems, 3) identifying a security-feature-enablement rule for the legacy application, 4) enabling at least one security feature for the legacy application by executing the security-feature-enablement rule, 5) determining the impact of the… Show more

A computer-implemented method for enabling community-tested security features for legacy applications may include: 1) identifying a plurality of client systems, 2) identifying a legacy application on a client system within the plurality of client systems, 3) identifying a security-feature-enablement rule for the legacy application, 4) enabling at least one security feature for the legacy application by executing the security-feature-enablement rule, 5) determining the impact of the security-feature-enablement rule on the health of the legacy application, and then 6) relaying the impact of the security-feature-enablement rule on the health of the legacy application to a server. Various other methods, systems, and computer-readable media are also disclosed. Show less

A computer-implemented method for determining the impact of a software change on the health of a computing system or an application installed on the computing system may comprise identifying the software change, performing a first health evaluation, allowing the software change to occur, performing a second health evaluation, and then determining the impact of the new application by comparing the results of the second health evaluation with the results of the first health evaluation. Exemplary… Show more

A computer-implemented method for determining the impact of a software change on the health of a computing system or an application installed on the computing system may comprise identifying the software change, performing a first health evaluation, allowing the software change to occur, performing a second health evaluation, and then determining the impact of the new application by comparing the results of the second health evaluation with the results of the first health evaluation. Exemplary methods for providing guidance on the potential impact of a software change and for determining the health impact of a software change based on information obtained from a plurality of computing systems are also disclosed. Corresponding systems and computer-readable media are also disclosed. Show less

A method and system for protecting identity information comprises determining identity information required by a resource utilized by a user, determining strength of the identity information used by the user to access the resource, and performing an action in view of the strength.

Installer package information is presented to a user in response to an attempted installation of an application on an endpoint. The attempted installation is detected and the installer package is identified to an information server. The installer package may be identified using a hash key or other unique identifier. In response, the information server provides to the endpoint information associated with the identified installer package based on information received from a plurality of other… Show more

Installer package information is presented to a user in response to an attempted installation of an application on an endpoint. The attempted installation is detected and the installer package is identified to an information server. The installer package may be identified using a hash key or other unique identifier. In response, the information server provides to the endpoint information associated with the identified installer package based on information received from a plurality of other endpoints. The endpoint may also provide installation and application information related to the installer package to the information server. In one embodiment, when the information server obtains more than the threshold amount of information for an installer package, the information server may analyze the information and provide the analysis to requesting endpoints. The analysis may include the risk or performance impact of the installer package, or the category or functionality of the application. Show less

A computer-implemented method for looking up anti-malware metadata may include identifying a plurality of executable objects to be scanned for malware before execution. The computer-implemented method may also include, for each executable object within the plurality of executable objects, assessing an imminence of execution of the executable object. The computer-implemented method may further include prioritizing, based on the assessments, a retrieval order for anti-malware metadata… Show more

A computer-implemented method for looking up anti-malware metadata may include identifying a plurality of executable objects to be scanned for malware before execution. The computer-implemented method may also include, for each executable object within the plurality of executable objects, assessing an imminence of execution of the executable object. The computer-implemented method may further include prioritizing, based on the assessments, a retrieval order for anti-malware metadata corresponding to the plurality of executable objects. The computer-implemented method may additionally include retrieving anti-malware metadata corresponding to an executable object within the plurality of executable objects based on the retrieval order. Various other methods, systems, and computer-readable media are also disclosed. Show less

When a program is loaded for execution, all code pages of the program except the one containing the entry point are set to be non-executable. When the executing program attempts to jump between code pages, an exception is thrown. Responsive to such an exception, a control flow graph of the program is examined, to determine if the attempted jump between code pages is expected. If the attempted jump is not expected, it is determined that the program is attempting a malicious activity. If the… Show more

When a program is loaded for execution, all code pages of the program except the one containing the entry point are set to be non-executable. When the executing program attempts to jump between code pages, an exception is thrown. Responsive to such an exception, a control flow graph of the program is examined, to determine if the attempted jump between code pages is expected. If the attempted jump is not expected, it is determined that the program is attempting a malicious activity. If the attempted jump is expected, the code page to which the program is attempting to jump is set to be executable, and control is returned to the program such that the jump executes. Show less

Incoming network traffic is monitored, and content-based files in the monitored incoming network traffic originating from remote sources are identified. When a specific content-based file originating from a remote source is identified, security information concerning that file is gleaned. This security information comprises at least a security reputation of the remote source from which the file originates. An attempt to open the file is identified, and a security risk rating is determined based… Show more

Incoming network traffic is monitored, and content-based files in the monitored incoming network traffic originating from remote sources are identified. When a specific content-based file originating from a remote source is identified, security information concerning that file is gleaned. This security information comprises at least a security reputation of the remote source from which the file originates. An attempt to open the file is identified, and a security risk rating is determined based on the security information concerning the file. In response to the security risk rating exceeding a given threshold, behavior associated with the attempt to open the file is altered. This altering of behavior can comprise, for example, disabling a scripting engine for the instance of the content processing application attempting to open the file, or altering file system and/or operating system resource access privileges. Show less

A computer-implemented method for preventing modification of network resources in the absence of a user's consent is disclosed. The method may comprise: 1) identifying an attempt to modify a network resource, 2) administering a human-verification test, and 3) determining, based on the outcome of the human-verification test, whether to prevent modification of the network resource. In addition, a computer-implemented method for preventing unauthorized communication with network resources may… Show more

A computer-implemented method for preventing modification of network resources in the absence of a user's consent is disclosed. The method may comprise: 1) identifying an attempt to modify a network resource, 2) administering a human-verification test, and 3) determining, based on the outcome of the human-verification test, whether to prevent modification of the network resource. In addition, a computer-implemented method for preventing unauthorized communication with network resources may comprise: 1) identifying a communication attempt between a network resource and an untrusted resource, 2) determining whether communication between the network resource and the untrusted resource is authorized, and 3) determining, based on whether communication between the network resource and the untrusted resource is authorized, whether to allow communication between the network resource and the untrusted resource. Corresponding systems and computer-readable media are also disclosed. Show less

A computer-implemented method for user-specific tuning of classification heuristics may include: 1) identifying a trusted software component on the computing device that has been excluded from analysis by a classification heuristic, 2) applying the classification heuristic to the trusted software component, 3) determining that the classification heuristic incorrectly classified the trusted software component, and then 4) lowering a confidence score associated with the classification heuristic.

A system, method, and computer program product for detecting malware in a software package on a computer having an operating system is disclosed. A software package can include various files and processes. A process monitoring module monitors a process associated with the software package and detects when the monitored process requests access to a system process or other operating system object. A constrained process manager provides a constrained object to the monitored process in response to… Show more

A system, method, and computer program product for detecting malware in a software package on a computer having an operating system is disclosed. A software package can include various files and processes. A process monitoring module monitors a process associated with the software package and detects when the monitored process requests access to a system process or other operating system object. A constrained process manager provides a constrained object to the monitored process in response to the request. The constrained object generally has less access to computer system resources than the system process. A malware detection module then observes interactions between the monitored process and the constrained object and determines whether the monitored process contains malware based on these interactions. Show less

The role of a user within an organization is automatically determined based on the classification of applications and content on the user's computer. Applications and files installed on a user's computer are identified. Identified applications and files that are not indicative of the role of the user within the organization are filtered out. The non-filtered out applications are functionally classified according to associated roles within the organization, based on predetermined functional… Show more

The role of a user within an organization is automatically determined based on the classification of applications and content on the user's computer. Applications and files installed on a user's computer are identified. Identified applications and files that are not indicative of the role of the user within the organization are filtered out. The non-filtered out applications are functionally classified according to associated roles within the organization, based on predetermined functional classification information. The non-filtered out files are also functionally classified, based on predetermined functional classification information concerning types of files associated with specific organizational roles. The content of files that are of types not indicative of the user's organizational role can be analyzed, and these files can be functionally classified based on their content. The functional classifications are used in determining the role of the user. Show less

Techniques for managing search engine results may include, for example, a method for managing search engine results comprising receiving a search engine result and associated summary content, receiving requested content associated with the search engine result, comparing, using a computer processor, the summary content and the received requested content, and performing one or more actions in the event the summary content does not match the received requested content.

A security module on a computing device applies security rules to examine content in a network cache and identify suspicious cache content. Cache content is identified as suspicious according to security rules, such as a rule determining whether the cache content is associated with modified-time set into the future, and a rule determining whether the cache content was created in a low-security environment. The security module may establish an out-of-band connection with the websites from which… Show more

A security module on a computing device applies security rules to examine content in a network cache and identify suspicious cache content. Cache content is identified as suspicious according to security rules, such as a rule determining whether the cache content is associated with modified-time set into the future, and a rule determining whether the cache content was created in a low-security environment. The security module may establish an out-of-band connection with the websites from which the cache content originated through a high security access network to receive responses from the websites, and use the responses to determine whether the cache content is suspicious cache content. Suspicious cache content is removed from the network cache to prevent the suspicious cache content from carrying out malicious activities. Show less

The launch of an installer or uninstaller is detected. A process lineage tree is created representing the detected launched installer/uninstaller process, and all processes launched directly and indirectly thereby. The detected installer/uninstaller process is represented by the root node in the process lineage tree. Launches of child processes by the installer/uninstaller process and by any subsequently launched child processes are detected. The launched child processes are represented by… Show more

The launch of an installer or uninstaller is detected. A process lineage tree is created representing the detected launched installer/uninstaller process, and all processes launched directly and indirectly thereby. The detected installer/uninstaller process is represented by the root node in the process lineage tree. Launches of child processes by the installer/uninstaller process and by any subsequently launched child processes are detected. The launched child processes are represented by child nodes in the tree. As long as the installer/uninstaller process represented by the root node in the tree is running, the processes represented by nodes in tree are exempted from anti-malware analysis. The termination of the installer/uninstaller process is detected, after which the processes represented by nodes in the process lineage tree are no longer exempted from anti-malware analysis. Show less

A request to send a JIT component to a streaming client is received. A network capability rating of the network over which the JIT component is to be sent to the streaming client is determined, and a client capability rating of the streaming client is determined. A transmission language format in which to send the JIT component to the streaming client is determined based on at least the network capability rating and the client capability rating. The JIT component is obtained in the transmission… Show more

A request to send a JIT component to a streaming client is received. A network capability rating of the network over which the JIT component is to be sent to the streaming client is determined, and a client capability rating of the streaming client is determined. A transmission language format in which to send the JIT component to the streaming client is determined based on at least the network capability rating and the client capability rating. The JIT component is obtained in the transmission language format and sent to the streaming client over the network. In some embodiments, a transmission language format is determined for each sub-component of the component based on the network capability rating, the streaming client rating, and a sub-component characteristic rating. Show less

A computer-implemented method for revoking digital signatures may include (1) identifying an executable file signed with a digital signature, (2) determining that the executable file is subject to a revocation check used to determine whether the digital signature has been revoked, (3) classifying the executable file based on at least one attribute of the executable file, (4) determining, based on the classification of the executable file, that the executable file is a member of a revocation… Show more

A computer-implemented method for revoking digital signatures may include (1) identifying an executable file signed with a digital signature, (2) determining that the executable file is subject to a revocation check used to determine whether the digital signature has been revoked, (3) classifying the executable file based on at least one attribute of the executable file, (4) determining, based on the classification of the executable file, that the executable file is a member of a revocation group, wherein a status identifier associated with the revocation group indicates whether any member of the revocation group has a digital signature revocation, (5) determining, based on the status identifier associated with the revocation group, that the digital signature of the executable file has potentially been revoked, and then (6) performing the revocation check on the executable file. Various other methods, systems, and computer-readable media are also disclosed. Show less

Method and apparatus for identifying a web server is described. In some examples, an initial request by a client to an intended web server is identified. A fingerprint for the intended web server is determined responsive to the initial request. A subsequent request by the client to the intended web server is detected. A response to the subsequent request is received from a responding web server. Verification of the responding web server as the intended web server is performed using the… Show more

Method and apparatus for identifying a web server is described. In some examples, an initial request by a client to an intended web server is identified. A fingerprint for the intended web server is determined responsive to the initial request. A subsequent request by the client to the intended web server is detected. A response to the subsequent request is received from a responding web server. Verification of the responding web server as the intended web server is performed using the fingerprint. Show less

A method and apparatus for enabling e-mail routing and filtering based on dynamic identities is presented. In one embodiment, the method includes provisioning a new e-mail address, and notifying an e-mail backend of the provisioned address wherein the provisioned address includes a list of authorized senders.

A computer-implemented method for alternating malware classifiers in an attempt to frustrate brute-force malware testing may include (1) providing a group of heuristic-based classifiers for detecting malware, wherein each classifier within the group differs from all other classifiers within the group but has an accuracy rate that is substantially similar to all other classifiers within the group, (2) including the group of classifiers within a security-software product, and (3) alternating the… Show more

A computer-implemented method for alternating malware classifiers in an attempt to frustrate brute-force malware testing may include (1) providing a group of heuristic-based classifiers for detecting malware, wherein each classifier within the group differs from all other classifiers within the group but has an accuracy rate that is substantially similar to all other classifiers within the group, (2) including the group of classifiers within a security-software product, and (3) alternating the security-software product's use of the classifiers within the group in an attempt to frustrate brute-force malware testing by (a) randomly selecting and activating an initial classifier from within the group and then, upon completion of a select interval, (b) replacing the initial classifier with an additional classifier randomly selected from within the group. Various other methods, systems, and computer-readable media are also disclosed. Show less

An attempted exploit of a vulnerability of an application executed by a computer is detected. The exploit attempts to call an application programming interface (API) and abuse application data through a malicious parameter of the call. The API of the application is hooked and monitored for a call made to the hooked API. A parameter of the call is analyzed to determine whether the parameter has a malicious characteristic indicating an attempt to use data within an address space of the… Show more

An attempted exploit of a vulnerability of an application executed by a computer is detected. The exploit attempts to call an application programming interface (API) and abuse application data through a malicious parameter of the call. The API of the application is hooked and monitored for a call made to the hooked API. A parameter of the call is analyzed to determine whether the parameter has a malicious characteristic indicating an attempt to use data within an address space of the application to execute malicious software. A remediation action is taken responsive to determining that the parameter has a malicious characteristic. Show less

Installation events associated with a software application are received from a plurality of clients. A rate at which the software application was uninstalled on the plurality of clients is determined based on the installation events. A reputation score is generated based on the rate at which the software application was uninstalled on the plurality of clients. A reputation score is generated for the software application responsive to the installation event and the performance data. The… Show more

Installation events associated with a software application are received from a plurality of clients. A rate at which the software application was uninstalled on the plurality of clients is determined based on the installation events. A reputation score is generated based on the rate at which the software application was uninstalled on the plurality of clients. A reputation score is generated for the software application responsive to the installation event and the performance data. The reputation score storied in association with the software application. Show less

A decision tree for classifying computer files is constructed. Computational complexities of a set of candidate attributes are determined. A set of attribute vectors are created for a set of training files with known classification. A node is created to represent the set. A weighted impurity reduction score is calculated for each candidate attribute based on the computational complexity of the attribute. If a stopping criterion is satisfied then the node is set as a leaf node. Otherwise the… Show more

A decision tree for classifying computer files is constructed. Computational complexities of a set of candidate attributes are determined. A set of attribute vectors are created for a set of training files with known classification. A node is created to represent the set. A weighted impurity reduction score is calculated for each candidate attribute based on the computational complexity of the attribute. If a stopping criterion is satisfied then the node is set as a leaf node. Otherwise the node is set as a branch node and the attribute with the highest weighted impurity reduction score is selected as the splitting attribute for the branch node. The set of attribute vectors are split into subsets based on their attribute values of the splitting attribute. The above process is repeated for each subset. The tree is then pruned based on the computational complexities of the splitting attributes. Show less

Secure, continuous, on-demand access to services provided by servers internal to a network is facilitated, while minimizing power consumption and power load spikes. Information concerning operation of the network is monitored, and a profile of the network is maintained. Internal network servers being in reduced power consumption states is tracked. Service requests from clients to internal network servers that are in reduced power consumption states are detected. In response, packets are… Show more

Secure, continuous, on-demand access to services provided by servers internal to a network is facilitated, while minimizing power consumption and power load spikes. Information concerning operation of the network is monitored, and a profile of the network is maintained. Internal network servers being in reduced power consumption states is tracked. Service requests from clients to internal network servers that are in reduced power consumption states are detected. In response, packets are generated to wake servers in reduced power consumption states, without requiring registration or installation of any components on the servers or clients. Frequencies are controlled at which packets are generated to wake servers, thereby minimizing sudden increases in power consumption associated with waking multiple servers. This can comprise waiting for a specific duration of time prior to generating packets, based on server profiles. Show less

Detecting new or modified portions of executable code is disclosed. An indication is received that a prior version of an executable file has been replaced by a new version. A security response is provided if a process associated with the executable file attempts to perform a restricted action and a new or changed portion of code comprising the new version has executed. If no new or changed portion of code has executed, the restricted action is allowed to an extent determined previously for the… Show more

Detecting new or modified portions of executable code is disclosed. An indication is received that a prior version of an executable file has been replaced by a new version. A security response is provided if a process associated with the executable file attempts to perform a restricted action and a new or changed portion of code comprising the new version has executed. If no new or changed portion of code has executed, the restricted action is allowed to an extent determined previously for the prior version of the executable file. Show less

An exemplary method for preventing exploitation of byte sequences that violate compiler-generated instruction alignment may comprise: 1) identifying instantiation of a process, 2) identifying an address space associated with the process, 3) identifying, within the address space associated with the process, at least one control-transfer instruction, 4) determining that at least one byte preceding the control-transfer instruction is capable of resulting in an out-of-alignment instruction, and… Show more

An exemplary method for preventing exploitation of byte sequences that violate compiler-generated instruction alignment may comprise: 1) identifying instantiation of a process, 2) identifying an address space associated with the process, 3) identifying, within the address space associated with the process, at least one control-transfer instruction, 4) determining that at least one byte preceding the control-transfer instruction is capable of resulting in an out-of-alignment instruction, and then 5) preventing the control-transfer instruction from being executed. In one example, the system may prevent the control-transfer instruction from being executed by inserting a hook in place of the intended instruction that executes the intended instruction and then returns control flow back to the instantiated process. Corresponding systems and computer-readable media are also disclosed. Show less

method and apparatus for identifying web attacks is described. In one embodiment, a method of securing a computer comprises generating origin information for a portion of a web page and identifying a modification in the origin information. The identified modification is used to determine an indicia of suspicious behavior at a computer.

A computer-implemented method for prioritizing virtual machine tasks may include receiving a request to perform a first task from a virtual machine. The request may include information relevant to determining a priority of the task. The method may include determining the priority of the task based on the information. The method may further include scheduling the first task based on the priority of the task. The method may include selecting the first task for execution based on the scheduling… Show more

A computer-implemented method for prioritizing virtual machine tasks may include receiving a request to perform a first task from a virtual machine. The request may include information relevant to determining a priority of the task. The method may include determining the priority of the task based on the information. The method may further include scheduling the first task based on the priority of the task. The method may include selecting the first task for execution based on the scheduling. The method may include notifying the virtual machine that the first task has been selected for execution. Various related methods, computer-readable media, and systems are also disclosed. Show less

A security module determines cost characteristics reflecting costs incurred in developing and/or deploying a software application, and determines whether the software application is malicious based at least in part on the cost characteristics. The security module determines (1) cost characteristics reflecting costs associated with an installer tool used to generate an installation package of the software application, (2) cost characteristics reflecting costs associated with a development tool… Show more

A security module determines cost characteristics reflecting costs incurred in developing and/or deploying a software application, and determines whether the software application is malicious based at least in part on the cost characteristics. The security module determines (1) cost characteristics reflecting costs associated with an installer tool used to generate an installation package of the software application, (2) cost characteristics reflecting costs associated with a development tool used to develop the software application, and (3) cost characteristics reflecting costs incurred in deploying the software application. If the cost characteristics indicate that substantial cost was incurred in developing and/or deploying the application, the security module determines that the application is legitimate. Otherwise the security module considers other traits of the application to determine whether it is malicious. Show less

A computer-implemented method for individually managing the power usage of software applications may include: 1) identifying at least one software application installed on a computing device, 2) determining the power usage of the software application, 3) identifying a power-management policy for managing the power usage of the software application independent of the overall power usage of the computing device, and then 4) managing the power usage of the software application independent of the… Show more

A computer-implemented method for individually managing the power usage of software applications may include: 1) identifying at least one software application installed on a computing device, 2) determining the power usage of the software application, 3) identifying a power-management policy for managing the power usage of the software application independent of the overall power usage of the computing device, and then 4) managing the power usage of the software application independent of the overall power usage of the computing device in accordance with the power-management policy. Various other methods, systems, and computer-readable media are also disclosed. Show less

Controlling identity disclosures is disclosed. A difference between a site policy as received at a first time and the site policy as received at a second time is detected through at least partially automated processing. The existence of the difference is indicated before disclosing to a relying party associated with the site policy, at or subsequent to the second time, an identity information.

A host reputation score indicating whether a host connected to the client by a network is malicious is received. An entity on the client that communicates with the host is identified. Whether the entity is a malware threat is determined based at least in part on the host reputation score.

A computer-implemented method for authenticating users may include identifying an image associated with a user for mutual assurance during an authentication process. The computer-implemented method may also include modifying the image based on a prompt message to create a modified image that displays the prompt message. The computer-implemented method may further include determining that user input comprises an expected response to the prompt message. Various other methods, systems, and… Show more

A computer-implemented method for authenticating users may include identifying an image associated with a user for mutual assurance during an authentication process. The computer-implemented method may also include modifying the image based on a prompt message to create a modified image that displays the prompt message. The computer-implemented method may further include determining that user input comprises an expected response to the prompt message. Various other methods, systems, and computer-readable media are also disclosed. Show less

A plurality of fingerprints are created for a file. Each fingerprint is created in response to an instance of activity involving the file. A malware signature associated with the mutating malware is compared to one or more of the plurality of fingerprints. In response to the malware signature matching one of the plurality of fingerprints, determining that the file is infected with mutating malware. Further, in response to determining that the file is infected with mutating malware, transmitting… Show more

A plurality of fingerprints are created for a file. Each fingerprint is created in response to an instance of activity involving the file. A malware signature associated with the mutating malware is compared to one or more of the plurality of fingerprints. In response to the malware signature matching one of the plurality of fingerprints, determining that the file is infected with mutating malware. Further, in response to determining that the file is infected with mutating malware, transmitting to a server multiple fingerprints of the plurality of fingerprints. The server analyzes the multiple fingerprints to determine a pattern of mutation by the mutating malware. The determined pattern of mutation is used by the server to create a signature for detecting mutations of the mutating malware. Show less

A computer-implemented method for detecting rootkits is disclosed. The computer-implemented method may include sending periodic security communications from a privileged-processor-mode region of a computing device. The computer-implemented method may also include identifying at least one of the periodic security communications. The computer-implemented method may further include determining, based on the periodic security communications, whether the privileged-processor-mode region of the… Show more

A computer-implemented method for detecting rootkits is disclosed. The computer-implemented method may include sending periodic security communications from a privileged-processor-mode region of a computing device. The computer-implemented method may also include identifying at least one of the periodic security communications. The computer-implemented method may further include determining, based on the periodic security communications, whether the privileged-processor-mode region of the computing device has been compromised. Various other methods, systems, and computer-readable media are also disclosed. Show less

A method and system for detecting an anomaly relating to resource access comprising logging in to a website using identity information, storing a current login time in an access time database, accessing a last local login time for the resource from the access time database, determining a last resource login time from the resource and comparing the last local login time to the last resource login time, wherein a result of the comparison indicates resource access anomaly.

A method and system for protecting users from accidentally disclosing personal information in an insecure environment. In one embodiment, the method includes monitoring I/O device input data associated with a guest operating system on a virtualization platform. The guest operating system has less privilege than a privileged operating system on the virtualization platform. The method further includes determining whether the I/O device input data corresponds to personal information of a user, and… Show more

A method and system for protecting users from accidentally disclosing personal information in an insecure environment. In one embodiment, the method includes monitoring I/O device input data associated with a guest operating system on a virtualization platform. The guest operating system has less privilege than a privileged operating system on the virtualization platform. The method further includes determining whether the I/O device input data corresponds to personal information of a user, and delaying or blocking the transfer of the I/O device input data to the guest operating system if the I/O device input data corresponds to the personal information of the user. Show less

Various methods and systems for scoring applications are disclosed. One method involves generating a baseline measuring a parameter of a computer system. The parameter is related, directly or indirectly, to the energy consumption of the computer system. The method next involves installing and running an application on the computer system. The previously measured parameter is measured with the application running. Next, a score is calculated for the application based on the two measurements… Show more

Various methods and systems for scoring applications are disclosed. One method involves generating a baseline measuring a parameter of a computer system. The parameter is related, directly or indirectly, to the energy consumption of the computer system. The method next involves installing and running an application on the computer system. The previously measured parameter is measured with the application running. Next, a score is calculated for the application based on the two measurements. This score indicates how green the application is. Show less

A computer-implemented method for defragmenting virtual machine prefetch data. The method may include obtaining prefetch information associated with prefetch data of a virtual machine. The method may also include defragmenting, based on the prefetch information, the prefetch data on physical storage. The prefetch information may include a starting location and length of the prefetch data on a virtual disk. The prefetch information may include a geometry specification of the virtual disk… Show more

A computer-implemented method for defragmenting virtual machine prefetch data. The method may include obtaining prefetch information associated with prefetch data of a virtual machine. The method may also include defragmenting, based on the prefetch information, the prefetch data on physical storage. The prefetch information may include a starting location and length of the prefetch data on a virtual disk. The prefetch information may include a geometry specification of the virtual disk. Defragmenting on physical storage may include placing the prefetch data contiguously on physical storage, placing the prefetch data in a fast-access segment of physical storage, and/or ordering the prefetch data according to the order in which it is accessed at system or application startup. Show less

A computer-implemented method for detecting data-stealing malware may include: 1) detecting an attempt by an untrusted application to access a storage location that is known to be used by a legitimate application when storing potentially sensitive information, 2) determining that the legitimate application is not installed on the computing device, 3) determining that the untrusted application represents a potential security risk, and then 4) performing a security operation on the untrusted… Show more

A computer-implemented method for detecting data-stealing malware may include: 1) detecting an attempt by an untrusted application to access a storage location that is known to be used by a legitimate application when storing potentially sensitive information, 2) determining that the legitimate application is not installed on the computing device, 3) determining that the untrusted application represents a potential security risk, and then 4) performing a security operation on the untrusted application. Corresponding systems and computer-readable instructions embodied on computer-readable media are also disclosed. Show less

A method and apparatus for providing information associated with service providers using a social network is described. In one embodiment, a method of providing indicia of familiarity with the service providers comprises identifying one or more relationships between one or more service providers and a user using a social network associated with the user and generating information regarding the one or more relationships, wherein the information comprises a social distance between the user and… Show more

A method and apparatus for providing information associated with service providers using a social network is described. In one embodiment, a method of providing indicia of familiarity with the service providers comprises identifying one or more relationships between one or more service providers and a user using a social network associated with the user and generating information regarding the one or more relationships, wherein the information comprises a social distance between the user and each service provider of the one or more service providers where the social distance represents an indicia of familiarity between the user and each service provider of the one or more service providers. Show less

A method of facilitating a blind referral comprising producing a referral communication for referring a client computer from a connection with a first server to a second server, wherein the referral communication comprises first server information defining a location of the first server, generating a placeholder for the first server information in the referral communication, and replacing the first server information with the placeholder in communications with the second server during the… Show more

A method of facilitating a blind referral comprising producing a referral communication for referring a client computer from a connection with a first server to a second server, wherein the referral communication comprises first server information defining a location of the first server, generating a placeholder for the first server information in the referral communication, and replacing the first server information with the placeholder in communications with the second server during the referral communication. Show less

Computers are monitored for malware communicating directly with the NIC. The infection of computers with NIC level malware is detected. Operating system level network packet transmission statistics are monitored, as are transmission counters maintained by the NIC. The operating system level transmission statistics are compared to the NIC level transmission counters for a given period of time. If the NIC counters indicate the occurrence of a greater number of transmissions than as is indicated… Show more

Computers are monitored for malware communicating directly with the NIC. The infection of computers with NIC level malware is detected. Operating system level network packet transmission statistics are monitored, as are transmission counters maintained by the NIC. The operating system level transmission statistics are compared to the NIC level transmission counters for a given period of time. If the NIC counters indicate the occurrence of a greater number of transmissions than as is indicated by the operating system level statistics, it is concluded that the computer is infected with NIC level malware. Show less

An agent on a network is preconfigured to automatically respond to neighborhood discovery by sending an advertisement having a spoof IPv6 address. A spoof IPv6 address includes a spoof NIC value that is a value that identifies a network interface card not being used on the network. Thus, upon receipt of the advertisement by the infected host computer system, malicious code on the infected host computer system probes the spoof IPv6 address space defined by a network section value of the spoof… Show more

An agent on a network is preconfigured to automatically respond to neighborhood discovery by sending an advertisement having a spoof IPv6 address. A spoof IPv6 address includes a spoof NIC value that is a value that identifies a network interface card not being used on the network. Thus, upon receipt of the advertisement by the infected host computer system, malicious code on the infected host computer system probes the spoof IPv6 address space defined by a network section value of the spoof IPv6 address, the spoof NIC value, and the range of possible values of the assigned host ID value of the spoof IPv6 address. As there are no interfaces within the spoof IPv6 address space except that associated with the agent, propagation of the malicious code is slowed or defeated and connections are directed to the agent Show less

Computers are monitored for malware communicating directly with the NIC. The infection of computers with NIC level malware is detected. Operating system level network packet transmission statistics are monitored, as are transmission counters maintained by the NIC. The operating system level transmission statistics are compared to the NIC level transmission counters for a given period of time. If the NIC counters indicate the occurrence of a greater number of transmissions than as is indicated… Show more

Computers are monitored for malware communicating directly with the NIC. The infection of computers with NIC level malware is detected. Operating system level network packet transmission statistics are monitored, as are transmission counters maintained by the NIC. The operating system level transmission statistics are compared to the NIC level transmission counters for a given period of time. If the NIC counters indicate the occurrence of a greater number of transmissions than as is indicated by the operating system level statistics, it is concluded that the computer is infected with NIC level malware. Show less

Controlling access to a protected network is disclosed. In some embodiments, one or more events that occur will a host is disconnected from the protected network are logged. The log is provided to one or more devices associated with the protected network when the host requests access to the protected network after a period in which it was not connected. In some embodiments, a network access control or other device or process uses the log to determine whether and/or an extent to which the host… Show more

Controlling access to a protected network is disclosed. In some embodiments, one or more events that occur will a host is disconnected from the protected network are logged. The log is provided to one or more devices associated with the protected network when the host requests access to the protected network after a period in which it was not connected. In some embodiments, a network access control or other device or process uses the log to determine whether and/or an extent to which the host should be permitted to connect to the network. Show less

Methods, systems, and products for detecting phishing attempts through fingerprinting are provided. In an embodiment, there is a computer program product that comprises a computer-readable medium and computer program instructions encoded on the medium for deterring fraud perpetrated through an incoming electronic message containing an address for responding to the incoming electronic message. The instructions are for extracting the address from the incoming electronic message and generating a… Show more

Methods, systems, and products for detecting phishing attempts through fingerprinting are provided. In an embodiment, there is a computer program product that comprises a computer-readable medium and computer program instructions encoded on the medium for deterring fraud perpetrated through an incoming electronic message containing an address for responding to the incoming electronic message. The instructions are for extracting the address from the incoming electronic message and generating a fingerprint based on the extracted address. It is then determined whether the generated fingerprint matches a plurality of stored legitimate fingerprints. When there is a lack of a match, an action is taken to prevent use of the address. Show less

The performance and hence the user experience of just-in-time application streaming is significantly enhanced by predicting which sections of an application are likely to execute next, and transmitting those sections from the server to the endpoint. A control flow graph of the application is created and analyzed against the execution state of the application such that it can be predicated which code pages the application is likely to utilize next. This analysis can be performed on the server… Show more

The performance and hence the user experience of just-in-time application streaming is significantly enhanced by predicting which sections of an application are likely to execute next, and transmitting those sections from the server to the endpoint. A control flow graph of the application is created and analyzed against the execution state of the application such that it can be predicated which code pages the application is likely to utilize next. This analysis can be performed on the server, endpoint or any combination of the two. The predicted code pages are proactively pushed and/or pulled such that the application can continue executing without delay. This significantly enhances the performance of application streaming and network file system technologies, and is especially beneficial for very performance sensitive applications. Show less

A computer has a hypervisor that supervises a virtual machine. The virtual machine includes a guest security module that enforces a security policy on network traffic entering and exiting the virtual machine. Malicious software (malware) uses stealth network communications to avoid the guest security module and attempts to communicate with its home base. A security module within the hypervisor has access to all network communications entering and exiting the computer. The security module… Show more

A computer has a hypervisor that supervises a virtual machine. The virtual machine includes a guest security module that enforces a security policy on network traffic entering and exiting the virtual machine. Malicious software (malware) uses stealth network communications to avoid the guest security module and attempts to communicate with its home base. A security module within the hypervisor has access to all network communications entering and exiting the computer. The security module communicates with the guest security module to identify communications of which the guest security module is aware. The security module analyzes the network communications for the computer to identify a stealth network communication of which the guest security module is unaware. The security module alters the stealth network communication, thereby prevent the malware from communicating with its home base. Show less

A template is received, the template comprising information describing an expected file system state. A discrepancy detection module compares an expected file system state from the template with an actual or requested state of the file system of a computer. If discrepancies between the expected state and the actual or requested file system state are detected, then an action is performed to respond to the discrepancy.

Capturing information associated with a document is disclosed. An indication that a request to print a document is being transmitted is observed in network traffic associated with a printer. At a node other than the printer, data associated with the observed network traffic is processed to determine information associated with the request to print the document.

One or more behavior-based features describing an execution of an application on a client are generated. One or more client-specific features are generated, wherein the client-specific features describe aspects of the client. A malware score is generated based on the behavior-based features and the client-specific features. Whether the application is a malware threat is determined based on the malware score and a result of the determination is stored.

Computer implemented methods, apparati, and computer-readable media for empirically adjusting access to a database (1). An apparatus embodiment comprises: coupled to the database (1), a database discovery module (11) for determining authorized accesses to the database (1); coupled to the database (1), a command monitoring module (12) for monitoring actual accesses to the database (1); and coupled to the database discovery module (11) and to the command monitoring module (12), an analysis module… Show more

Computer implemented methods, apparati, and computer-readable media for empirically adjusting access to a database (1). An apparatus embodiment comprises: coupled to the database (1), a database discovery module (11) for determining authorized accesses to the database (1); coupled to the database (1), a command monitoring module (12) for monitoring actual accesses to the database (1); and coupled to the database discovery module (11) and to the command monitoring module (12), an analysis module (13) for comparing actual accesses with authorized accesses. Show less

A behavioral signature for detecting malware is generated. A computer is used to collect behavior traces of malware in a malware dataset. The behavior traces describe sequential behaviors performed by the malware. The behavior traces are normalized to produce malware behavior sequences. Similar malware behavior sequences are clustered together. The malware behavior sequences in a cluster describe behaviors of a malware family. The cluster is analyzed to identify a behavior subsequence common to… Show more

A behavioral signature for detecting malware is generated. A computer is used to collect behavior traces of malware in a malware dataset. The behavior traces describe sequential behaviors performed by the malware. The behavior traces are normalized to produce malware behavior sequences. Similar malware behavior sequences are clustered together. The malware behavior sequences in a cluster describe behaviors of a malware family. The cluster is analyzed to identify a behavior subsequence common to the cluster's malware family. A behavior signature for the malware family is generated using the behavior subsequence. A trace of new malware is normalized and aligned with an existing cluster, if possible. The behavioral signature for that cluster is generated based on the behavior sequence of the new malware and the other sequences in the cluster. Show less

A decision tree for classifying computer files is constructed. Computational complexities of a set of candidate attributes are determined. A set of attribute vectors are created for a set of training files with known classification. A node is created to represent the set. A weighted impurity reduction score is calculated for each candidate attribute based on the computational complexity of the attribute. If a stopping criterion is satisfied then the node is set as a leaf node. Otherwise the… Show more

A decision tree for classifying computer files is constructed. Computational complexities of a set of candidate attributes are determined. A set of attribute vectors are created for a set of training files with known classification. A node is created to represent the set. A weighted impurity reduction score is calculated for each candidate attribute based on the computational complexity of the attribute. If a stopping criterion is satisfied then the node is set as a leaf node. Otherwise the node is set as a branch node and the attribute with the highest weighted impurity reduction score is selected as the splitting attribute for the branch node. The set of attribute vectors are split into subsets based on their attribute values of the splitting attribute. The above process is repeated for each subset. The tree is then pruned based on the computational complexities of the splitting attributes. Show less

A callback component embedded on a web site determines a current location of the web site. The current location is compared to a known legitimate location of the web site to determine if the web site has been copied to a different host location. Responsive to determining that the web site has been copied to a different location, the callback component alerts a central authority that the web site may be a fraudulent web site set up to launch phishing attacks. If the central authority determines… Show more

A callback component embedded on a web site determines a current location of the web site. The current location is compared to a known legitimate location of the web site to determine if the web site has been copied to a different host location. Responsive to determining that the web site has been copied to a different location, the callback component alerts a central authority that the web site may be a fraudulent web site set up to launch phishing attacks. If the central authority determines that the web site is fraudulent, the central authority alerts appropriate entities to take down the fraudulent web site. The callback component generates a visual component viewable on the web site to deter phishing attackers from removing the callback component when the web site is copied. Show less

A file on a computer system is evaluated against trust criteria to determine whether the file is compatible with the trust criteria. Responsive to the file being incompatible with the trust criteria, the file is assigned to a package. Files assigned to the package are tracked to determine whether the files collectively perform malicious behavior. The package is convicted as malware responsive to the files in the package collectively performing malicious behavior.

A security system monitors the trustworthiness and firewall configurations of a set of clients, where a firewall configuration comprises a set of firewall rules that control access by an application to network communication functionalities of a client. Based on the firewall rules used by other clients and the reputation of those clients, the system determines a set of default firewall rules by selecting one or more rules that are used by the more trustworthy clients. The default firewall rules… Show more

A security system monitors the trustworthiness and firewall configurations of a set of clients, where a firewall configuration comprises a set of firewall rules that control access by an application to network communication functionalities of a client. Based on the firewall rules used by other clients and the reputation of those clients, the system determines a set of default firewall rules by selecting one or more rules that are used by the more trustworthy clients. The default firewall rules are made available to other clients, which may use these default rules. This leverages community knowledge about how much network access to allow for a particular application. Show less

Application profiles for applications stored on the endpoint are defined. An application profile identifies components on the endpoint associated with an application with which the application profile is associated. Applications on the endpoint accessed by a user to perform a task are monitored. A task profile associated with the task is created and stored, the task profile associated with the application profiles for the applications accessed by the user to perform the task.

A DRM server parses a request received from a client for a content identifier and client classification information. The content identifier identifies the requested content and client classification information describes the capabilities of the client. The DRM server determines a policy for the requested content. The policy specifies rules for determining access rights for the content responsive to the capabilities of the client. The DRM server determines access rights for the requested content… Show more

A DRM server parses a request received from a client for a content identifier and client classification information. The content identifier identifies the requested content and client classification information describes the capabilities of the client. The DRM server determines a policy for the requested content. The policy specifies rules for determining access rights for the content responsive to the capabilities of the client. The DRM server determines access rights for the requested content responsive to the capabilities of the client and the policy. The DRM manager then provides the requested content and the determined access rights to the client. Show less

A method for assessing network safety using a computer health metric comprises processing internet resource information, wherein a portion of the internet resource information comprises one or more internet resources that were accessed during a period of network activity associated with an impact on a computer health and analyzing one or more internet resource to determine a candidate internet resource, wherein a candidate internet resource is related to the impact on computer health.

Embodiments in accordance with the invention install a primary security browser extension first in the browser event notification order list and a secondary security browser extension last in the event notification order list. On receipt of a user data event including user confidential data at the primary security browser extension, the user confidential data is obfuscated by the primary security browser extension and the user data event including the obfuscated data is released to a next… Show more

Embodiments in accordance with the invention install a primary security browser extension first in the browser event notification order list and a secondary security browser extension last in the event notification order list. On receipt of a user data event including user confidential data at the primary security browser extension, the user confidential data is obfuscated by the primary security browser extension and the user data event including the obfuscated data is released to a next browser extension in the browser event notification order list. Upon receipt of the user data event at the secondary security browser extension, the obfuscated data is restored with the original user confidential data and the user data event is released for further processing. Show less

Systems and methods for improving the effectiveness of decision trees are disclosed. In one example, an exemplary method for performing such a task may include: 1) receiving, from at least one computing device, a) a sample, b) a classification assigned to the sample by a decision tree employed by the computing device, and c) identification information for a branch configuration that resulted in the classification, 2) determining that the decision tree incorrectly classified the sample, and then… Show more

Systems and methods for improving the effectiveness of decision trees are disclosed. In one example, an exemplary method for performing such a task may include: 1) receiving, from at least one computing device, a) a sample, b) a classification assigned to the sample by a decision tree employed by the computing device, and c) identification information for a branch configuration that resulted in the classification, 2) determining that the decision tree incorrectly classified the sample, and then 3) excluding the offending branch configuration from future decision trees. An exemplary method for dynamically adjusting the confidence of decision-tree classifications based on community-supplied data, along with corresponding systems and computer-readable media, are also described. Show less

Monitoring activity in a network is disclosed, including monitoring a communication associated with a messaging service, observing suspicious activity associated with a host associated with the messaging service, and sending a challenge to the host using the messaging service.

A decision tree for classifying computer files is constructed. A set of training files known to be legitimate or malicious are executed and their runtime behaviors are monitored. When a behavior event is detected for one of the training file at a point in time, a feature vector is generated for that training file. Behavior sequencing and timing information for the training file at that point in time is identified and encoded in the feature vector. Feature vectors for each of the training files… Show more

A decision tree for classifying computer files is constructed. A set of training files known to be legitimate or malicious are executed and their runtime behaviors are monitored. When a behavior event is detected for one of the training file at a point in time, a feature vector is generated for that training file. Behavior sequencing and timing information for the training file at that point in time is identified and encoded in the feature vector. Feature vectors for each of the training files at various points in time are fed into a decision tree induction algorithm to construct a decision tree that takes into account of the sequencing and timing information. Show less