US 7,178,166 B1Grant
Vulnerability assessment and authentication of a computer by a local scanner
Issue Date:2007-02-13
•18 Claims
•4 Drawing Sheets
Abstract
Providing a user with assurance that a computer is secure based on a vulnerability assessment completed by a browser-compatible scanner operating on the computer. If the scanner finds a vulnerability, the scanner can inform the user that the machine is or may be compromised, or repair the vulnerability. For example, the scanner may be able to repair the vulnerability of the workstation. In the alternative, the scanner can provide the scan results to a network server. If the vulnerability assessment shows that the workstation is compromised, or if the possibility of remote compromise is high, the network server can decline to provide network services to the workstation.
Metadata
Assignee
- Internet Security Systems, Inc.
Inventors
- Patrick Taylor
- Scott Mewett
- Philip C. Brass
- Theodore R. Doty
Application Information
Application Number:US 09/665,018
Filing Date:2000-09-19
Priority Date:2000-09-19
Art Unit:2136
Classifications
IPC:
G06F11/00
Patent Drawings (4 sheets)
Description
Related Application
[0001] The present application is related to U.S. patent application Ser. No. 09/607,375, filed on Jun. 30, 2000, entitled “Method and Apparatus for Network Assessment and Authentication,” which is fully incorporated herein by reference.
Field of the Invention
[0002] The present invention relates to network security for distributed computer systems and, more specifically, to granting computer services based upon a local vulnerability assessment of a computer by a browser-based scanner operating on that computer.
Background of the Invention
[0003] While the open network architecture of the Internet permits a user on a network to have access to information on many different computers, it also provides access to messages generated by a user's computer and to the resources of the user's computer. In fact, there are persons who attempt to use knowledge regarding the operations of the protocol stack and operating systems in an effort to gain access to computers without authorization. These persons are typically called “hackers.” hackers present a significant security risk to any computer coupled to a network where a user for one computer may attempt to gain unauthorized access to resources on another computer of the network. For example, an employee may attempt to gain access to private and confidential employee records on a computer used by the human resources department of an employer.
[0004] The present invention solves the security compromise problem by using services provided by a scanner operable with a Web-enabled browser for the invocation and execution of scans and risk assessment. The invention can accomplish this desirable objective using a browser-based tool to scan the user's workstation for evidence of a security compromise or a vulnerability.
Summary of the Invention
[0005] The disadvantages of the prior art are overcome by the present invention, which can complete a local scan of a workstation upon installation of a browser-based scanner provided to the workstation by a remote server via a distributed computer network. A remote server receives a request for an on-line scanner from a browser operating on a workstation connected to a computer network. In response to receiving the scanner via the network, the browser installs the scanner at the workstation to support the completion of vulnerability assessment scans within the local operating environment of the workstation. Using this local scanner, the browser can perform a scan of the workstation and its operating environment and generate a scan results report for presentation to the user or a system administrator. The browser also can transmit the scan results to the remote server for archival storage and subsequent reporting. In one aspect of the invention, the browser can attempt to address an identified security risk by implementing a repair solution or “fix of the workstation.”
[0006] In view of the foregoing, it will be understood that the present invention can deploy a scanning tool from a remote server to a browser-enabled workstation to support a local assessment of the vulnerability of a workstation coupled to a computer network. This scanning tool can operate within the browser environment to complete a scan of the workstation and to generate workstation credentials. The advantages and implementation of the present invention will be described in more detail below in connection with the detailed description, the drawing set, and the attached claims.
Brief Description of the Drawings
[0007] FIG. 1 is a block diagram illustrating the primary components of a network security system, including a local workstation assessment service on a workstation, in accordance with an exemplary embodiment of the present invention.
[0008] FIG. 2 is a diagram showing interactions between a browser and a Web server in a Web-based security system in accordance with an exemplary embodiment of the present invention.
[0009] FIG. 3 is a diagram illustrating interactions between a browser and a Web server in a Web-based security system using a scanner operating within a browser environment on a workstation in accordance with an alternative exemplary embodiment of the present invention.
Detailed Description of the Exemplary Embodiments
[0010] In environments where computers are shared, users want an assurance that the computer they are accessing is secure, before completion of the log-in operation. For an exemplary embodiment, a local scanner can complete a vulnerability assessment of the workstation and provide the scan results to the user or to a system administrator. If the local scanner finds a vulnerability, a local process can inform the user that the machine is or may be compromised, or repair an identified vulnerability. The local scanner can be implemented as a plug-in or a control for operation with a browser operating on the workstation. For example, the local scanner can be implemented as an ActiveX control maintained at a Web server available for download to a workstation in response to a network request transmitted by a browser operated on the workstation. Once installed, the ActiveX control can operate in tandem with the browser to perform a vulnerability assessment of the workstation and to generate a report identifying the scanned results.
[0011] For another exemplary embodiment, the results of the local host assessment can be provided to a network server prior to the delivery of the requested network service to the workstation. For example, a local scanner operating in tandem with a browser on the workstation can complete a vulnerability assessment of the workstation and supply the scan results to the browser installed on workstation. In turn, the browser can transmit the local scan results to the network server via the computer network for evaluation by the network server. Performing a vulnerability assessment at the local level of the workstation allows a network server to determine whether the workstation is a “trusted” platform from which to accept network service requests. If the vulnerability assessment shows that the computer is compromised, or if the possibility of remote compromise is high, the network server can deny service to the workstation. Optionally, the network server can distribute a vulnerability assessment tool via the computer network to repair the vulnerability of the workstation.
[0012] Turning now to the drawing set, in which like numbers reference like elements, FIG. 1 illustrates a client-invoked vulnerability assessment of a workstation in which the workstation credentials are generated locally at the workstation. In other words, the vulnerability assessment is invoked at the client and the assessment is completed by a local workstation assessment service on the workstation. Workstation credentials typically include information about the current integrity of the workstation and the security posture of the workstation. For example, security posture can include data that indicates the potential for the workstation to be compromised by an unauthorized user or service. As shown in FIG. 1 , an exemplary network security system 100 comprises a workstation 115 operating a local workstation assessment service in a network environment including a distributed computer network 125 and a network server 120. A client application 130 retrieves workstation credentials, typically including workstation integrity information and workstation security posture information, from the local workstation assessment service 135 on the workstation 115. The local workstation assessment service 135 generates the workstation credentials by completing a local vulnerability examination of the workstation 115.
[0013] The client application 130 can present the results of the local scan assessment, namely the workstation credentials, to the user. This allows the user to compare the scan assessment results to a workstation security policy to determine the extent to which the workstation 115 complies with that security policy. In the event that the local workstation assessment service 135 detects a vulnerability, the client application 130 can present to the user the recommended course of action to repair the detected vulnerability. The client application 130 can be implemented by a browser, such as the “INTERNET EXPLORER” browser marketed by Microsoft Corporation, and the local workstation assessment service 135 can be implemented by a scanner plug-in or control for installation at the browser. For example, the local workstation assessment service 135 can be embodied by an ActiveX control available for download from the Web server for use with the browser operating on the workstation 115 to complete local scan operations. The plug-in or control operates in tandem with the browser to complete a scan of the workstation and its environment and to generate scan results.
[0014] The client application 130, which also resides on the workstation 115, can present the local scan results to a network service 140 on the network server 120. The network service 140 can store the local scan results of the server 120 to create an archival record of the vulnerability assessment of the workstation 115. The network service 140 can also decide whether to provide service to the workstation 115 via the network 125 based on workstation credentials, namely the local scan results. Specifically, the network service 140 completes this decision-making process by evaluating the workstation against a workstation security policy. This allows the network service 140 to determine the extent to which the workstation 115 complies with its security policy. The network service 140 typically uses a policy compliance measurement to decide what, if any, service level to be the supplied to the workstation 115. In the alternative, the network service 140 can transmit a vulnerability assessment tool to repair the vulnerability of the workstation 115.
[0015] An exemplary process 200 for a Web-based authentication service relying upon browser-based technology is shown in FIG. 2 . Turning to FIG. 2 , the process 200 is initiated by a browser 205, operating on a workstation coupled to a computer network. The browser 205 issues a request to a network server, such as a Web server 210, via a distributed computer network, such as the Internet or a corporate intranet. Responsive to the request, the Web server 210 transmits a workstation assessment agent, which may be a “JAVA” applet, ActiveX control, browser plug-in, or other Web-based executable content, to the Web browser 205 in response to the request. Once installed at the browser 205, the workstation assessment agent generates workstation credentials based on a local examination of the workstation. For example, if the workstation assessment agent is implemented as a browser plug-in, also described as an authentication plug-in, the plug-in operates within the browser environment to complete a scan of the host computer. The results of this vulnerability scan represent workstation credentials. For the representative example shown in FIG. 2 , the workstation assessment agent is implemented by a browser plug-in 205′.
[0016] The workstation assessment agent, i.e., the browser plug-in 205′, transmits the workstation credentials to the Web server 210 via the computer network. An application on the Web server 210, typically a CGI 215, compares the workstation credentials to a workstation security policy to decide whether the workstation is secure. Service by the Web server 210 is allowed if the CGI 215 determines that the workstation is secure and the Web server 210 authenticates the user. If the CGI 215 decides to continue, and the Web server 210 has not already authenticated the user, the server may begin the user authentication process. There is a benefit to authenticating the user after completing a vulnerability analysis of the workstation—it is more difficult for an intruder to steal a user's credentials if the intrusion is detected and the user authentication process is terminated before the user presents their credentials.
[0017] Table I provides an overview of the primary network service authentication tasks completed for the Web-based operating environment of a workstation assessment agent operating on a workstation and a Web server, as shown in FIG. 2 . The workstation assessment agent completes vulnerability assessment tasks and transmits the assessment results to the Web server. In turn, the Web server determines whether to provide a network service to the workstation based on the assessment results.
[0018]
| TABLE I | |
|---|---|
| 1. | The user of a workstation requests a log-in page from a Web server, |
| typically by clicking a button or link on a Web page to begin the | |
| authentication process. | |
| 2. | A browser, operating at the workstation, loads a log-in page or a host |
| authentication page from the Web server. The host authentication | |
| page typically contains a browser plug-in representing a workstation | |
| assessment agent. | |
| 3. | The browser plug-in performs a host assessment scan of the work- |
| station. | |
| 4. | The browser plug-in sends the scan results from the browser via a |
| secure link to a CGI script on the Web server. | |
| 5. | The CGI script uses the scan results to decide whether to grant |
| the workstation access to a network service at the Web server. | |
| 6. | If the workstation is granted access, the CGI script redirects the |
| browser to the next step in the authentication process, namely user | |
| authentication. If the workstation is denied access, the CGI script | |
| redirects the browser to a page that explains to the user why the | |
| workstation cannot be granted access to the Web server. This page | |
| also describes what the user can do to bring the host into compliance | |
| so that access will be granted. | |
[0019] The exemplary Web-based process shown in FIG. 2 is supported by two separate components: (1) the browser plug-in 205′ that performs the workstation assessment in connection with browser operations; and (2) the CGI script 215, which evaluates the workstation credentials generated by the asessment and determines whether the host satisfies authentication requirements. The browser plug-in and the CGI script are representative embodiments of software routines that operate on the workstation and the Web server, respectively. The workstation assessment service is provided by the browser plug-in and implemented by a variety of different software routines, including a Java applet or an ActiveX control. Likewise, the network service implemented by the CGI script can be implemented by other conventional Web-based executable software programs. Consequently, it will be understood that the present invention is not limited to a particular Web-based implementation, such as the representative exemplary embodiment illustrated in FIG. 2 .
[0020] The workstation assessment agent, implemented as a browser plug-in 205′, has three main functions: host assessment; communication of workstation assessment results; and reporting workstation assessment results. The host assessment is completed to determine whether the workstation is compromised. The browser plug-in 205′ runs a series of checks or exploits, each looking for a particular security risk. Each check generates a scan result, which indicates whether a vulnerability risk is present at the workstation. The browser plug-in 205′ then prepares assessment results for transmission to the Web server.
[0021] The browser plug-in 205′ communicates the assessment results to the CGI script 215 operating on the Web server 210. This communication is preferably completed in a secure manner, between the workstation and the Web server, so that results cannot be intercepted by a third party. The communication also should be secure in such a way as to prevent the transmission of false information to the CGI script 215. This can be accomplished by the use of authentication or encryption technologies
[0022] For example, the communication between the browser plug-in 205′ and the CGI script 215 can be completed by sending an HTTPS GET request with vulnerability assessment results stored as parameters of the GET request. The browser plug-in 205′ can generate a URL that uses HTTPS for confidentiality and contains the scan results as parameters. These parameters can be obfuscated by using shared secret encryption to prevent reverse engineering of the communications channel and to insure transmission only to appropriate servers.
[0023] The CGI script 215 receives scan results from a Web-enabled client and decides, based on the results, whether to continue the authentication process. The script 215 responds to the scan results by redirecting the Web client, i.e., the workstation, to one of two different Web pages based on this decision. If the script 215 decides to allow authentication to continue, it redirects the browser 205 to a page that continues or completes the log-on process. If the script 215 decides to deny access, it redirects the browser 205 to a page that explains that service is denied, why access is denied, and what can be done to obtain access to the requested service.
[0024] The CGI script 215 is preferably capable of receiving encrypted data comprising scan results from the browser plug-in 205′, decrypting the data, and making a decision based on the results. The script 215 can assign a score to each different vulnerability identified by the browser plug-in 205′. When all results are received from the browser plug-in 205′, the script 215 calculates a total score by adding the score assigned to each vulnerability. The total score is then compared by the script 215 against a maximum allowable score. If the total score is less than or equal to the maximum allowable score, authentication is allowed to proceed. If the total score is greater than the maximum allowable score, access by the workstation to the Web server 210 is denied by the script 215.
[0025] The Web-based design illustrated in FIG. 2 requires the server to decide, based on security assessment information from the client, whether or not to grant access, or to possibly grant restricted access to a client workstation. In the alternative, the client can make that decision, given sufficient decision-making information at the workstation or received from the server. For example, a browser operating on a workstation can issue a request for a log-in page to a network server. In response, the network server can transmit the log-in page, an authentication plug-in, and a workstation policy to the workstation via the computer network. The authentication plug-in is installable within the browser and operative to generate workstation security credentials by completing a vulnerability assessment of the workstation to identify security vulnerabilities that would compromise the secure operation of the workstation on the computer network. The workstation security credentials can be compared to the workstation policy on the workstation to determine whether the workstation should be granted access to a software service of the network.
[0026] In many web service contexts, the result of a decision-making process for determining whether to grant access by a client to a network service can be expressed as making a choice between URLs. If the decision comes out one way, the browser points to one URL. If it comes out another way, the browser points to a different URL. This can be accomplished on the server side by instructing the client to submit scan information to the server, and having the server redirect the client to the appropriate URL after making the service access decision.
[0027] In the past, a local host scanning device has typically been implemented as an installable, executable program that uses services provided by the operating system on a workstation for the completion of vulnerability assessment scans. In contrast to the prior art, the present invention operates within the environment of a browser on a workstation to complete vulnerability assessments of the workstation and its operating environment. In an alternative exemplary embodiment, a browser operating on the workstation can request a scanner from a Web server via a computer network. The Web server transmits the scanner to the browser via the computer network for installation at the local workstation, otherwise described as a client computer. The scanner is a browser-based program that can be downloaded from a remote server to a browser-compatible workstation to complete local vulnerability assessments without the use of operating system services. Upon installation at the browser, the scanner can complete vulnerability assessment operations and generate a report describing the scan results. The scan results can be presented to the user or to a system administrator responsible for resources of the computer network coupled to the workstation. The scanner also can attempt to repair an identified security risk. Vulnerability assessments and repair operations are completed within the Web-enabled browser environment.
[0028] Turning now to FIG. 3 , an exemplary browser-enabled operating environment 300 comprises a workstation with a Web-compatible browser 305 and a Web server 310, each coupled to a computer network (not shown), such as the global Internet or a corporate intranet. To initiate installation of a scanner, the browser 305 transmits a request via the computer network to a network server, such as the Web server 310. The Web server 310 typically publishes a Web page that hosts the scanner for download to a requesting workstation. For an exemplary embodiment, the scanner is packaged as an ActiveX control for operation within an ActiveX-compatible browser, such as Microsoft's “INTERNET EXPLORER” browser program. For example, the scanner can comprise an ActiveX control DLL and a data file comprising vulnerability descriptions, both packaged within a .CAB file. Alternative embodiments of the scanner can include a JAVA applet, a browser plug-in, or another Web-based executable tool.
[0029] The browser 305 can download the scanner by accessing an OBJECT tag at the control hosting page published by the Web server 310. The OBJECT tag typically comprises a class identifier (ID) for an ActiveX control and a uniform resource locator (URL) to the online scanner program (.CAB file) containing the ActiveX control. The scanner program typically includes a current version identifier for the ActiveX control. The browser 305 preferably uses the current version of the ActiveX control to support online scan operations within the browser environment of the workstation. If an ActiveX control with the specified class ID has been installed at the workstation, the browser can compare the version number for that ActiveX control to the version number specified by the OBJECT tag. If the version number in the OBJECT tag represents a more recent version of the ActiveX control, then the browser can download the current version of the ActiveX control to deploy the online scanner. If, on the other hand, the version number for the currently installed ActiveX control is the same as or less than the OBJECT tag, then the browser should not download a new copy of the ActiveX control. This functionality is supported by Microsoft's “INTERNET EXPLORER” browser and is used by the exemplary embodiment to operate an online scanner within the browser environment of the workstation based upon the current version of the appropriate ActiveX control.
[0030] In response to the deployment request, the control hosting page at the Web server 310 transmits the online scanner to the browser 305 at the workstation via the computer network. Upon completing the download operation, the browser 305 can use “Authenticode” technology to verify the identity of the publisher of the ActiveX control for the scanner and to query the user whether the scanner should be installed as part of the browser operating on the workstation. As known to those of skill in the art, Authenticode technology comprises a special signing key and the signing of either the ActiveX control or the .CAB file representing the scanner. This signing key must, in turn, be signed by a trusted third party to support a secure installation of the scanner at the browser 305. For example, Verisign can provide a code-signing key to sign the ActiveX control of the scanner program. Upon downloading the scanner, the browser 305 can query the user as to whether the user wishes to download an ActiveX control published by a publisher having an identity verified by Verisign.
[0031] Upon completion of the installation operation, the browser-compatible scanner 305′ can complete vulnerability assessments of the local workstation and its operating environment. The scanner 305′ can generate a report in response to completing vulnerability assessment scan operations. The scanner 305′ typically presents this report to the user or to a system administrator for the computer network coupled to the workstation. For example, the scanner 305′ can display the scan results as a report published in the form of a HYPERTEXT MARKUP LANGUAGE (HTML) page published at the workstation. The scanner also can transmit the results using the HTTP or HTTPS protocol to a remote server, such as the Web server 310, for archival storage and to generate subsequent reports. The scanner 305′ can support this transmission of scan results via the computer network based upon a browser-supplied application programming interface (API).
[0032] For an exemplary embodiment, the scanner 305′ also can attempt to repair security risks identified by the vulnerability assessment report. In the alternative, the scanner can identify a repair solution in the report presented to the user or to the system administrator. It will be understood that an optional scanner operation is the transmission of scan results via the browser 305 to another server connected to the computer network.
[0033] Significantly, the present invention supports the distribution and execution of a vulnerability assessment tool within a browser operating at a workstation coupled to a computer network. Although this online scanner is typically supported by Microsoft's ActiveX control technology, it will be understood that alternative Web technologies can be used to implement the online scanner, including Sun's “JAVA” language or other Web-deployed technologies, such as “JavaScript”, VBSCript, and Macromedia's “Shockwave” technologies. Rather than install a software program for operation with the operating system of a workstation, the present invention can support a vulnerability assessment of the workstation and its operating environment via a Web-enabled browser. This enables the scanner to be installed on a central server for deployment to multiple workstations via a browser operating on each workstation.
[0034] In view of the foregoing, it will be understood that the present invention also provide a Web-based system for completing local scan assessments of a workstation in connection with the operation of a browser running on that workstation. The scanner can be downloaded to the workstation from a Web server and installed as a plug-in or control within the browser environment of the workstation. The scanner can complete a local scan of the workstation and its operating environment and generate workstation assessments results for presentation to the user or delivery to a network server.
[0035] The above-described embodiments are presented as illustrative examples. Although the preferred operating environment for the present invention is a Web-based computing environment, such as the Internet, those skilled in the art that the present invention is operable within other forms of distributed computer networks, such as local area or wide area network. It will be readily appreciated that deviations may be made from the specific embodiments disclosed in this specification without departing from the invention. Accordingly, the scope of this invention is to be determined by the claims below rather than being limited to the specifically described embodiments above.
Claims
What is claimed is:
1. A computer-implemented process for assessing the vulnerability of a workstation to a security compromise, comprising the steps:
issuing a request for a scanner from a browser operating, on the workstation to a network server via a computer network;
transmitting the scanner from the network server to the workstation via the computer network, the scanner installable within the browser and operative to complete a vulnerability assessment of the workstation to identify security vulnerabilities of the workstation that can compromise secure operation of the workstation on the computer network;
completing a repair operation by the scanner to address a security vulnerability identified by the scanner in response to completing the vulnerability assessment of the workstation;
generating workstation credentials derived from the scanner conducting the vulnerability assessment of the workstation, the workstation credentials comprising at least one of information about integrity of the workstation and a security posture of the workstation;
comparing the workstation credentials to a workstation policy;
authenticating a workstation for access to the network server by granting the workstation access to one or more services available on the network server if the workstation credentials derived from the scanner are in compliance with the workstation policy;
if access to the one or more services available on the network server is granted to the workstation because the workstation credentials are in compliance with the workstation policy, issuing a request for credentials associated with a user; receiving credentials associated with a user; and authenticating a user of the workstation for access to the network server after said authenticating the workstation for access to the network server by determining if the user is authorized to access the one or more services available on the network server through evaluating the credentials associated with the user; and
if the workstation credentials do not match the workstation security policy, then denying access to the one or more network services.
2. The computer-implemented process of claim 1 further comprising the step of presenting the workstation credentials to the user of the workstation.
3. The computer-implemented process of claim 1 further comprising the step of transmitting the workstation credentials to the network server via the computer network.
4. The computer-implemented process of claim 1 wherein the scanner comprises a plug-in control operable with the browser and a data file defining security vulnerabilities.
5. The computer-implemented process of claim 1, wherein the step of issuing a request for a scanner comprises the browser issuing a request for a Web page at the network server, the Web page hosting the scanner as a plug-in control available for installation with the browser.
6. A computer-readable medium comprising the computer-implemented process of claim 1.
7. The computer-implemented process of claim 1, further comprising receiving credentials associated with a user from the browser.
8. A computer-implemented process for authenticating a workstation requesting a software service, comprising the steps:
issuing a request for a scanner to a network server from a browser operating on the workstation;
transmitting the scanner and a workstation policy from the network server to the workstation via the computer network, the scanner installable within the browser and operative to generate workstation credentials by completing a vulnerability assessment of the workstation, the workstation credentials comprising at least one of information about integrity of the workstation and a security posture of the workstation;
completing a repair operation by the scanner to address a security vulnerability identified by the scanner in response to completing the vulnerability assessment of the workstation;
comparing the workstation credentials to the workstation policy on the workstation to determine whether the workstation should be granted access to the software service;
authenticating a workstation for access to the software service by granting the workstation access to the software service available on the network server if the workstation credentials derived from the scanner are in compliance with the workstation policy; and
if access to the software service is granted to the workstation because the workstation credentials are in compliance with the workstation policy, authenticating a user of the workstation for access to the software service after said authenticating the workstation for access to the software service by issuing a request for user authentication in order to determine if a user of the workstation is authorized to access the software service available on the network server; and
if the workstation credentials do not match the workstation security policy, then denying access to the software service.
9. The computer-implemented process of claim 8, wherein the step of issuing a request for a scanner comprises the browser issuing a request for a Web page at the network server, the Web page hosting the scanner as a control operable with the browser.
10. A computer-readable medium comprising the process of claim 8.
11. The computer-implemented process of claim 8, further comprising receiving credentials associated with a user from the browser.
12. The computer-implemented process of claim 11, further comprising authenticating the user based on the credentials.
13. A computer-implemented process for authenticating a workstation requesting a network service from a network server via a computer network, comprising the steps:
issuing a request for a scanner to the network server from a browser operating on the workstation;
transmitting the scanner from the network server to the workstation via the computer network, the scanner installable within the browser and operative to generate workstation credentials by completing a vulnerability assessment of the workstation to identify security vulnerabilities that would compromise the secure operation of the workstation on the computer network, the workstation credentials comprising at least one of information about integrity of the workstation and a security posture of the workstation;
completing a repair operation by the scanner to address a security vulnerability identified by the scanner in response to completing the vulnerability assessment of the workstation;
transmitting the workstation security credentials from the scanner to the network server via the computer network;
determining at the network server whether the workstation should be granted access to a network service of the network based on the workstation credentials;
authenticating a workstation for access to the network service by granting the workstation access to the network service if the workstation credentials derived from the scanner are in compliance with the workstation policy; and
if access is granted to the workstation for the network service because the workstation credentials are in compliance with the workstation policy, authenticating a user of the workstation for access to the network service after said authenticating the workstation for access to the network service by issuing a request for information relating to user authentication in order to determine if the user is authorized to access the network service; and
if the workstation credentials do not match the workstation security policy, then denying access to the network service.
14. The computer-implemented process recited by claim 13 wherein the network server comprises a CGI script and the step of determining whether the workstation should be granted access to the network service comprises the CGI script comparing the workstation credentials to a workstation security policy maintained at the network server to determine whether the workstation should be granted access to the network service;
wherein granting the workstation access to the network service comprises directing the browser to the log-in page via the computer network;
if the workstation credentials do not match the workstation security policy, then denying access to the network service and delivering an access denied page to the workstation via the computer network.
15. A computer-readable medium comprising the computer-implemented process of claim 13.
16. The computer-implemented process of claim 13, wherein the step of issuing a request for a scanner comprises the browser issuing a request for a Web page at the network server, the Web page hosting the scanner as a plug-in control available for installation with the browser.
17. The computer-implemented process of claim 13, further comprising receiving credentials associated with a user from the browser.
18. The computer-implemented process of claim 17, further comprising authenticating the user based on the credentials.
Patent Citations (262)
| Patent | Date | Inventor | Cited By |
|---|---|---|---|
| US4223380(A) | 1980-09-01 | Antonaccio et al. | Applicant |
| US4400769(A) | 1983-08-01 | Kaneda et al. | Applicant |
| US4672609(A) | 1987-06-01 | Humphrey et al. | Applicant |
| US4773028(A) | 1988-09-01 | Tallman | Applicant |
| US4819234(A) | 1989-04-01 | Huber | Applicant |
| US4975950(A) | 1990-12-01 | Lentz | Applicant |
| US5032979(A) | 1991-07-01 | Hecht et al. | Applicant |
| US5121345(A) | 1992-06-01 | Lentz | Applicant |
| US5204966(A) | 1993-04-01 | Wittenberg et al. | Applicant |
| US5210704(A) | 1993-05-01 | Husseiny | Applicant |
| US5274824(A) | 1993-12-01 | Howarth | Applicant |
| US5278901(A) | 1994-01-01 | Shieh et al. | Applicant |
| US5309562(A) | 1994-05-01 | Li | Applicant |
| US5311593(A) | 1994-05-01 | Carmi | Applicant |
| US5345595(A) | 1994-09-01 | Johnson et al. | Applicant |
| US5347450(A) | 1994-09-01 | Nugent | Applicant |
| US5353393(A) | 1994-10-01 | Bennett et al. | Applicant |
| US5359659(A) | 1994-10-01 | Rosenthal | Applicant |
| US5371852(A) | 1994-12-01 | Attanasio et al. | Applicant |
| US5398196(A) | 1995-03-01 | Chambers | Applicant |
| US5414833(A) | 1995-05-01 | Hershey et al. | Applicant |
| US5440723(A) | 1995-08-01 | Arnold et al. | Applicant |
| US5452442(A) | 1995-09-01 | Kephart | Applicant |
| US5454074(A) | 1995-09-01 | Hartel et al. | Applicant |
| US5475839(A) | 1995-12-01 | Watson et al. | Applicant |
| US5511184(A) | 1996-04-01 | Lin | Applicant |
| US5515508(A) | 1996-05-01 | Pettus et al. | Applicant |
| US5522026(A) | 1996-05-01 | Records et al. | Applicant |
| US5539659(A) | 1996-07-01 | McKee et al. | Applicant |
| US5557742(A) | 1996-09-01 | Smaha et al. | Applicant |
| US5586260(A) | 1996-12-01 | Hu | Applicant |
| US5590331(A) | 1996-12-01 | Lewis et al. | Applicant |
| US5606668(A) | 1997-02-01 | Shwed | Applicant |
| US5623600(A) | 1997-04-01 | Ji et al. | Applicant |
| US5623601(A) | 1997-04-01 | Vu | Applicant |
| US5630061(A) | 1997-05-01 | Richter et al. | Applicant |
| US5649095(A) | 1997-07-01 | Cozza | Applicant |
| US5649185(A) | 1997-07-01 | Antognini et al. | Applicant |
| US5675711(A) | 1997-10-01 | Kephart et al. | Applicant |
| US5696486(A) | 1997-12-01 | Poliquin et al. | Applicant |
| US5696822(A) | 1997-12-01 | Nachenberg | Applicant |
| US5706210(A) | 1998-01-01 | Kumano et al. | Applicant |
| US5734697(A) | 1998-03-01 | Jabbarnezhad | Applicant |
| US5745692(A) | 1998-04-01 | Lohmann, II et al. | Applicant |
| US5748098(A) | 1998-05-01 | Grace | Applicant |
| US5761504(A) | 1998-06-01 | Corrigan et al. | Applicant |
| US5764887(A) | 1998-06-01 | Kells et al. | Applicant |
| US5764890(A) | 1998-06-01 | Glasser et al. | Applicant |
| US5765030(A) | 1998-06-01 | Nachenberg et al. | Applicant |
| US5774727(A) | 1998-06-01 | Walsh et al. | Applicant |
| US5787177(A) | 1998-07-01 | Leppek | Applicant |
| US5790799(A) | 1998-08-01 | Mogul | Applicant |
| US5796942(A) | 1998-08-01 | Esbensen | Applicant |
| US5798706(A) | 1998-08-01 | Kraemer et al. | Applicant |
| US5812763(A) | 1998-09-01 | Teng | Applicant |
| US5815574(A) | 1998-09-01 | Fortinsky | Applicant |
| US5822517(A) | 1998-10-01 | Dotan | Applicant |
| US5826013(A) | 1998-10-01 | Nachenberg | Applicant |
| US5828833(A) | 1998-10-01 | Belville et al. | Applicant |
| US5832208(A) | 1998-11-01 | Chen et al. | Applicant |
| US5832211(A) | 1998-11-01 | Blakley, III et al. | Applicant |
| US5835726(A) | 1998-11-01 | Shwed et al. | Applicant |
| US5838903(A) | 1998-11-01 | Blakely, III et al. | Applicant |
| US5842002(A) | 1998-11-01 | Schnurer et al. | Applicant |
| US5845067(A) | 1998-12-01 | Porter et al. | Applicant |
| US5848233(A) | 1998-12-01 | Radia et al. | Applicant |
| US5854916(A) | 1998-12-01 | Nachenberg | Applicant |
| US5857191(A) | 1999-01-01 | Blackwell, Jr. et al. | Applicant |
| US5864665(A) | 1999-01-01 | Tran | Applicant |
| US5864803(A) | 1999-01-01 | Nussbaum | Applicant |
| US5872915(A) | 1999-02-01 | Dykes et al. | Examiner |
| US5872978(A) | 1999-02-01 | Hoskins | Applicant |
| US5875296(A) | 1999-02-01 | Shi et al. | Examiner |
| US5878420(A) | 1999-03-01 | de la Salle | Applicant |
| US5881236(A) | 1999-03-01 | Dickey | Applicant |
| US5884033(A) | 1999-03-01 | Duvall et al. | Applicant |
| US5892903(A) | 1999-04-01 | Klaus | Applicant |
| US5899999(A) | 1999-05-01 | De Bonet | Applicant |
| US5907834(A) | 1999-05-01 | Kephart et al. | Applicant |
| US5919257(A) | 1999-07-01 | Trostle | Examiner |
| US5919258(A) | 1999-07-01 | Kayashima et al. | Applicant |
| US5922051(A) | 1999-07-01 | Sidey | Applicant |
| US5925126(A) | 1999-07-01 | Hsieh | Applicant |
| US5931946(A) | 1999-08-01 | Terada et al. | Applicant |
| US5940591(A) | 1999-08-01 | Boyle et al. | Applicant |
| US5950012(A) | 1999-09-01 | Shiell et al. | Applicant |
| US5961644(A) | 1999-10-01 | Kurtzberg et al. | Applicant |
| US5964839(A) | 1999-10-01 | Johnson et al. | Applicant |
| US5964889(A) | 1999-10-01 | Nachenberg | Applicant |
| US5974237(A) | 1999-10-01 | Shurmer et al. | Applicant |
| US5974457(A) | 1999-10-01 | Waclawsky et al. | Applicant |
| US5978917(A) | 1999-11-01 | Chi | Applicant |
| US5983270(A) | 1999-11-01 | Abraham et al. | Applicant |
| US5983348(A) | 1999-11-01 | Ji | Applicant |
| US5983350(A) | 1999-11-01 | Minear et al. | Applicant |
| US5987606(A) | 1999-11-01 | Cirasole et al. | Applicant |
| US5987610(A) | 1999-11-01 | Franczek et al. | Applicant |
| US5987611(A) | 1999-11-01 | Freund | Applicant |
| US5991856(A) | 1999-11-01 | Spilo et al. | Applicant |
| US5991881(A) | 1999-11-01 | Conklin et al. | Applicant |
| US5999711(A) | 1999-12-01 | Misra et al. | Applicant |
| US5999723(A) | 1999-12-01 | Nachenberg | Applicant |
| US6003132(A) | 1999-12-01 | Mann | Applicant |
| US6006016(A) | 1999-12-01 | Faigon et al. | Applicant |
| US6009467(A) | 1999-12-01 | Ratcliff et al. | Applicant |
| US6014645(A) | 2000-01-01 | Cunningham | Applicant |
| US6016553(A) | 2000-01-01 | Schneider et al. | Applicant |
| US6021510(A) | 2000-02-01 | Nachenberg | Applicant |
| US6026442(A) | 2000-02-01 | Lewis et al. | Applicant |
| US6029256(A) | 2000-02-01 | Kouznetsov | Applicant |
| US6035323(A) | 2000-03-01 | Narayen et al. | Applicant |
| US6035423(A) | 2000-03-01 | Hodges et al. | Applicant |
| US6041347(A) | 2000-03-01 | Harsham et al. | Examiner |
| US6052709(A) | 2000-04-01 | Paul | Applicant |
| US6061795(A) | 2000-05-01 | Dircks et al. | Applicant |
| US6067410(A) | 2000-05-01 | Nachenberg | Applicant |
| US6070190(A) | 2000-05-01 | Reps et al. | Applicant |
| US6070244(A) | 2000-05-01 | Orchier et al. | Applicant |
| US6073172(A) | 2000-06-01 | Frailong et al. | Applicant |
| US6081894(A) | 2000-06-01 | Mann | Applicant |
| US6085224(A) | 2000-07-01 | Wagner | Applicant |
| US6088803(A) | 2000-07-01 | Tso et al. | Applicant |
| US6088804(A) | 2000-07-01 | Hill et al. | Examiner |
| US6092194(A) | 2000-07-01 | Touboul | Applicant |
| US6094731(A) | 2000-07-01 | Waldin et al. | Applicant |
| US6098173(A) | 2000-08-01 | Elgressy et al. | Applicant |
| US6104783(A) | 2000-08-01 | DeFino | Applicant |
| US6108799(A) | 2000-08-01 | Boulay et al. | Applicant |
| US6118940(A) | 2000-09-01 | Alexander, III et al. | Applicant |
| US6119165(A) | 2000-09-01 | Li et al. | Applicant |
| US6119234(A) | 2000-09-01 | Aziz et al. | Applicant |
| US6122738(A) | 2000-09-01 | Millard | Applicant |
| US6144961(A) | 2000-11-01 | de la Salle | Applicant |
| US6154844(A) | 2000-11-01 | Touboul et al. | Applicant |
| US6161109(A) | 2000-12-01 | Matamoros et al. | Applicant |
| US6167520(A) | 2000-12-01 | Touboul | Applicant |
| US6173413(B1) | 2001-01-01 | Slaughter et al. | Applicant |
| US6185689(B1) | 2001-02-01 | Todd, Sr. et al. | Applicant |
| US6195687(B1) | 2001-02-01 | Greaves et al. | Applicant |
| US6199181(B1) | 2001-03-01 | Rechef et al. | Applicant |
| US6205552(B1) | 2001-03-01 | Fudge | Applicant |
| US6226372(B1) | 2001-05-01 | Beebe et al. | Applicant |
| US6230288(B1) | 2001-05-01 | Kuo et al. | Applicant |
| US6266773(B1) | 2001-07-01 | Kisor et al. | Applicant |
| US6266774(B1) | 2001-07-01 | Sampath et al. | Applicant |
| US6271840(B1) | 2001-08-01 | Finseth et al. | Applicant |
| US6272641(B1) | 2001-08-01 | Ji | Applicant |
| US6275938(B1) | 2001-08-01 | Bond et al. | Examiner |
| US6275942(B1) | 2001-08-01 | Bernhard et al. | Applicant |
| US6278886(B1) | 2001-08-01 | Hwang | Applicant |
| US6279113(B1) | 2001-08-01 | Vaidya | Applicant |
| US6282546(B1) | 2001-08-01 | Gleichauf et al. | Applicant |
| US6298445(B1) | 2001-10-01 | Shostack et al. | Examiner |
| US6301668(B1) | 2001-10-01 | Gleichauf et al. | Examiner |
| US6314520(B1) | 2001-11-01 | Schell et al. | Applicant |
| US6314525(B1) | 2001-11-01 | Mahalingham et al. | Applicant |
| US6321338(B1) | 2001-11-01 | Porras et al. | Applicant |
| US6324627(B1) | 2001-11-01 | Kricheff et al. | Applicant |
| US6324647(B1) | 2001-11-01 | Bowman-Amuah | Applicant |
| US6324656(B1) | 2001-11-01 | Gleichauf et al. | Applicant |
| US6338141(B1) | 2002-01-01 | Wells | Applicant |
| US6347374(B1) | 2002-02-01 | Drake et al. | Applicant |
| US6353385(B1) | 2002-03-01 | Molini et al. | Applicant |
| US6357008(B1) | 2002-03-01 | Nachenberg | Applicant |
| US6377994(B1) | 2002-04-01 | Ault et al. | Applicant |
| US6396845(B1) | 2002-05-01 | Sugita | Applicant |
| US6397242(B1) | 2002-05-01 | Devine et al. | Applicant |
| US6397245(B1) | 2002-05-01 | Johnson et al. | Examiner |
| US6405318(B1) | 2002-06-01 | Rowland | Applicant |
| US6405364(B1) | 2002-06-01 | Bowman-Amuah | Applicant |
| US6408391(B1) | 2002-06-01 | Huff et al. | Applicant |
| US6415321(B1) | 2002-07-01 | Gleichauf et al. | Applicant |
| US6418472(B1) | 2002-07-01 | Mi et al. | Examiner |
| US6429952(B1) | 2002-08-01 | Olbricht | Examiner |
| US6434615(B1) | 2002-08-01 | Dinh et al. | Examiner |
| US6438600(B1) | 2002-08-01 | Greenfield et al. | Examiner |
| US6445822(B1) | 2002-09-01 | Crill et al. | Applicant |
| US6453345(B2) | 2002-09-01 | Trcka et al. | Applicant |
| US6453346(B1) | 2002-09-01 | Garg et al. | Applicant |
| US6460141(B1) | 2002-10-01 | Olden | Applicant |
| US6463426(B1) | 2002-10-01 | Lipson et al. | Applicant |
| US6470449(B1) | 2002-10-01 | Blandford | Applicant |
| US6477585(B1) | 2002-11-01 | Cohen et al. | Applicant |
| US6477648(B1) | 2002-11-01 | Schell et al. | Applicant |
| US6477651(B1) | 2002-11-01 | Teal | Applicant |
| US6484203(B1) | 2002-11-01 | Porras et al. | Applicant |
| US6487666(B1) | 2002-11-01 | Shanklin et al. | Applicant |
| US6496858(B1) | 2002-12-01 | Frailong et al. | Applicant |
| US6499107(B1) | 2002-12-01 | Gleichauf et al. | Applicant |
| US6510523(B1) | 2003-01-01 | Perlman et al. | Applicant |
| US6517587(B2) | 2003-02-01 | Satyavolu et al. | Applicant |
| US6519647(B1) | 2003-02-01 | Howard et al. | Applicant |
| US6519703(B1) | 2003-02-01 | Joyce | Applicant |
| US6530024(B1) | 2003-03-01 | Proctor | Applicant |
| US6535227(B1) | 2003-03-01 | Fox et al. | Applicant |
| US6546493(B1) | 2003-04-01 | Magdych et al. | Applicant |
| US6563959(B1) | 2003-05-01 | Troyanker | Applicant |
| US6574737(B1) | 2003-06-01 | Kingsford et al. | Applicant |
| US6578147(B1) | 2003-06-01 | Shanklin et al. | Applicant |
| US6584454(B1) | 2003-06-01 | Hummel et al. | Examiner |
| US6601190(B1) | 2003-07-01 | Meyer et al. | Applicant |
| US6606744(B1) | 2003-08-01 | Mikurak | Applicant |
| US6618501(B1) | 2003-09-01 | Osawa et al. | Applicant |
| US6628824(B1) | 2003-09-01 | Belanger | Applicant |
| US6647139(B1) | 2003-11-01 | Kunii et al. | Applicant |
| US6647400(B1) | 2003-11-01 | Moran | Applicant |
| US6661904(B1) | 2003-12-01 | Sasich et al. | Applicant |
| US6668082(B1) | 2003-12-01 | Davison et al. | Applicant |
| US6668084(B1) | 2003-12-01 | Minami | Applicant |
| US6681331(B1) | 2004-01-01 | Munson et al. | Applicant |
| US6691232(B1) | 2004-02-01 | Wood et al. | Applicant |
| US6704874(B1) | 2004-03-01 | Porras et al. | Applicant |
| US6708212(B2) | 2004-03-01 | Porras et al. | Applicant |
| US6711127(B1) | 2004-03-01 | Gorman et al. | Applicant |
| US6711615(B2) | 2004-03-01 | Porras et al. | Applicant |
| US6718383(B1) | 2004-04-01 | Hebert | Applicant |
| US6721806(B2) | 2004-04-01 | Boyd et al. | Applicant |
| US6725377(B1) | 2004-04-01 | Kouznetsov | Applicant |
| US6725378(B1) | 2004-04-01 | Schuba et al. | Applicant |
| US6775780(B1) | 2004-08-01 | Muttik | Applicant |
| US6792144(B1) | 2004-09-01 | Yan et al. | Applicant |
| US6792546(B1) | 2004-09-01 | Shanklin et al. | Applicant |
| US6816973(B1) | 2004-11-01 | Gleichauf et al. | Applicant |
| US6829711(B1) | 2004-12-01 | Kwok et al. | Examiner |
| US6839850(B1) | 2005-01-01 | Campbell et al. | Applicant |
| US6850915(B1) | 2005-02-01 | Wiehler | Examiner |
| US2001/0034847(A1) | 2001-10-01 | Gaul, Jr. | Examiner |
| US2002/0032717(A1) | 2002-03-01 | Malan et al. | Applicant |
| US2002/0032793(A1) | 2002-03-01 | Malan et al. | Applicant |
| US2002/0032880(A1) | 2002-03-01 | Poletto et al. | Applicant |
| US2002/0035698(A1) | 2002-03-01 | Malan et al. | Applicant |
| US2002/0083331(A1) | 2002-06-01 | Krumel | Applicant |
| US2002/0083334(A1) | 2002-06-01 | Rogers et al. | Applicant |
| US2002/0138753(A1) | 2002-09-01 | Munson | Applicant |
| US2002/0144156(A1) | 2002-10-01 | Copeland, III | Applicant |
| US2003/0037136(A1) | 2003-02-01 | Labovitz et al. | Applicant |
| US2003/0088791(A1) | 2003-05-01 | Porras et al. | Applicant |
| US2003/0212903(A1) | 2003-11-01 | Porras et al. | Applicant |
| US2004/0010718(A1) | 2004-01-01 | Porras et al. | Applicant |
| EP636977 | 2001-05-01 | Applicant | |
| EP985995 | 2003-08-01 | Applicant | |
| WO93/25024 | 1993-12-01 | Applicant | |
| WO98/41919 | 1998-09-01 | Applicant | |
| WO99/00720 | 1999-01-01 | Applicant | |
| WO99/13427 | 1999-03-01 | Applicant | |
| WO99/15966 | 1999-04-01 | Applicant | |
| WO99/50734 | 1999-10-01 | Applicant | |
| WO99/53391 | 1999-10-01 | Applicant | |
| WO99/57626 | 1999-11-01 | Applicant | |
| WO/02115 | 2000-01-01 | Applicant | |
| WO/10278 | 2000-02-01 | Applicant | |
| WO/25214 | 2000-05-01 | Applicant | |
| WO/25527 | 2000-05-01 | Applicant | |
| WO/34867 | 2000-06-01 | Applicant | |
| WO/054458 | 2000-09-01 | Applicant | |
| WO/54458 | 2000-09-01 | Applicant | |
| WO1/084285 | 2001-11-01 | Applicant | |
| WO1/84285 | 2001-11-01 | Applicant | |
| WO2/06928 | 2002-01-01 | Applicant | |
| WO2/006928 | 2002-01-01 | Applicant | |
| WO2/056152 | 2002-07-01 | Applicant | |
| WO2/101516 | 2002-12-01 | Applicant |
Non-Patent Literature (337)
- Gary McGraw, Edward Felten, “Secure Computing with Java: Now and the Future”, 1997, “http://java.sun.com/security/javaone97-whitepaper.html”; pp. 1-20.Examiner
- Essex, David, E-Sleuths Make Net Safe for E-Commerce, Computerworld, Jun. 2000, pp. 1-2.Applicant
- Newman, David, Intrusion Detection Systems, Data Communications, 1998, pp. 1-9.Applicant
- International Search Report for PCT/US02/17161 of Dec. 31, 2002.Applicant
- Hyland, et al., Concentric Supervision of Security Applications: A New Security Management Paradigm Computer Security Applications Conference, 1998, pp. 59-68.Applicant
- Koilpillai et al., Recon-A Tool for Incident Detection, Tracking and Response, Darpa Information Survivability Conference and Exposition, 2000, pp. 199-206.Applicant
- Alves-Foss, J., An Overview of SNIF: A Tool for Surveying Network Information Flow, Network and Distributed System Security, 1995, pp. 94-101.Applicant
- Mansouri-Samani et al., A Configurable Event Service for Distributed Systems Configurable Distributed Systems, 1996, pp. 210-217.Applicant
- International Search Report for PCT/US01/13769 of Mar. 8, 2002.Applicant
- Jagannathan et al., System Design Document: Next-Generation Intrusion Detection Expert Systems (NIDES), Internet Citation, Mar. 9, 1993, XP002136082, pp. 1-66.Applicant
- Koilpillai, Adaptive Network Security Management, DARPA NGI PI Conference, Oct. 1998, pp. 1-27.Applicant
- Hiverworld Continuous Adaptive Risk Management, Hiverworld, Inc., 1999-2000, pp. 1-14.Applicant
- International Search Report for PCT/US02/04989of Sep. 19, 2002.Applicant
- International Search Report for PCT/US02/02917 of Aug. 8, 2002.Applicant
- International Search Report for PCT/US03/00155 of May 15, 2003.Applicant
- NXI Communications, Inc., White Paper, NTS Security Issues, Oct. 15, 2001, pp .1-12.Applicant
- Mounji et al., Distributed Audit Trail Analysis, Proceedings of the Symposium of Network and Distributed System Security, San Diego, CA, Feb. 16-17, 1995, pp. 102-112.Applicant
- Wobber et al., Authentication in the Taos Operating System, ACM Transactions on Computer Systems, vol. 12, No. 1, Feb. 1994, pp. 3-32.Applicant
- Mayer et al., The Design of the Trusted Workstation: A True Infosec Product, 13th National Computer Security Conference, Washing, DC, Oct. 1-4, 1990, pp. 827-839.Applicant
- Dawson, Intrusion Protection for Networks, Byte, Apr. 1995, pp. 171-172.Applicant
- Bukhan, Checkpoint Charlie, PC Week Network, Nov. 27, 1995, pp. N1, N6-N7.Applicant
- Process Software Technical Support Page, found on http://www.process.com/techsupport/whitesec.html, printed off of the Process Software website on Feb. 26, 2003, pp. 1-5.Applicant
- Ganesan, BAfirewall: A Modern Firewall Design, Proceedings Internet Society Symposium on Network and Distributed System Security 1994, Internet Soc., 1994, pp. 99-108.Applicant
- Lee, Trusted Systems, Chapter II-1-6 of Handbook of Information Security Management, Ed. Zella G. Ruthberg and Harold F. Tipton, Auerbach, Boston and New York, 1993, pp. 345-362.Applicant
- Lunt, Automated Intrusion Detection, Chapter II-4-4 of Handbook of Information Security Management, Ed. Zella G. Ruthberg and Harold F. Tipton, Auerbach, Boston and New York, 1993, pp. 551-563.Applicant
- Guha et al., Network Security via Reverse Engineering of TCP Code: Vulnerability Analysis and Proposed Solution, IEEE, Mar. 1996, pp. 603-610.Applicant
- Garg et al., High Level Commnunication Primitives for Concurrent Systems, IEEE, 1988, pp. 92-99.Applicant
- Hastings et al., TCP/IP Spoofing Fundamentals, IEEE, May 1996, pp. 218-224.Applicant
- Snapp, Signature Analysis and Communication Issues in a Distributed Intrusion Detection System, Master Thesis, University of California, Davis, California, 1991, pp. 1-40.Applicant
- Guha et al., Network Security via Reverse Engineering of TCP Code: Vulnerability Analysis and Proposed Solutions, IEEE, Jul. 1997, pp. 40-48.Applicant
- Djahandari et al., An MBone for an Application Gateway Firewall, IEEE, Nov. 1997, pp. 72-81.Applicant
- Kim et al., Implementing a Secure Login Environment: A Case Study of Using a Secure Network Layer Protocol, Department of Computer Science, University of Alabama, Jun. 1995, pp. 1-9.Applicant
- Satyanarayanan, Integrating Security in a Large Distributed System, Acm Transaction on Computer Systems, vol. 7, No. 3, Aug. 1989, pp. 47-280.Applicant
- Sammons, Nathaniel, “Multi-platform Interrogation and Reporting with Rscan,” The Ninth Systems Administration Conference, LISA 1995, Monterrey, California, Sep. 17-22, 1995, pp. 75-87.Applicant
- Dean et al., “Java Security: From HotJava to Netscape and Beyond,” Proceedings of the 1996 IEEE Symposium on Security and Privacy, May 6-8, 1996, Oakland, California, pp. 190-200.Applicant
- Fisch et al., “The Design of an Audit Trail Analysis Tool,” Proceedings of the 10th Annual Computer Security Applications Conference, Dec. 5-9, 1994, Orlando, Florida, pp. 126-132.Applicant
- Safford et al., “The TAMU Security Package: An Ongoing Response to Internet Intruders in an Academic Environment,” USENIX Symposium Proceedings, UNIX Security IV, Oct. 4-6, 1993, Santa Clara, California, pp. 91-118.Applicant
- Sugawara, Toshiharu, “A Cooperative LAN Diagnostic and Observation Expert System,” Ninth Annual Phoenix Conference on Computers and Communications, 1990 Conference Proceedings, Mar. 21-23, 1990, Scottsdale, Arizona, pp. 667-674.Applicant
- Casella, Karen A., “Security Administration in an Open Networking Environment,” The Ninth Systems Administration Conference, LISA 1995, Monterrey, California, Sep. 17-22, 1995, pp. 67-73.Applicant
- Burchell, Jonathan, “Vi-SPY: Universal NIM?” Virus Bulletin, Jan. 1995, pp. 20-22.Applicant
- Benzel et al., “Identification of Subjects and Objects in a Trusted Extensible Client Server Architecture,” 18th National Information Systems Security Conference, Oct. 10-13, 1995, Baltimore, Maryland, pp. 83-99.Applicant
- Epstein et al., “Component Architectures for Trusted Netware,” 18th National Information Systems Security Conference, Oct. 10-13, 1995, Baltimore, Maryland, pp. 455-463.Applicant
- Varadharajan, Vijay, “Design and Management of a Secure Networked Administration System: A Practical Approach,” 19th National Information Systems Security Conference, Oct. 22-25, 1996, Baltimore, Maryland, pp. 570-580.Applicant
- Snapp et al., “DIDS (Distributed Intrusion Detection System)—Motivation, Architecture, and An Early Prototype,” 14th National Computer Security Conference, Oct. 1-4, 1991, Washington, DC, pp. 167-176.Applicant
- Broner et al., “IntelligentI/O Rule-Based Input/Output Processing for Operating Systems,” Operating Systems Review, vol. 25, No. 3, Jul. 1991, pp. 10-26.Applicant
- Drews et al., “Special Delivery—Automatic Software Distribution Can Make You A Hero,” Network Computing, Aug. 1, 1994, pp. 80, 82-86, 89, 91-95.Applicant
- Morrissey, Peter, “Walls,” Network Computing, Feb. 15, 1996, pp. 55-59, 65-67.Applicant
- Harlander, Dr. Magnus, “Central System Administration in a Heterogenous Unix Environment: GeNUAdmin,” Proceedings of the Eighth Systems Administration Conference (LISA VIII), Sep. 19-23, 1994, San Diego, California, pp. 1-8.Applicant
- Shaddock et al., “How to Upgrade 1500 Workstations on Saturday, and Still Have Time to Mow the Yard on Sunday,” The Ninth Systems Administration Conference LISA '95, Sep. 17-22, 1995, Monterrey, California, pp. 59-65.Applicant
- Anderson, Paul, “Towards a High-Level Machine-Configuration System,” Proceedings of the Eighth Systems Administration Conference (LISA VIII), Sep. 19-23, 1994, San Diego, California, pp. 19-26.Applicant
- Cooper, Michael A., “Overhauling Rdist for the '90s,” Proceedings of the Sixth Systems Administration Conference (LISA VI), Oct. 19-23, 1992, Long Beach, California, pp. 175-188.Applicant
- Vangala et al., “Software Distribution and Management in a Networked Environment,” Proceedings of the Sixth Systems Administration Conference, Oct. 19-23, 1992, Long Beach, California, pp. 163-170.Applicant
- Kim et al., “The Design and Implementation of Tripwire: A File System Integrity Checker,” 2nd ACM Conference on Computer and Communications Security, Nov. 2-4, 1994, Fairfax, Virginia, pp. 18-29.Applicant
- Winn Schwartau, “e.Security™-Solving ‘Dumb Days’ With Security Visualization,” e-Security, Inc., Naples, FL 34103, 2000.Applicant
- Anita D'Amico, Ph.D., “Assessment of Open e-Security Platform™: Vendor-Independent Central Management of Computer Security Resources,” Applied Visions, Inc., 1999.Applicant
- “e.Security™-Open Enterprise Security Management: Delivering an integrated, automated, centrally Managed Solution You Can Leverage Today and Tomorrow,” e-Security, Inc., Naples, FL 34102, 1999.Applicant
- “e.Security ™-Vision,” e-Security, Inc., Naples, FL, 1999.Applicant
- “e.Security™ -Administrator Workbench™,” e-Security, Inc. Naples, FL, 1999.Applicant
- “e.Security™-Fact Sheet,” e-Security, Inc., Naples, FL, 1999.Applicant
- “e.Security™-Open e-Security Platform™,” e-Security, Inc. Naples, FL,1999.Applicant
- Babcock, “E-Security Tackles The Enterprise,” Jul. 28, 1999; Inter@ctive Week, www.Zdnet.com.Applicant
- Kay Blough, “In Search of More-Secure Extranets,” Nov. 1, 1999, www.InformationWeek.com.Applicant
- Paul H. Desmond, “Making Sense of Your Security Tools,” Software Magazine and Wiesner Publishing, www.softwaremag.com, 1999.Applicant
- Kay Blough, “Extra Steps Can Protect Extranets,” Nov. 1, 1999, www. InformationWeek.com.Applicant
- Sean Hao, “Software protects e-commerce—e-security's product alerts networks when hackers attack,” Florida Today, Florida.Applicant
- Scott Weiss, “Security Strategies—E-Security, Inc.,” product brief, Hurwitz Group, Inc., Mar. 24, 2000.Applicant
- Sean Adee, CISA, “Managed Risk, Enhanced Response -The Positive Impact of Real-Time Security Awareness,” Information Systems Control Journal, vol. 2, 2000.Applicant
- “Reprint Review—The Information Security Portal—Open e-Security Platform Version 1.0”, Feb. 2000, West Cost Publishing, SC Magazine, 1999.Applicant
- “e.Security—Introducing the First Integrated, Automated, and Centralized Enterprise Security Management System,” white paper, e-Security, Inc., Naples, FL 34102, 1999.Applicant
- Ann Harrison, “Computerworld—Integrated Security Helps Zap Bugs,” Feb. 21, 2000, Computerworld, vol. 34, No. 8, Framingham, MA.Applicant
- Shruti Daté, “Justice Department Will Centrally Monitor Its Systems For Intrusions,” Apr. 3, 2000, Post-Newsweek Business Information, Inc., www.gcn.com.Applicant
- e.Security™, website pages (pp. 1-83), www.esecurityinc.com, e-Security, Inc., Naples FL 34103, Sep. 14, 2000.Applicant
- Peter Sommer, “Intrusion Detection Systems as Evidence,” Computer Security Research Centre, United Kingdom.Applicant
- Musman et al., System or Security Managers Adaptive Response Tool, DARPA Information Survivability Conference and Exposition, Jan. 25, 2000, pp. 56-68.Applicant
- Gibson Research Corporation Web Pages, Shields Up!—Internet Connection Security Analysis, grc.com/default.htm, Laguna Hills, California, 2000.Applicant
- Rouse et al., Design and Evaluation of an Onboard Computer-Based Information System fro Aircraft, IEEE Transactions of Systems, Man, and Cybernetics, vol. SMC-12, No. 4, Jul./Aug. 1982, pp. 451-463.Applicant
- Hammer, An Intelligent Flight-Management Aid for Procedure Execution, IEEE Transactions on Systems, Man and Cybernetics, vol. SMC-4, No. 6, Nov./Dec. 1984, pp. 885-888.Applicant
- Mann et al., Analysis of User Procedural Compliance in Controlling a Simulated Process, IEEE Transactions on Systems, Man, and Cybernetics, vol. SMC-16, No. 4, Jul./Aug. 1986.Applicant
- Todd, Signed and Delivered: An Introduction to Security and Authentication, Find Out How the Jave Security API Can Help you Secure your Code, Javaworld, Web Publishing, Inc., San Francisco, Dec. 1, 1998, pp. 1-5.Applicant
- Arvind, Secure This. Inform, Association for Information and Image Management, Silver Spring, Sep./Oct. 1999, pp. 1-4.Applicant
- Stevens TCP/IP Illustrated, vol. 1, 1994, pp. 247.Applicant
- Lee et al., A Generic Virus Detection Agent on the Internet, IEEE, 30th Annual Hawaii International Conference on System Sciences, 1997, vol. 4.Applicant
- Cutler, Inside Windows NT, 1993, Microsoft Press.Applicant
- Duncan, Advances MS-Dos, 1986, Microsoft Press.Applicant
- McDaniel, IBM Dictionary of Computing, 1994, International Business Machines Corporation.Applicant
- Burd, Systems Architecture, 1998, Course Technology, Second Edition.Applicant
- Programmer's Guide PowerJ, 1997, Sybase.Applicant
- Swimmer et al., Dynamic detection and classification of computer viruses using general behavior patterns, 1995, Proceedings of the Fifth International Virus Bulletin Conference, Boston.Applicant
- Advanced Virus Detection Technology for the Next Millennium, Aug. 1999, Network Associates, A Network Associates Executive White Paper, pp. 1-14.Applicant
- Enterprise-Grade Anti-Virus Automation in the 21st Century, Jun. 2000, Symantec, Technology Brief, pp. 1-17.Applicant
- Kephart et al., Blueprint for a Computer Immune System, 1997, Retrieved from Internet, URL: http//www.research.ibm.com/antivirus/scipapers/kephart/VB97, pp. 1-15.Applicant
- Richardson, Enterprise Antivirus Software, Feb. 2000, Retrieved from Internet, URL: http://www.networkmagazine.com/article/nmg20000426S0006, pp. 1-6.Applicant
- Understanding and Managing Polymorphic Viruses, 1996, Symantec, The Symantec Enterprise Papers, vol. XXX, pp. 1-13.Applicant
- Gong, JavaTM Security Architecture (JDK1.2), Oct. 2, 1998, Sun Microsystems, Inc., Version 1.0, pp. i-iv, 1-62.Applicant
- Softworks Limited VBVM Whitepaper, Nov. 3, 1998, Retrieved from the Internet, URL: http://web.archive.org/web/19981203105455/http://softworksltd.com/vbvm.html, pp. 1-4.Applicant
- Kephart, A Biologically Inspired Immune System for Computers, 1994, Artificial Life IV, pp. 130-139.Applicant
- International Search Report for PCT/US01/26804 of Mar. 21, 2002.Applicant
- Kosoresow et al., Intrusion Detection via System Call Traces, IEEE Software, pp. 35-42, Sep./Oct. 1997.Applicant
- Veldman, Heuristic Anti-Virus Technology, Proceedings, 3rd International Virus Bulletin Conference, pp. 67-76, Sep. 1993.Applicant
- Symantec, Understanding Heuristics: Symantec's Bloodhound Technology, Symantec White Paper Series, vol. XXXIV, pp. 1-14, Sep. 1997.Applicant
- Nachenberg, A New Technique for Detecting Polymorphic Computer Viruses, A thesis submitted in partial satisfaction of the requirements for the degree Master of Science in Computer Science, University of California Los Angeles, pp. 1-127, 1995.Applicant
- Microsoft P-Code Technology, http://msdn.microsoft.com/archive/default.asp?url=/archive/enus/dnarvc/html/mdsn—c7pcode2.asp, pp. 1-6, Apr. 1992.Applicant
- DJGPP COFF Spec, http://delorie.com/digpp/doc/coff/, pp. 1-15, Oct. 1996.Applicant
- Natvig, Sandbox Technology Inside AV Scanners, Virus Bulletin Conference, Sep. 2001, pp. 475-488.Applicant
- Norman introduces a new technique for eliminating new computer viruses, found on Norman's website, file://c:/documents%20and%20settings\7489\local%20settings\temporary%20internet%20files\olk, pp. 1-2, published Oct. 25, 2001, printed from website Dec. 27, 2002.Applicant
- International Search Report for PCT/US01/19142 of Jan. 17, 2003.Applicant
- Using the CamNet BBS FAQ, http://www.cam.net.uk/manuals/bbsfaq/bbsfaq.htm, Jan. 17, 1997.Applicant
- Express Storehouse Ordering System, “Accessing ESOS through the Network”, http://www-bfs.ucsd.edu/mss/esos/man3.htm, Sep. 3, 1996.Applicant
- NASIRE, NASIRC Bulletin #94-10, http://cs-www.ncsl.nist.gov/secalert/nasa/nasa9410.txt, Mar. 29, 1994.Applicant
- Packages in the net directory, http://linux4u.jinr.ru/usoft/WWW/www—debian.org/FTP/net.html, Mar. 20, 1997.Applicant
- Sundaram, An Introduction to Intrusion Detection, Copyright 1996, published at www.acm.org/crossroads/xrds2-4/intrus.html, pp. 1-12.Applicant
- Samfat, IDAMN: An Intrusion Detection Architecture for Mobile Networks, IEEE Journal on Selected Areas in Communications, vol. 15, No. 7, Sep. 1997, pp. 1373-1380.Applicant
- INFO: Visual Basic Supports P-Code and Native Code Compilation (Q229415), http://support.micorsoft.com/support/kb/articles/Q229/4/15.ASP, pp. 1-2, Apr. 28, 1999.Applicant
- International Search Report for PCT/US99/29117 of May 2, 2000.Applicant
- Nordin, U of MN OIT Security and Assurance, Feb. 9, 2000.Applicant
- Internet Security Systems, RealSecure SiteProtector, SAFEsuite Decisions to SiteProtector Migration, Aug. 8, 2003, pp. 1-42.Applicant
- Internet Security Systems, SAFEsuite Enterprise, SAFEsuite Decisions, 1998.Applicant
- Internet Security Systems, SAFEsuite Enterprise, Recognizing the Need for Enterprise Security: An Introduction to SAFEsuite Decisions, Aug. 1998, pp. 1-9.Applicant
- Internet Security Systems, SAFEsuite Decisions 2.6, Frequently Asked Questions, Feb. 21, 2001, pp. 1-10.Applicant
- Internet Security Systems, SAFEsuite Decisions Version 1.0, User's Guide, 1998, pp. 1-78.Applicant
- Porras et al., Emerald: Event Monitoring Enabling Responses to Anomalous Live Disturbances, Computer Science Laboratory, SRI International, Menlo Park, CA, Oct. 1997, pp. 353-365.Applicant
- Cisco Systems, Empowering the Internet Generation, 1998.Applicant
- Messmer, Start-Up Puts Hackers on BlackICE, Network World Fusion, http://www.nwfusion.com/cgi-bin/mailto/x/cgi, Apr. 21, 1999, p. 1-2.Applicant
- NeworkICE Corporation, Can You Explain How Your Product Can Protect a Remote User with a VPN Client?, 1998-1999, pp. 1-2, http://www.webarchive.org/web/20000304071415/advice.networkice.com/advice/support/kb/q000003/default.Applicant
- Yasin, Start-Up Puts Network Intruders on Ice, http://www.internetweek.com/story/INW19990505S0001, May 5, 1999, pp. 1-2.Applicant
- Morency, NetworkWorldFusion, http://nwfusion.com/cgi-bin/mailto/x.cgi, Jun. 28, 1999, pp. 1-2.Applicant
- Rogers, Network ICE Touts Security Wares, Apr. 23, 1999, San Mateo, California, http://www.crn.com/showArticle.jhtml?articleID=18829106&flatPage=true, pp. 1-2.Applicant
- Rogers, Network ICE Signs Resellers, May 26, 1999, San Mateo, California, http://www.crn.com/showArticle.jhtml?articleID=18805302&flatPage=true, pp. 1-2.Applicant
- Internet Security Systems, I've Beem Attacked! Now What?, Aug. 27, 1999, http://www.iss.net/security—center/advice/Support/KB/q000033/default.htm, pp. 1-2.Applicant
- Internet Security Systems, What is the Format of “Attack-List.CSV”?, Aug. 21, 1999, http://www.iss.net/security—center/advice/Support/KB/q000018/default.htm, pp. 1-2.Applicant
- Neumann et al., Experience with Emerald to Date, Apr. 11-12, 1999, 1st USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, California, pp. 1-9.Applicant
- Lindqvist et al., Detecting Computer and Network Misuse Through the Production-Based Expert System Toolset (P-BEST), May 9-12, 1999, Proceedings of the 1999 IEEE Symposium on Security and Privacy, Oakland, California, pp. 1-16.Applicant
- Kendall, A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems, Jun. 1999, Department of Defense Advanced Research Projects Agency, pp. 1-124.Applicant
- Neumann, Computer Security and the U.S. Infrastructure, Nov. 6, 1997, Congressional Testimony, pp. 1-11.Applicant
- Porras et al., Life Traffic Analysis of TCP/IP Gateways, Nov. 10, 1997, Internet Society's Networks and Distributed Systems Security Systems Symposium, Mar. 1998, http://www.sdl.sri.com/projects/emerald/livetraffic.html, pp. 1-16.Applicant
- Raynaud et al., Integrated Network Management IV, 1995, Proceedings of the 4th International Symposium on Integrated Network Management, pp. 1-2, and 5-16.Applicant
- Heberlein, et al., A Method to Detect Intrusive Activity in a Networked Environment, Oct. 1-4, 1991, 14th National Computer Security Conference, Washington, D.C., pp. 362-363 and 365-371.Applicant
- Ko et al., Execution Monitoring of Security-Critical Programs in Distributed Systems: A Specification-Based Approach, 1997, Proceedings of the 1997 IEEE Symposium on Security and Privacy, pp. 175-187.Applicant
- Crosbie et al., Active Defense of a Computer System Using Autonomous Agents, Technical Report No. 95-008, Feb. 15, 1995, Purdue University, West Lafayette, Indiana, pp. 1-14.Applicant
- Mansouri-Samani et al., Monitoring Distributed Systems, Nov. 1993, IEEE Network, pp. 20-30.Applicant
- Jakobson et al., Alarm Correlation, Nov. 1993, IEEE Network, pp. 52-59.Applicant
- Anderson et al., Next-Generation Intrusion Detection Expert (NIDES), A Summary, May 1995, SRI International, pp. 1-37.Applicant
- Veritas Software, Press Release, Robust Enhancements in Version 6.0 Maintain Seagate WI as the De Facto Standard for Software Distribution, Oct. 6, 1997, Press Releases, pp. 1-4, http://216.239.39.104/search?q=cache:HS9kmK1m2QoJ:www.veritas.com/us/aboutus/pressroom/199....Applicant
- Yasin, Network-Based IDS are About to Stop Crying Wolf, Security Mandate: Silence False Alarms, Apr. 9, 1999, http://lists.jammed.com/ISN/1999/04/0021.html, pp. 1-3.Applicant
- Internet Security Systems, Press Release, ISS Reports Record Revenues and Net Income for Second Quarter, Jul. 19, 1999, http://bvlive01.iss.net/issEn/delivery/prdetail.jsp?type=Financial&oid=14515, pp. 1-5.Applicant
- LaPadula, State of the Art in CyberSecurity Monitoring, A Supplement, Sep. 2001, Mitre Corporation, pp. 1-15.Applicant
- Balasubramaniyan et al., An Architecture for Intrusion Detection Using Autonomous Agents, Jun. 11, 1998, Purdue University, West Lafayette, Indiana, pp. 1-4, http://gunther.smeal.psu.edu/images/b9/f3/bb/9e/ba7f39c3871dcedeb9abd0f70cb84607/1.png.Applicant
- Crosbie et al., Active Defense of a Computer System Using Autonomous Agents, Feb. 15, 1995, Technical Report No. 95-008, Purdue University, West Lafayette, Indiana, pp. 1-14.Applicant
- Crosbie et al., Defending a Computer System Using Autonomous Agents, Mar. 11, 1994, Technical Report No. 95-022, Purdue University, West Lafayette, Indiana, pp. 1-11.Applicant
- Denning, An Intrusion-Detection Model, Feb. 1987, IEEE Transactions on Software Engineering, vol. SE-13, No. 2, pp. 1-17.Applicant
- Lunt, A Survey of Intrusion Detection Techniques, 1993, Computers & Security, 12 (1993), pp. 405-418.Applicant
- Porras et al., Penetration State Transition Analysis A Rule-Based Intrusion Detection Approach, 1992, pp. 220-229.Applicant
- Javitz et al., The NIDES Statistical Component: Description and Justification, SRI International, Menlo Park, California, SRI Project 3131, Mar. 7, 1994.Applicant
- Lindqvist et al., Detecting Computer and Network Misuses Through the Production-Based Expert System Toolset (P-BEST), Oct. 25, 1998, pp. 1-20.Applicant
- Javitz et al., The SRI IDES Statistical Anomaly Detector, SRI Internationa, Menlo Park, California, May 1991, IEEE Symposium on Security and Privacy, pp. 1-11.Applicant
- Porras et al., Live Traffic Analysis of TCP/IP Gateways, Nov. 10, 1997, SRI International, Menlo Park, California, pp. 1-16.Applicant
- Porras et al., Live Traffic Analysis of TCP/IP Gateways, Dec. 12, 1997, SRI International, Menlo Park, California, Proceedings of the 1998 ISOC Symposium on Network and Distributed Systems Security, pp. 1-13.Applicant
- Information & Computing Sciences: System Design Laboratory: Programs: Intrusion Detection, SRI International, http://www.sdl.sri.com/programs/intrusion/, Jun. 17, 2004, pp. 1-2.Applicant
- Lindqvist et al., eXpert-BSM: A Host-based Intrusion Detection Solution for Sun Solaris, SRI International, Menlo Park, California, Dec. 10-14, 2001, Proceedings of the 17th Annual Computer Security Applications Conference, pp. 1-12.Applicant
- Almgren et al., Application-Integrated Data Collection for Security Monitoring, Oct. 10-12, 2001, SRI International, Menlo Park, California, pp. 1-15.Applicant
- Debar et al., Research Report: A Revised Taxonomy for Intrusion-Detection Systems, Oct. 25, 1999, IBM Research, Switzerland, pp. 1-23.Applicant
- Porras et al., Emerald: Event Monitoring Enabling Responses to Anomalous Live Disturbances, Computer Science Laboratory, SRI International, Menlo Park, CA, Dec. 18, 1996, pp. 1-3.Applicant
- Frequently-Asked Questions about RealSecure, pp. 1-14, http://web.archive.org/web/19970721183227/iss.net/prod/rs—faq.html, May 30, 1997.Applicant
- Cisco Systems, Inc., Empowering the Internet Generation, 1998.Applicant
- Internet Security Systems, Inc., RealSecure Release 1.2 for UNIX, A User Guide and Reference Manual, 1997.Applicant
- Internet Security Systems, Inc., Real-time attack recognition and response: A solution for tightening network security, Jan. 1997, pp. 1-13.Applicant
- Internet Security Systems, Inc., SAFEsuite Decisions User Guide, Version 1.0, 1998, pp. 1-78.Applicant
- NetworkICE Corporation, ICEcap Administrator's Guide, Version 1.0 BETA, 1999, pp. 1-142.Applicant
- Debar, Herve et al., A Neural Network Component for an Intrusion Detection System, 1992, pp. 240-250.Applicant
- SRI International, A Prototype IDES: A Real-Time Intrusion-Detection Expert System, Aug. 1987, p. 1-63.Applicant
- SRI International, Requirements and Model for IDES-A Real Time Intrusion-Detection Expert System, Aug. 1985, pp. 1-70.Applicant
- SRI International, An Intrusion-Detection Model, Nov. 1985, pp. 1-29.Applicant
- Dowell et al., The ComputerWatch Data Reduction Tool, Proc. of the 13th National Computer Security Conference, Washington, D.C., Oct. 1990, pp. 99-108.Applicant
- Fox et al., A Neural Network Approach Towards Intrusion Detection, Jul. 2, 1990, pp. 125-134.Applicant
- Garvey et al., Model-Based Intrusion Detection, Oct. 1991, pp. 1-14.Applicant
- Ilgun et al., State Transition Analysis: A Rule-Based Intrusion Detection Approach, Mar. 1995, pp. 181-199.Applicant
- Javitz et al., The SRI IDES Statistical Anomaly Detector, May 1991, pp. 1-11.Applicant
- SRI International, The NIDES Statistical Component Description and Justification, Mar. 7, 1994, pp. 1-46.Applicant
- Karen, Oliver, PC Magazine, The Digital Doorman, Nov. 16, 1999, p. 68.Applicant
- Liepins et al., Anomaly Detection: Purpose and Frameowrk, 1989, pp. 495-504.Applicant
- Lindqvist et al., Detecting Computer and Network Misuse Through the Production-Bases Expert System Toolset (P-BEST), Oct. 25, 1998, pp. 1-20.Applicant
- Lunt, Teresa, A survey of intrusion detection techniques, 1993, pp. 405-418.Applicant
- Lunt, Teresa, Automated Audit Trail Analysis and Intrusion Detection: A Survey, Oct. 1988, pp. 1-8.Applicant
- Porras et al., Penetration State Transition Analysis A Rule-Based Intrusion Detection Approach, 1992, pp. 220-229.Applicant
- Sebring et al., Expert Systems in Intrusion Detection: A Case Study, Oct. 1988, pp. 74-81.Applicant
- Shieh et al., A Pattern-Oriented Intrusion-Detection Model and Its Applications, 1991, pp. 327-342.Applicant
- Smaha, Stephen, Haystack: An Intrusion Detection System, 1988.Applicant
- Snapp, Steven Ray, Signature Analysis and Communication Issues in a Distributed Intrusion Detection System, 1991, pp. 1-40.Applicant
- Porras et al., EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances, Oct. 1997, pp. 353-365.Applicant
- Lunt et al., Knowledge-Based Intrusion Detection, Mar. 1989, pp. 102-107.Applicant
- Lunt et al., An Expert System to Classify and Sanitize Text, Dec. 1987, pp. 1-5.Applicant
- Tener, William, Computer Security in the Age of Information, AI & 4GL: Automated Detection and Investigation Tools, 1989, pp. 23-29.Applicant
- Teng et al., Adaptive Real-time Anomaly Detection Using Inductively Generated Sequential Patterns, 1990, pp. 278-284.Applicant
- Vaccaro et al., Detection of Anomalous Computer Session Activity, 1989, pp. 280-289.Applicant
- Winkler, J.R., A UNIX Prototype for Intrusion and Anomaly Detection in Secure Networks, 1990, pp. 115-124.Applicant
- Boyen et al. Tractable Inference for Complex Stochastic Process, Jul. 24-26, 1998.Applicant
- Copeland, Observing Network Traffic—Techniques to Sort Out the Good, the Bad, and the Ugly, 2000, pp. 1-7.Applicant
- Goan, Terrance, Communications of the ACM, A Cop on the Beat Collecting and Appraising Intrusion Evidence, Jul. 1999, pp. 47-52.Applicant
- Heberlein et al., A network Security Monitor, 1990, pp. 296-304.Applicant
- Jackson et al., An Expert System Applications for Network Intrusion Detection, Oct. 1991, pp. 1-8.Applicant
- Lankewicz et al., Real-Time Anomaly Detection Using a Nonparametric Pattern Recognition Approach, 1991, pp. 80-89.Applicant
- Lippmann et al., Evaluating Intrusion Detection Systems: The 1998 DARPA Off-line Intrusion Detection Evaluation, 1999.Applicant
- Munson et al., Watcher: The Missing Piece of the Security Puzzle, Dec. 2001.Applicant
- Pearl, Judea, Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference, Sep. 1988.Applicant
- Porras et al., Live Traffic Analysis of TCP/IP Gateways, Dec. 12, 1997, pp. 1-13.Applicant
- EMERALD TCP Statitical Analyzer 1998 Evaluation Results, http://www.sdl.sri.com/projects/emerald/98-eval-estat/index.html, Jul. 9, 1999, pp. 1-15.Applicant
- Staniford-Chen, GrIDS-A Graph Based Intrusion Detection System for Large Networks, Oct. 1996.Applicant
- Tener, William, Discovery: An Expert System in the Commercial Data Security Environment, Dec. 1986, pp. 45-53.Applicant
- Valdes et al., Adaptive, Model-Based Monitoring for Cyber Attack Detection, 2000, pp. 1-19.Applicant
- SRI International, Blue Sensors, Sensor Correlation, and Alert Fusion, Oct. 4, 2000.Applicant
- Valdes et al., Statistical Methods for Computer Usage Anomaly Detection Using NIDES, Jan. 27, 1995, pp. 306-311.Applicant
- Wimer, Scott, The Core of CylantSecure, http://www.cylant.com/products/core.html, 1999, pp. 1-4.Applicant
- Zhang et al., A Hierarchical Anomaly Network Intrusion Detection System using Neural Network Classification, Feb. 2001.Applicant
- Cisco Secure Intrusion Detection System 2.1.1 Release Notes, http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids3/nr211new.htm, Jun. 10, 2003, pp. 1-29.Applicant
- Linux Weekly News, http://Iwn.net/1998/0910shadow.html, Sep. 8, 1998, pp. 1-38.Applicant
- Cracker Tracking: Tighter Security with Intrucsion Detection, http://www.byte.com/art/9805/sec20/art1.htm, May 1998, pp. 1-8.Applicant
- Cisco Systems, Inc., Newtork RS: Intrusion Detection and Scanning with Active Audit Session 1305, 1998.Applicant
- Business Security Advisor Magazine, Intrusion Detection Systems: What You Need to Know, http://advisor.com/doc/0527, Sep. 1998, pp. 1-7.Applicant
- Garvey et al., An Inference Technique for Integrating Knowledge from Disparate Sources, Multisensor Integration and Fusion for Intelligenct Machines and Systems, 1995, pp. 458-464.Applicant
- Power et al., CSI Intrusion Detection System Resource, Jul. 1998, pp. 1-7.Applicant
- Cisco Systems, Inc., NetRanger User's Guide Version 2.1.1, 1998.Applicant
- Internet Security Systems, Real-Time Attack Recognition and Response: A Solution for Tightening Network Security, http://www.iss.net, 1997, pp. 1-13.Applicant
- Network ICE Corporation, Network ICE Product Documentation, pp. 1-3, http://www.web.archive.org/web/20011005080013/www.networkice.com/support/documentation.html, Jul. 6, 2004.Applicant
- Network ICE Corporation, Network ICE Documentation, p. 1, http://www.web.archive.org/web/19991109050852/www.networkice.com/support/docs.htm, Jul. 6, 2004.Applicant
- Network ICE Corporation, Network ICE Press Releases, p. 1, http://www.web.archive.org/web/19990903214428/www.netice.com/company/pressrelease/press.htm, Jul. 7, 2004.Applicant
- Network ICE Corporation, Network ICE Press Releases, p. 1, http://www.web.archive.org/web/20000304074934/www.netice.com/company/pressrelease/press.htm, Jul. 7, 2004.Applicant
- Brentano et al., An Architecture for Distributed Intrusion Detection System, Department of Energy Computer Security Group, 14th Annual Conference Proceedings, pp. (17)25-17(45), May 1991.Applicant
- Staniford-Chen et al., GrIDS-A Graph Based Intrusion Detection System for Large Networks, University of California, Davis, California, 19th National Information Systems Security Conference, 1996, pp. 1-10.Applicant
- Ricciulli et al., Modeling Correlated Alarms in Network Management Systems, SRI International, Menlo Park, California, , Proceedings of the Conference on Communication Networks and Distributed System Modeling and Simulation, 1997, pp. 1-8.Applicant
- Porras et al., Emerald: Event Monitoring Enabling Responses to Anomalous Live Disturbances, SRI International, Menlo Park, California, 20th National Information Systems Security Conference, Oct. 1997, pp. 1-24.Applicant
- Porras et al., A Mission-Impact Based Approach to INFOSEC Alarm Correlation, SRI International, Menlo Park, California, Oct. 2002, pp. 1-33.Applicant
- Phrack 55 Download (234 kb, Sep. 9, 1999), http://www.phrack.org/show.php?p=55&a=9, pp. 1-6.Applicant
- Porras et al., A Mission-Impact-Based Approach to INFOSEC Alarm Correlation, SRI International, Menlo Park, California, Oct. 2002, pp. 1-19.Applicant
- Bace, An Introduction to Intrusion Detection and Assessment for System and Network Security Management, 1999, pp. 1-38.Applicant
- Hunteman, Automated Information System—(AIS) Alarm System, University of California, Los Alamos National Laboratory, 20th National Information System Security Conference, Oct. 1997, pp. 1-12.Applicant
- Janakiraman et al., Indra: A Peer-to-Peer Approach to Network Intrusion Detection and Prevention, Proceedings of the 12th International Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, 2003, pp. 1-5.Applicant
- Innella, Intrusion Detection Systems (IDS), Navy Information Assurance, Jun. 28, 2004, pp. 1-4, http://www.infosec.navy.mil/ps/?t=infosecprodsservices/infosecprodsservices.tag&bc=infosecprodsservices/b...Applicant
- Curry, Intrusion Detection Systems, IBM Emergency Response Service, Coast Laboratory, http://www.cerias.purdue.edu/about/history/coast—resources/idcontent/ids.html, Jul. 19, 2004, pp. 1-28.Applicant
- Lunt et al., Knowledge-Based Intrusion Detection, SRI International, Menlo Park, California, Conference on AI Systems in Government, Washington, D.C., Mar. 1989, pp. 102-107.Applicant
- A. Information Assurance BAA 98-34 Cover Sheet, SRI International, Nov. 1, 2000, pp. 2-35.Applicant
- NetScreen Products, FAQ, http://www.netscreen.com/products/faq.html, Feb. 28, 2003, pp. 1-6.Applicant
- Miller, A Network Under Attack: Leverage Your Existing Instrumentation to Recognize and Respond to Hacker Attacks, NetScout Systems, Westford, MA, Apr. 2003, pp. 1-8.Applicant
- Technology Brief: Intrusion Detection for the Millennium, Internet Security Systems, 2000, pp. 1-6.Applicant
- Weiss et al., Analysis of Audit and Protocol Data using Methods from Artificial Intelligence, Siemens AG, Munich, Germany, Proc. of the 13th National Computer Security Conference, Washington, D.C., Oct. 1990, pp. 109-114.Applicant
- Snapp et al., DIDS (Distributed Intrusion Detection System)—Motivation, Architecture, and an Early Protype), University of California, Davis California, , Proc. 14th National Computer Security Conference, Washington, D.C., Oct. 1991, pp. 167-176.Applicant
- Internet Security Systems, Inc., SAFEsuite Enterprise Edition, Project “Gatekeeper” 1.0, Market Requirements Document, Mar. 30, 1998, pp. 1-12.Applicant
- Internet Security Systems, SAFEsuite Decisions, 2000, pp. 1-2.Applicant
- Internet Security Systems, Dynamic Threat Protection, Presse-Roundtable, Munich, Germany, Apr. 10, 2003, pp. 1-63.Applicant
- Internet Security Systems, Preliminary ODM 1.0 Functional Specification, Aug. 1997, pp. 1-7.Applicant
- Internet Security Systems, Inc., Scanner-ISSDK Interface, Design Specification, Jun. 2, 2000, Draft 1.07, pp. 1-7.Applicant
- RealSecure, Adaptive Network Security Manager Module Programmer's Reference Manual, pp. 1-74.Applicant
- Advanced Concept Technology Demonstrations (ACTD), 2005, pp. 1-28.Applicant
- Frank, Sounding the Alarm, Sep. 6, 1999, Federal Computer Week, pp. 1-2.Applicant
- Crumb, Intrusion Detection Systems to be Integrated at AFRL, Air Force Research Laboratory, News@AFRL, Fall 1999, pp. 1.Applicant
- Temin, Case Study: The IA: AIDE System at Two, 15th Annual Computer Security Applications Conference, Dec. 6-10, 1999, Phoenix, Arizona, pp. 1-26.Applicant
- Spink, Automated Intrusion Detection Environment (AIDE), Intrusion Detection Sensor Fusion, Sep. 7, 1999, pp. 1-25.Applicant
- Frincke et al., A Framework for Cooperative Intrusion Detection, 21st National Information Systems Security Conference, Oct. 6-9, 1998, Crystal City, Virginia, pp. 1-20.Applicant
- Anderson et al., In Athena's Camp: Preparing for Conflict in the Information Age, An Exploration of Cyberspace Security R&D Investment Strategies for DARPA: The Day After-in Cyberspace II, Chaper Eleven, 1996, pp. 253-271.Applicant
- Valdes et al., SRI International, Probabilistic Alert Correlation, 2001, pp. 1-15.Applicant
- Bass, Multisensor Data Fusion for Next Generation Distributed Intrusion Detection Systems, Apr. 28, 1999, Iris National Symposium, pp. 1-6.Applicant
- Perrochon et al., Enlisting Event Patterns for Cyber Battlefield Awareness, No Date, Stanford University, pp. 1-12.Applicant
- Perrochon, Using Context-Based Correlation in Network Operations and Management, Jul. 2, 1999, Stanford University, pp. 1-20.Applicant
- Perrochon, Real Time Event Based Analysis of Complex Systems, Jun. 1998, pp. 1-9.Applicant
- Luckham et al., Complex Event Processing in Distributed Systems, Aug. 18, 1988, Stanford University, pp. 1-26.Applicant
- Pettigrew, US Southcom United States Southern Command's Information Sharing Projects, Summer 1999, IAnewsletter, vol. 3, No. 1, pp. 1-24.Applicant
- Levitt et al., CMAD IV, Computer Misuse & Anomaly Detection, Session Summaries, Nov. 12-14, 1996, Proceedings of the Fourth Workshop on Future Directions in Computer Misuse and Anomaly Detection, Monterey, California, pp. 1-86.Applicant
- Cheung et al., The Design of GrIDS: A Graph-Based Intrusion Detection System, Jan. 26, 1999, University of California, pp. 1-51.Applicant
- Cohen et al., Report of the Reporting and Analysis Track, Detection of Malicious Code, Intrusions, and Anomalous Activities Workshop, Feb. 22-23, 1999, pp. 1-47.Applicant
- Garofalakis et al., Network Mining and Analysis: The Nemesis Project, Bell Labs, Lucent Technologies, No Date, pp. 1-12.Applicant
- RealSecure ICEcap Manager User Guide Version 3.6, Internet Security Systems, Inc., 1998-2002, pp. 1-228.Applicant
- Cuppens, Cooperative Intrusion Detection, Date Unknown, pp. 1-10.Applicant
- Mukherjee et al., Network Intrusion Detection, IEEE Network, May/Jun. 1994, pp. 26-41.Applicant
- Machlis, Net Monitoring Tools Gain Real-Time Alerts, Apr. 14, 1997, http://www.computerworld.com, pp. 1-12.Applicant
- Omniguard/ITA Intruder Alert, AXENT Technologies, Inc., Nov. 17, 2004, http://www.web.archive.org, pp. 1-10.Applicant
- NetRanger Overview, Chapter 1, Date Unknown, pp. 1-16.Applicant
- Sutterfield, Large-Scale Network Intrusion Detection, 1997, WheelGroup Corporation, pp. 1-10.Applicant
- Kumar et al., An Application of Pattern Matching in Intrusion Detection, Technical Report No. CSD-TR-94-013, Jun. 17, 1994, Purdue University, pp. 1-55.Applicant
- Huang et al., A Large-Scale Distributed Intrusion Detection Framework Based on Attack Strategy Analysis, Date Unknown, The Boeing Company, pp. 1-12.Applicant
- Perrochon et al., Event Mining with Event Processing Networks, Date Unknown, Stanford University, pp. 1-4.Applicant
- Gruschke, Integrated Event Management: Event Correlation Using Dependency Graphs, presented at DSOM 1998, University of Munich, pp. 1-12.Applicant
- Bass, Intrusion Detection System and Multisensor Data Fusion, Apr. 2000, Communications of the ACM, vol. 43, No. 4, pp. 99-105.Applicant
- Bass et al., A Glimpse into the Future of ID, Date Unknown, Usenix, pp. 1-10.Applicant
- LaPadula, State of the Art in Anomaly Detection and Reaction, Jul. 1999, Mitre Corporation, pp. 1-36.Applicant
- Rationalizing Security Events with Three Dimensions of Correlation, Date Unknown, NetForensics, Tech Brief, pp. 1-6.Applicant
- Jou et al., Design and Implementation of a Scalable Intrusion Detection System for the Protection of Network Infrastructure, Date Unknown, MCNC, pp. 1-15.Applicant
- Caldwell, Event Correlation: Security's Holy Grail?, Aug. 1, 2002, GuardedNet, pp. 1-21.Applicant
- Metcalf et al., Intrusion Detection System Requirements, Sep. 2000, Mitre Corporation, pp. 1-33.Applicant
- Jou et al., Architecture Design of a Scalable Intrusion Detection System for the Emerging Network Infrastructure, Technical Report CDRL A005, Apr. 1997, MCNC, pp. 1-42.Applicant
- Security Manager for UNIX Systems Version 3.2.1 User's Guide, Feb. 1998, Internet Security Systems, pp. 1-62.Applicant
- RealSecure Release 1.2 for UNIX A User Guide and Reference Manual, 1997, Internet Security Systems, Inc., pp. 1-92.Applicant
- Internet Scanner SAFE SAFEsuite 4.0 User Guide and Reference Manual, 1996, Internet Security Systems, Inc., pp. 1-158.Applicant
- Internet Scanner 3.3 User Guide and Reference Manual, 1996, Internet Security Systems, Inc., pp. 1-119.Applicant
- Landwehr et al., Newsletter of the IEEE Computer Society's TC on Security and Privacy Electronics, Electronic CIPHER, Nov. 25, 1997, Issue 25, pp. 1-34.Applicant
- 20th National Information Systems Security Conference, Oct. 6-10, 1997, Baltimore, Maryland, pp. 1-44.Applicant
- EMERALD Alert Management Interface User's Guide Version 1.2 Dec. 6, 2000, SRI International, pp. 1-11.Applicant
- Anderson et al., Detecting Unusual Program Behavior Using the Statistical Component of the Next-Generation Intrusion Detection Expert System (NIDES), May 1995, SRI International, pp. 1-89.Applicant
- Lunt et al., Detecting Intruders in Computer Systems, 1993 Conference on Auditing and Computer Technology, SRI International, pp. 1-17.Applicant
- Network ICE Products—ICEcap, Date Unknown, pp. 1-2.Applicant
- Forlanda, The Secrets to Driving on BlackICE, Jan. 12, 2000, Network ICE, pp. 1-35.Applicant
- BlackICE User's Guide Version 1.0 Beta Draft, 1999, Network ICE Corporation, pp. 1-59.Applicant
- ICEcap Administrator's Guide Version 1.0 Beta Draft, 1999, Network ICE Corporation, pp. 1-25.Applicant
- Shulak et al., ICEcap Advanced Administration Guide Version 3.0 2001, Internet Security Systems Corporation, pp. 1-51.Applicant
- “Real Secure, OS Sensor User Guide,” Version 5.0, © Internet Security Systems, Inc., 199?-2000; Sep. 2000, pp. 1-64.Applicant
- “Real Secure, User's Guide,” Version 3.0, © 1992-1998, Internet Security Systems, Inc., pp. 1-128.Applicant
- “System Security Scanner, User Guide,” Version 1.6, © 1996-1998, Internet Security Systems, Inc., pp. 1-164.Applicant
- “Real Secure™, Network Engine User Guide,” Version 3.2.1, © 1999 by Internet Security Systems, Inc., pp. 1-38.Applicant
- “Real Secure™, User Guide,” Version 3.2.1, © 1999 by Internet Security Systems, Inc., pp. 1-38.Applicant
- “Real Secure™, Manager for HP OpenView User Guide,” Version 1.3, © 1999 by Internet Security Systems, Inc., pp. 1-48.Applicant
- “Database Scanner, User Guide,” Version 2.0, © 1992-1999, Internet Security Systems, Inc., pp. 1-112.Applicant
- “Database Scanner™, User Guide,” Version 4.0, © 2000 by Internet Security Systems, Inc., pp. 1-122.Applicant
- “Database Scanner™, User Guide,” Version 3.0.1, , © 1999 by Internet Security Systems, Inc., pp. 1-164.Applicant
- “Real Secure™, Network Sensor User Guide,” Version 5.0, © 2000 by Internet Security Systems, Inc., pp. 1-42.Applicant
- “Real Secure, Server Sensor User Guide,” Version 5.5, © Internet Security Systems, Inc. 2000, pp. 1-56.Applicant
- “Internet Scanner™, User Guide,” Version 6.0, Copyright © 1999 by Internet Security Systems, Inc., pp. 1-182.Applicant
- “Internet Scanner™, User Guide,” Version 6.1, © 2000 by Internet Security Systems, Inc., pp. 1-226.Applicant
- “Internet Scanner™, User Guide,” Version 5.6, © 1992-1998, Internet Security Systems, Inc., pp. 1-162.Applicant
- “Internet Scanner™, User Guide,” Version 5.3, © 1992-1998, Internet Security Systems, Inc. pp. 1-173.Applicant
- “Real Secure, Console User Guide,” Version 5.5, © 199?-2000, Internet Security Systems, Inc., pp. 1-162.Applicant
- “Internet Scanner™, User Guide,” Version 5.8, © 1999 by Internet Security Systems, Inc., pp. 1-148.Applicant
- “SAFEsuite Decisions, User Guide,” Version 1.0, © 1992-1998, Internet Security Systems, Inc., pp. 1-88.Applicant
- “Real Secure™, Console User Guide,” Version 5.0, © 2000 by Internet Security Systems, Inc., pp. 1-114.Applicant
- “SAFEsuite DECISIONS, User Guide,” Version 2.5, © 2000 by Internet Security Systems, Inc., pp. 1-194,Applicant
- “System Scanner, User Guide,” Version 1.7, © 1992-1998, Internet Security Systems, Inc., pp. 1-248.Applicant
- “Sytem Scanner, User Guide,” Version 1.0, © 1996-1998, Internet Security Systems, Inc., pp. 1-140.Applicant
- “System Scanner™, User Guide,” Version 4.0, © 1999 by Internet Security Systems, Inc., pp. 1-178.Applicant
- Internet Security Systems, Inc., “Introduction to RealSecure Version 5.0, The Industry's Only Integrated Host-Based and Network-Based Intrusion Detection System”, Aug. 22, 2000, pp. 1-47.Applicant
- Internet Security Systems, Inc., “RealSecure Network Sensor and Gigabit Network Sensor Policy Guide Version 7.0”, Aug. 2003, pp. 1-86.Applicant
- Internet Security Systems, Inc., “RealSecure Console User Guide Version 3.1”, Jun. 1999, pp. 1-98.Applicant
- Internet Security Systems, Inc., “RealSecure Version 2.0”, Apr. 1998, pp. 1-154.Applicant
- Internet Security Systems, Inc., “Enhanced Dynamic Threat Protection via Automated Correlation and Analysis”, an ISS White Paper, 2002, pp. 1-14.Applicant
- Internet Security Systems, Inc., “RealSecure Site Protector Comparison Guide for Internet Scanner 7.0 Reporting Version 1.2”, Mar. 2003, an ISS Tech Note, pp. 1-15.Applicant
- Internet Security System, Inc., “RealSecure Site Protector Comparison Guide for ICEcap Manager Version 1.5”, Jan. 2002, an ISS Technical White Paper, pp. 1-27.Applicant
- Internet Security Systems, Inc., “RealSecure SiteProtector Security Fusion Module 2.0 Frequently-Asked Questions”, Mar. 2003, pp. 1-8.Applicant
- Internet Security Systems, Inc., “RealSecure SiteProtector Console User Reference Guide Version 2.0 Service Pack 1”, Mar. 14, 2003, Chapter 3, pp. 1-27.Applicant
- Internet Security Systems, Inc., “Proventia Gateway and Network Protection”, Jul. 2003, pp. 1-12.Applicant
- Farley, Internet Security System, Inc., “ID Fusion Technology, A First-Generation Approach”, Apr. 29, 1999, National Security Framework Forum, pp. 1-8.Applicant
- Farley, “RealSecure Fusion Engine Concepts”, an ISS White Paper, Jun. 30, 1999, pp. 1-23.Applicant