US 9,609,007 B1Grant
System and method of detecting delivery of malware based on indicators of compromise from different sources
Issue Date:2017-03-28
•35 Claims
•9 Drawing Sheets
Abstract
According to one embodiment, a computerized method comprises receiving a set of indicators of compromise (IOCs) associated with a known malware of a first message type from a first source and receiving one or more IOCs (IOC(s)) from a second source that is different from the first source. Thereafter, a determination is made as to whether the received IOC(s) from the second source correspond to the set of IOCs received from the first source. If so, information associated with at least the set of IOCs is used to locate a malware of the first message type that is undetected at the second source.
Metadata
Assignee
- FireEye, Inc.
Inventors
- Alexandr Rivlin
- Divyesh Mehra
- Henry Uyeno
- Vinay Pidathala
Application Information
Application Number:US 15/174,827
Filing Date:2016-06-06
Priority Date:2014-08-22
Art Unit:2435
Classifications
IPC:
G06F11/00H04L29/06
Field of Search:
H04L 63/145H04L 63/1466H04L 63/1475H04L 63/16H04L 63/20H04L 63/1416H04L 63/1425H04L 63/1433H04L 63/1441
Patent Drawings (9 sheets)
Description
CROSS-REFERENCE TO RELATED APPLICATIONS
[0001] This application claims the benefit of priority on U.S. application Ser. No. 14/466,898 filed Aug. 22, 2014, now U.S. Pat. No. 9,363,280 issued Jun. 7, 2016, the entire contents of which are incorporated by reference.
[0002] 1. Field
[0003] Embodiments of the disclosure relate to the field of cybersecurity. More specifically, embodiments of the disclosure relate to a system and method for conducting a predictive analysis, based on information from a first customer, as to when indicators of compromise (IOCs) experienced by a second customer are caused by receipt of an undetected malicious electronic message.
[0004] 2. General Background
[0005] Currently, there exist a number of malware delivery techniques. A commonly used malware delivery technique involves the transmission of a malicious electronic mail (email) message to a computer or device controlled by a targeted user. Based on user activity, the malicious email message causes the computer to become infected. More specifically, the malicious email message may be structured to lure the targeted user to select a Uniform Resource Locator (URL) within the malicious email message which, upon selection, establishes communications with a web server that, unbeknownst to the user, is malicious. Thereafter, malware is uploaded and sensitive information may be subsequently downloaded from the infected computer.
[0006] For the last few years, anti-virus and email filtering industries have developed tools and techniques to identify and isolate potentially infected email messages. However, these traditional tools and techniques are not effective in detecting certain types of advanced, malicious email messages. To address this detection gap, one type of security appliance has been solely developed (and is currently available) to analyze an email message and determine whether the email message is likely infected with malware. In particular, this email analytic appliance analyzes incoming email messages, namely its header, content, links and attachments, in order to identify the presence of malware. Upon discovery of a malicious email message, the email analytic appliance alerts security personnel to quarantine the malicious email message and cleanse the infected computer.
[0007] Many customers deploy dedicated email analysis appliances as well as network monitoring appliances. However, some customers do not operate dedicated email analytic appliances. Instead, most of these customers simply deploy one or more security appliances that are configured to monitor network communications with one or more network devices to identify indicators of compromise (IOCs), namely malicious behaviors that suggest the presence of malware on a particular network device or particular network devices. While these types of security appliances are able to identify the presence of malware on a particular computer, they are not configured to analyze email messages for the presence of malware within these messages. As a result, without an email analytic appliance, a customer has no ability to reliably prevent delivery of malicious to targeted victim of attack. Protection against malicious email messages becomes more complex as the messages may lay dormant in the user's inbox for days or even weeks. This lack of detection has prolonged adverse effects on network security as subsequent malicious attacks may persist months later as long as the malicious email message is stored at an email server of the enterprise network and/or stored locally at a computer having access to the network.
BRIEF DESCRIPTION OF THE DRAWINGS
[0008] Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings, in which like references indicate similar elements and in which:
[0009] FIG. 1 is an exemplary block diagram of a communication network 100 deploying an embodiment of the invention.
[0010] FIG. 2A is a block diagram of an exemplary embodiment of the management platform 110 of FIG. 1 .
[0011] FIG. 2B is a block diagram of an exemplary embodiment of a logical representation of the management platform 110 of FIG. 1 .
[0012] FIG. 3 is an illustrative embodiment of the operations conducted by the management platform 110 of FIG. 1 for conducting a predictive analysis.
[0013] FIG. 4 is a detailed embodiment of the operations in conducting predictive analysis by the management platform.
[0014] FIG. 5 is an exemplary embodiment of the predictive analysis conducted by the management platform in determining a threat level that signifies a degree of confidence that the detected IOCs are caused by a malicious electronic message.
[0015] FIG. 6 is an exemplary embodiment of a first response scheme that includes selection of different response levels by the management platform based on the determined threat level.
[0016] FIG. 7 is an exemplary embodiment of a second response scheme by the management platform upon determining specific threat levels for the detected IOCs.
DETAILED DESCRIPTION
[0017] Various embodiments of the disclosure relate to a platform and method for determining whether one or more indicators of compromise (IOCs) detected by a second customer (e.g., second source) have been caused by receipt of a malicious electronic message, even when no malicious electronic message has been directly observed by the second customer. More specifically, the platform is configured to conduct a predictive analysis that determines, based on a sufficient correspondence between IOCs detected by the second customer and IOCs associated with a particular malicious electronic message as detected and/or observed by one or more customers different than the second customer (e.g., a first source), whether the detected IOCs received from the second customer are caused by receipt of a malicious electronic message that is proximate in time and/or similar in content to the particular malicious electronic message.
[0018] According to one embodiment of the disclosure, a management platform receives anomalous behaviors, namely IOCs, from multiple customers having different security deployments. Herein, a first customer deploys at least a message analytic appliance that is specifically designed to protect against attacks delivered via malicious electronic messages such as email messages that includes a malicious attachment, a malicious text message, or the like. One example of a message analytic appliance is an email analytic appliance is a FireEye® EX™ security platform manufactured by FireEye, Inc. of Milpitas, Calif. The email analytic appliance performs an analysis on email messages directed to the first customer in efforts to determine whether there is a high probability of the email messages being part of a malicious attack.
[0019] Thereafter, the management platform qualifies heuristics associated with the IOCs from the second customer. In qualifying these heuristics, the management platform determines whether or not a triggering event has occurred, which causes a predictive analysis to be conducted on the detected IOCs from the second customer. According to one embodiment of the disclosure, the triggering event may include a significant increase or shift in volume of a given type of IOC by a particular (second) customer, where the increase or shift exceeds a prescribed threshold (e.g., a prescribed total number, a selected increase or decrease in number or percentage, etc.). The triggering event signifies to the management platform that the particular customer has a prescribed likelihood (e.g., greater than 50%, greater than 70%, or greater than 90%) that it is experiencing a malicious attack.
[0020] After qualifying heuristics associated with the detected IOCs from the second customer, the management platform conducts a predictive analysis that evaluates whether these detected IOCs correspond to a set (e.g., a sequence, a particular group, etc.) of IOCs associated with known malware of a first message type that has been detected by another (first) customer. This first message type may include electronic mail (email) messaging having a format in accordance with RFC 5322 or another email format, text messaging having a format in accordance with Short Message Service (SMS), or any other recognized or proprietary communication format. For instance, the IOCs associated with known malware of a first electronic message type may include (1) a set of IOCs associated with an email message that has been previously detected at the first customer as being malicious, (2) a set of IOCs associated with a text message that has been previously detected at the first customer as being malicious, or another type of transmission. Whether the detected IOCs correspond to the set of IOCs is based on a selected degree of correlation needed between the detected IOCs and the set of IOCs associated with known malware of the first message type, where the level of correlation may be static in nature or may vary dynamically based on desired warning trigger levels, current work load of the management platform, or the like. This degree of correlation may also be referred to as “degree of correspondence”.
[0021] Thereafter, once the detected IOCs are initially determined to be associated with malware of the first message type (e.g., a non-detected malicious electronic message such as a malicious email message, a malicious text message, a malicious global satellite positioning “GPS” message, website post message, etc.), the predictive analysis conducted by the management platform further determines a threat level, which signifies a level of confidence that the detected IOCs are caused by a malicious electronic message. The threat level may be based, at least in part, on the degree of correspondence determined by the management platform between the detected IOCs from the second customer and the set of IOCs associated with known malicious messages. Also, the threat level may be based on the manner in which the IOCs associated with the malicious electronic message(s) have been uncovered. As an example, the threat level may be based, at least in part, on the following: (1) similarity in type or order of the detected IOCs to the set of IOCs associated with the malicious electronic message; (2) whether the set IOCs associated with the malicious electronic message were detected or observed; (3) timing of the detected IOCs compared to the IOCs associated with the malicious electronic message; and/or (4) a sudden change in magnitude (e.g., number) of one or more of the detected IOCs compared to the level before the IOC(s) were detected in malicious electronic message at first customer.
[0022] For instance, as an illustrative embodiment, the predictive analysis is conducted to determine a threat level based on (i) a qualification of heuristics at the second customer, (ii) a determination of correspondence between detected IOCs from the second customer and IOCs associated with one or more known malicious electronic messages from the first customer, and/or (iii) a determination as to the manner in which the IOCs from the first customer (and perhaps other customers) were uncovered (e.g., detected and/or observed IOCs). Where the management platform determines that the IOC(s) provided by the second customer correspond to one or more IOCs detected by the first customer, a first threat level is assigned.
[0023] Similarly, upon determining that the IOC(s) provided by the second customer correspond to one or more IOCs observed by the first customer, the management platform assigns a second threat level. Given that the first customer is actually observing IOCs rather than detecting IOCs through virtual processing operations observed in a run-time environment such as may be established in a virtual machine running in a threat detection platform (and implemented in a host, endpoint, server, dedicated appliance or other electronic device), a greater threat level may be assigned.
[0024] Lastly, where the management platform determines that the IOC(s) provided by the second customer correspond to one or more IOCs observed by multiple customers, including the first customer, a third threat level is assigned. The third threat level may signify a malware campaign is being conducted.
[0025] In summary, an embodiment of the invention is directed to utilizing IOCs that are correlated with malware that has infected a first customer (e.g., first source) in efforts to determine, based on analysis of IOCs detected at second customer (e.g., a different source than the first source), a likelihood that identical malware or similar malware (e.g., of the same malware family or polymorphic malware) has also infected one or more network devices at the second customer. This likelihood may be classified according to a plurality of threat levels that may be the same as or differ from the measured likelihood by the first customer of the IOCs being associated with malware. These threat levels may be based on whether the IOCs were detected (e.g., through static analysis of an object under analysis or dynamic processing of the object in a run-time environment) or observed in network traffic in flight or content (e.g., files) at rest as monitored by the first customer. However, it is contemplated that the threat levels may be associated with any threshold of associated maliciousness risk or probability, which may be static (fixed) or dynamic (variable, e.g., based on prevailing conditions and/or user threat tolerance and user preference at a particular time), in order to provide the second customer with information as to the likelihood of one of more network devices being infected with a certain type of known malware.
I. Terminology
[0026] In the following description, certain terminology is used to describe aspects of the invention. For example, in certain situations, both terms “logic” and “engine” are representative of hardware, firmware and/or software that is configured to perform one or more functions. As hardware, logic (or engine) may include circuitry having data processing or storage functionality. Examples of such processing circuitry may include, but is not limited or restricted to one or more processors or processor cores; a programmable gate array; a microcontroller; an application specific integrated circuit; receiver, transmitter and/or transceiver circuitry; semiconductor memory; or combinatorial logic.
[0027] Logic (or engine) may be in the form of one or more software modules, such as executable code in the form of an executable application, an application programming interface (API), a subroutine, a function, a procedure, an applet, a servlet, a routine, source code, object code, a shared library/dynamic load library, or one or more instructions. These software modules may be stored in any type of a suitable non-transitory storage medium, or transitory storage medium (e.g., electrical, optical, acoustical or other form of propagated signals such as carrier waves, infrared signals, or digital signals). Examples of a “non-transitory storage medium” may include, but are not limited or restricted to a programmable circuit; non-persistent storage such as volatile memory (e.g., any type of random access memory “RAM”); persistent storage such as non-volatile memory (e.g., read-only memory “ROM”, power-backed RAM, flash memory, phase-change memory, etc.), a solid-state drive, hard disk drive, an optical disc drive, or a portable memory device; and/or a semiconductor memory. As firmware, the executable code is stored in persistent storage.
[0028] The term “message” generally refers to information transmitted in a prescribed format, where each message may be in the form of one or more packets or frames, a Hypertext Transfer Protocol (HTTP) based transmission, or any other series of bits having the prescribed format. For instance, a message may include an electronic message such as an electronic mail (email) message; a text message in accordance with a SMS-based or non-SMS based format; an instant message in accordance with Session Initiation Protocol (SIP); or a series of bits in accordance with another messaging protocol. The message may be part of a “flow,” namely a series of related packets that are communicated during a single communication session (e.g., Transport Control Protocol “TCP” session), between a source network device and a destination network device.
[0029] The term “malware” may be broadly construed as any information or action that is directed to adversely affect or disrupt operability of an electronic device, surreptitiously gather stored information and/or gain access to systems, or cause human interaction that results in unintended or unexpected outcomes. The malware may include an exploit that takes advantage of a software vulnerability, an advanced persistent threat (APT), or the like.
[0030] The term “transmission medium” is a physical or logical communication path within a network device such as an endpoint device, which is an electronic device with data processing and/or network connectivity such as, for example, a server; a stationary or portable computer including a desktop computer, laptop, electronic reader, netbook or tablet; a smart phone; a video-game console; wearable technology (e.g., watch phone, etc.). For instance, the communication path may include wired and/or wireless segments. Examples of wired and/or wireless segments include electrical wiring, optical fiber, cable, bus trace, or a wireless channel using infrared, radio frequency (RF), or any other wired/wireless signaling mechanism.
[0031] The term “computerized” generally represents that any corresponding operations are conducted by hardware in combination with software and/or firmware. Also, a “set” of items generally relates a plurality of items although, in some case, a set may be broadly defined as including a single item. One type of “set” is a “sequence” of items that feature a particular order of occurrence.
[0032] Lastly, the terms “or” and “and/or” as used herein are to be interpreted as inclusive or meaning any one or any combination. Therefore, “A, B or C” or “A, B and/or C” mean “any of the following: A; B; C; A and B; A and C; B and C; A, B and C.” An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.
[0033] As this invention is susceptible to embodiments of many different forms, it is intended that the present disclosure is to be considered as an example of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.
II. General Architecture
[0034] Referring to FIG. 1 , an exemplary block diagram of a communication network 100 deploying an embodiment of the invention is shown. Herein, the communication network 100 comprises a management platform 110 communicatively coupled to a plurality of customers 1201-120M (M≧2, M=2 for this embodiment) via a network 130. The network 130 may include a public network such as the Internet, a private network (e.g., a local area network “LAN”, wireless LAN, etc.), or a combination thereof. It is contemplated that the number and type of customers 1201-120M, which are communicatively coupled to the same management platform 110, may be selected based on a variety of parameters, including industry or agency type (e.g., technology, manufacturing, energy, health care, entertainment, financial services, banking, governmental, etc.); field type (e.g., electronic component manufacturing, Internet services, etc.); geographical location of the customer; and/or requested level of service. It is contemplated that the grouping of customers 1201-120M based on certain parameters may improve detection as some malicious attacks may be industry, field and/or geographic specific.
[0035] Herein, each customer 1201, . . . , or 120M may be broadly construed as a network-based entity, which includes one or more threat detection platforms (TDPs) where each TDP is configured to analyze information propagating into and/or from the network-based entity and upload one or more detected indicators of compromise (IOCs) destined for the management platform 110. The network-based entity may represent an organization, a subset of the organization (e.g. a subsidiary where different customers may be different subsidiaries that are part of the same parent organization, a division, group, etc.), a particular enterprise network, or the like.
[0036] According to one embodiment of the disclosure, as shown in FIG. 1 , the first customer 1201 may include, at least in part, one or more threat detection platforms (TDPs), such as a first TDP 1401 and a second TDP 1402 for this embodiment. As shown, the first TDP 1401 is a network device that includes message analysis logic 150 and a second TDP 1402 is a network device operating as a web-based security appliance that includes network traffic analysis logic 160. Similarly, a second customer 1202 may include, at least in part, one or more threat detection platforms (TDPs), such as a third TDP 1403 in this embodiment.
[0037] As described below in detail, the message analysis logic 150 of the first TDP 1401 is configured to conduct a specific analysis of the content of a message of a first format type (e.g., email messages, text messages, etc.) transmitted and/or received over the network 130. Based on this analysis, the first TDP 1401 is capable of determining whether a malicious attack originated from a malicious electronic message and the particular malicious electronic message. The second network traffic analysis logic 160 of the second TDP 1402 is configured to conduct an analysis of information associated with network traffic over the network 130 in efforts to determine if this information suggests the presence of a malicious attack. But, without the first TDP 1401, the second TDP 1402 is unable to determine whether the origin of the malicious attack is from a malicious electronic message.
[0038] More specifically, according to one embodiment of the disclosure, the first TDP 1401 is deployed in a customer's public network (sometimes referred to as the “Demilitarized Zone” or “DMZ”), where email servers most often reside. Of course, the location of the TDP 1401 may vary, provided that the TDP 1401 has access to the communication path of the transmitted messages and is communicatively coupled to the management platform 110. For instance, the TDP 1401 could be deployed outside of customer's premises. For instance, where the message is a SMS message, the TDP 1401 could be deployed in a cell carrier network. Furthermore, the TDP 1401 may be part of cloud services, or even deployed within an endpoint device (e.g., smartphone, computer, etc.).
[0039] Herein, the message analysis logic 150 enables the first TDP 1401 to operate, at least in part, as an email analytic appliance by performing an analysis of one or more portions of an incoming email message, namely its header, content, links and/or attachments. This analysis may be performed by one or more virtual machines (hereinafter “virtual machine(s)” or “VM(s)” 170) deployed within the first TDP 1401. Each of the virtual machine(s) may be configured with a software profile, which corresponds to a particular message management application (e.g., Microsoft® Outlook, iPad™ native email application, native email application on Windows® Phone 8, etc.) that is being used by a network device deployed within the same enterprise network as the first TDP 1401. The virtual machine(s) may be configured to support concurrent virtual execution of a variety of different software configurations in efforts to verify that a malicious email message is part of a malicious attack.
[0040] The virtual machine(s), in combination with other logic (e.g., processing logic 175) within the first TDP 1401, are adapted to simulate the receipt and execution of content associated with the malicious email message within a run-time environment as expected by the email message. For instance, the processing logic 175 is configured to emulate and provide anticipated signaling to the virtual machine(s) during virtual processing.
[0041] As an example, the processing logic 175 may be adapted to provide, and sometimes modify, information (e.g., an Internet Protocol “IP” address, etc.) associated with an email message under analysis in order to control return signaling back to a virtual execution environment that includes the virtual machines. Hence, the processing logic 175 may suppress (e.g., discard) the return network traffic so that the return network traffic is not transmitted to the network 130.
[0042] Unlike the first TDP 1401, both the second TDP 1402 and the third TDP 1403 include network traffic analysis logic 160, which operates as a web-based security appliance by analyzing information associated with network traffic over the network 130 to determine if the information suggests the occurrence of a malicious attack. By itself without operability of the first TDP 1401, neither the second TDP 1402 nor the third TDP 1403 is able to determine the origin of the malicious attack. An illustrative example of the network traffic analysis logic 160 is illustrated as the MCD System in a prior U.S. patent application entitled “Dynamically Remote Tuning of Malware Content Detection System,” U.S. patent application Ser. No. 14/231,216 filed Mar. 31, 2014, the contents of which are incorporated by reference.
[0043] Referring still to FIG. 1 , the management platform 110 is adapted to receive information from the plurality of customers 1201-120M, notably TDPs 1401-1403. As shown, the first TDP 1401 and the second TDP 1402 are associated with the first customer 1201 and the third TDP 1403 is associated with a second customer 1202. Upon receipt of information from the TDPs 1401-1403, the management platform 110 qualifies heuristics associated with the received information in order to determine if the received information indicates that a malicious attack is occurring. Of course, certain heuristics may be specifically selected for analysis during the qualification operations, as these specific heuristics may be directed to functionality normally targeted by a malware attack via a malicious email message. The “heuristics” may encompass rules, policies, statistics, signatures, hash values, or other determinative attributes or characteristics of received information under analysis, and thus, qualification of the heuristics involves analysis of the received information based on the heuristics.
[0044] As an illustrative example, after receipt of received information including indicators of compromise (IOCs), namely information associated with anomalous behaviors detected by network traffic analysis logic 160 within the TDP 1403, the management platform 110 qualifies the heuristics associated with the IOCs in order to determine whether a triggering event has occurred, which identifies that a malicious (email-based) attack may be occurring at the second customer 1202. For instance, the management platform 110 may determine whether a particular IOC-based threshold has been met (e.g., exceeds or falls below the threshold). As an example, the particular IOC-based threshold may be associated with an average number of a certain type of IOC detected by multiple TDPs with network traffic analysis logic (or perhaps TDP 1403 by itself) over a prescribed amount of time. This threshold is met if the detected IOCs are equal to or greater in number that the IOC average. Of course, other types of thresholds may be used, including a preselected number of total IOCs that may be dependent or independent of type, mere presence of a particular type of IOC, or the like.
[0045] If the IOC heuristics have been qualified, the management platform 110 conducts a predictive analysis associated with the detected IOCs received from the TDP 1403 to determine if these IOCs correspond to a set of IOCs associated with known malware of a first message type that are provided from the TDP 1401. For instance, the amount of similarity between the detected IOCs and the set of IOCs associated with the known malware of the first message type in order to determine whether the detected IOCs correspond to the set of IOCs may be static or dynamic in nature (e.g., the degree of correspondence between detected IOCs and the IOCs associated with the known malware may vary based on the operating state of the management platform 110). For instance, when the management platform 110 is operating in a first operating state, the degree of correspondence may be set at a high level where the detected IOCs need to be present and in the same chronological order as the set of IOCs associated with the known malware. Alternatively, when the management platform 110 is operating in a second operating state, the degree of correspondence may be set at a lower level where the detected IOCs correspond to the known malware IOCs if multiple (but not all) IOCs of the detected IOCs are present in the set of IOCs.
[0046] When the IOC heuristics have been qualified and the predictive analysis concludes, with a certain degree of confidence that the detected IOCs are associated with a malicious attack originating from a malicious email message, the management platform 110 determines a type of response. As an illustrative example, the management platform 110 may adjust the threat level, which is associated with the degree of confidence that the detected IOCs are caused by a malicious electronic message, based on whether the set of IOCs associated with the known malware of the first message type are detected by the TDP 1201 during static and/or virtual processing of the malicious electronic message or are actual observed behavior(s) by a network device communicatively coupled to the TDP 1403. Herein, actual observed behavior(s) are assigned a higher threat level than detected behavior(s). More details of the assignment of threat level are described in FIG. 6 .
[0047] Referring now to FIG. 2A , a block diagram of an exemplary embodiment of the management platform 110 is shown. Herein, the management platform 110 includes processing circuitry 200 that are coupled to communication interface logic 210 via a first transmission medium 220. Communication interface logic 210 enables communications with customers 1201-120M, notably one or more TDP 1401-1403 deployed by the customers as shown in FIG. 1 . According to one embodiment of the disclosure, communication interface logic 210 may be implemented as a physical interface including one or more ports for wired connectors. Additionally, or in the alternative, communication interface logic 210 may be implemented with one or more radio units for supporting wireless communications with other electronic devices.
[0048] As shown, processing circuitry 200 is further coupled to a data storage 230, IOC management logic 240, predictive analysis logic 250, alert generation logic 260 and remediation logic 270. According to one embodiment of the disclosure, the IOC management logic 240 is configured to acquire information associated with detected and/or observed anomalous behaviors (IOCs) from the customers 1201-120M, where the IOCs may be acquired based upon actions by security personnel manually controlling the maintenance platform 110 to obtain the IOCs in response to an event or an elapsed period of time. Alternatively, the IOCs from the customers 1201-120M may be received automatically in accordance with a periodic or aperiodic uploading of the IOCs. The uploading may be accomplished by a push, pull or polling technique in which the TDPs 1401-1403 are configured to automatically transmit the IOCs in response to an activity (e.g., detection of the triggering event that identifies that a malicious, email-based attack may be occurring) and/or expiration of an elapsed period of time.
[0049] Upon receiving IOCs from TDPs 1401-1403 shown in FIG. 1 , the IOC management logic 240 stores the received IOCs within the data store 230, which may be organized to identify which IOCs are received from which customers and which IOCs are associated with known malware associated with a particular message type. For instance, the IOCs may be organized to identify which IOCs are associated with known malicious electronic messages, where these IOCs include the anomalous behaviors and/or metadata associated with the malicious electronic messages. Examples of the metadata may include the arrival time of the message and/or profile information associated with the recipient, which may include one or more of the following: geographical origin of the recipient, group membership, company type, industry type, or the like.
[0050] Thereafter, the IOC management logic 240 qualifies heuristics associated with the detected IOCs from the third TDP 1403 of FIG. 1 by determining whether a triggering event has occurred to denote that a malicious attack due to a non-detected malicious electronic message may be occurring at the second customer 1202. The triggering event activates predictive analysis logic 250, which causes a predictive analysis to be conducted on the detected IOCs from the second customer 1202 of FIG. 1 . As described above, the triggering event may include an increase or shift in volume of a given type of IOC by a particular (second) customer that exceeds a prescribed threshold.
[0051] More specifically, the predictive analysis logic 250 conducts a predictive analysis that evaluates whether the detected IOCs from the second customer 1202 of FIG. 1 correspond to a set of IOCs associated with known malware of a first message type that has been detected by another customer (e.g., first customer 1201). For instance, the set of IOCs may be associated with a known type of malicious email message or a known type of malicious text message.
[0052] Thereafter, once the detected IOCs are initially determined to be associated with a non-detected malicious (email or text) message, the predictive analysis logic 250 further determines a threat level, which signifies a degree of confidence that the detected IOCs are caused by a malicious email message or a malicious text message. The threat level may be based, at least in part, on the degree of correspondence determined by the predictive analysis logic 250 between the detected IOCs from the second customer 1202 of FIG. 1 and the set of IOCs associated with known malicious electronic messages. Additionally, the threat level may be based on the manner in which the set of IOCs associated with the malicious electronic message(s) was uncovered, where observed IOCs provide a greater weighting and a higher threat level than detected IOCs and observations by multiple customers increase the threat level.
[0053] The alert generation logic 260 and the remediation logic 270 perform operations based, at least in part, on the determined threat level. For instance, in response to computation of a first threat level, the alert generation logic 260 may merely issue an alert to security personnel of the second customer. However, in response to computation of a first threat level, the alert generation logic 260 may generate multiple alerts, in which the alerts may be sent through different mediums (e.g., network email, text message, automated cellular telephone call, etc.). Also, the remediation logic 270 may operate to provide suggested actions to remediate the potential malicious email message (e.g., search email servers for email messages associated with a particular phrase in the subject line or originating from a particular domain, specific attachment, specific size, originated from a specific source IP or MAC address, arrival time within a particular time period (e.g., range in minutes, hours or days), block the potential malicious email message from being opened or processed, and/or automatically delete the potential malicious email message with or without user notification).
[0054] Referring now to FIG. 2B , a block diagram of an exemplary embodiment of a logical representation of the management platform 110 is shown. Herein, the management platform 110 includes processing circuitry 200 that are coupled to the communication interface logic 210 via the first transmission medium 220 as well as the data store 230 and persistent storage 280 via a second transmission medium 225.
[0055] According to one embodiment of the disclosure, persistent storage 280 may include (a) the IOC management logic 240; (b) the predictive analysis logic 250; (c) the alert generation logic 260; and (d) the remediation logic 270. Of course, when implemented partially or fully in hardware, one or more of these logic units could be implemented separately from each other.
[0056] Referring now to FIG. 3 , an illustrative embodiment of the operations conducted by the management platform 110 of FIG. 1 for conducting a predictive analysis, based on IOCs provided from a first customer, to determine that a malicious attack is being conducted by a malicious electronic message on a second customer is shown. The management platform 110 receives and stores IOC information from a plurality of customers, including at least one set of IOCs associated with known malicious electronic message from the first customer and detected IOCs from the second customer (blocks 300 and 310).
[0057] Thereafter, the management platform qualifies heuristics associated with the detected IOCs from the second customer in order to establish evidence of a potential presence of a malicious electronic message of a first message type at the second customer (block 320). Thereafter, the management platform evaluates heuristics associated with selected IOCs, which may be part or all of the detected IOCs, and determines if the evaluated heuristics qualify for issuance of an alert message and/or remediation (blocks 330 and 340).
[0058] Referring to FIG. 4 , a detailed embodiment of the operations conducted by the management platform as set forth in FIG. 3 for conducting predictive analysis is shown. The management platform 110 receives and stores IOC information from a plurality of customers, including at least one set of IOCs associated with known malicious electronic message from the first customer and detected IOCs from the second customer (blocks 400 and 410).
[0059] Thereafter, the management platform qualifies heuristics associated with the IOCs from the second customer by determining whether a triggering event has occurred that causes a predictive analysis to be conducted on the detected IOCs from the second customer (block 420). For instance, as an illustrative example, the triggering event may include a condition where the detected IOCs from the second customer indicate that a selected threshold has been met (e.g., a particular increase or decrease in volume of a given type or types of IOCs has occurred, etc.).
[0060] After determining that a triggering event has occurred, the management platform conducts a predictive analysis that evaluates whether these detected IOCs correspond to a set of IOCs associated with known malware of a first message type that has been detected by first customer (blocks 430 and 435). For instance, as an illustrative example, the ordering and content of the IOCs are compared with the set of IOCs.
[0061] Thereafter, once the detected IOCs are determined to correspond to the set of IOCs, a predictive analysis is conducted by the management platform to determine a threat level that signifies a degree of confidence that the detected IOCs are caused by a malicious electronic message (block 440). The threat level may be based, at least in part, on a qualification of heuristics at the second customer, such as the degree of correspondence determined by the management platform between the detected IOCs from the second customer and the set of IOCs associated with known malicious electronic messages. Also, the threat level may be based on the manner in which the IOCs associated with the malicious electronic message(s) were uncovered. As an example, the threat level may be based, at least in part, on the following: (1) similarity of the detected IOCs to the set of IOCs associated with the malicious electronic message; (2) whether the set IOCs associated with the malicious electronic message were detected or observed; and/or (3) timing of the detected IOCs compared to the IOCs associated with the malicious electronic message.
[0062] As an illustrative embodiment, as shown in FIG. 5 , a first determination is made as to whether there is sufficient qualification of IOC heuristics at the second customer compared to IOCs detected at the first customer and associated with a malicious electronic message (block 500). If there are sufficient qualifications in that the detected IOCs of the second customer correspond to IOCs detected by the first customer, a first threat level is assigned (block 510). Otherwise, no threat level is assigned to signify that there is no apparent correspondence between the detected IOCs at the second customer and IOCs associated with a malicious electronic message.
[0063] Thereafter, a second determination is made as to whether there is sufficient qualification of IOC heuristics at the second customer compared to IOCs observed at the first customer and associated with a malicious electronic message (block 520). If there are sufficient qualifications in that the detected IOCs of the second customer correspond to IOCs observed by the first customer, a second threat level is assigned (block 530). Otherwise, the predictive analysis maintains that the detected IOCs from the second customer to the assigned first threat level.
[0064] Lastly, a third determination is made as to whether there is sufficient qualification of IOC heuristics at the second customer compared to IOCs observed at multiple customers, inclusive of the first customer (block 540). If there are sufficient qualifications in that the detected IOCs of the second customer correspond to IOCs observed by multiple customers including the first customer, a third threat level is assigned (block 550). Otherwise, the predictive analysis maintains that the detected IOCs from the second customer to the assigned second threat level.
[0065] Referring back to FIG. 4 , a particular type of response is selected based on the determined threat level (block 450). For instance, in accordance with an illustrative embodiment shown in FIG. 6 , after the management platform has determined the threat level associated with detected IOCs under analysis from the second customer (block 600), the threat level is used to determine the response type (blocks 610-650). More specifically, if the qualification results in a first threat level, a first level response is conducted (blocks 610 and 620). As an illustrative example, an alert message may be sent to security personnel associated with the second customer with information pertaining to a potential malicious email message that may be stored within one of its email servers.
[0066] Similarly, if the qualification results in a second threat level, a second level response is conducted (blocks 630 and 640). The second level response may be assigned higher urgency than the first level response. For example, an alert message may be sent to security personnel associated with the second customer with information pertaining to a potential malicious email message that may be stored within one of its email servers along with additional information including contact information for security personnel and/or marketing representatives associated with the management platform.
[0067] Otherwise, the qualification resulted in a third threat level, and thus, warrants that a third level response is conducted (block 650). The third level response may be assigned the highest urgency. For example, multiple alert messages may be sent to security personnel associated with the second customer with information pertaining to a potential malicious email message that may be stored within one of its email servers. These alert messages may be successive or through different mediums (e.g., email message, text message over a cellular network, etc.). Additionally, additional information including contact information for security personnel and/or marketing representatives associated with the management platform may be provided.
[0068] In lieu of transmitting messages to the customers as shown in FIG. 6 , as an alternative embodiment, the particular type of response selected may be directed as to whether a report should be generated that provides aggregated data of potential malicious electronic messages that have not been detected by customers without an email analytic appliance. Herein, as shown in FIG. 7 , the management platform determines threat levels for the detected IOCs associated with a plurality of customers without message analytic appliances (block 700). The data associated with the detected IOCs and corresponding threat levels are aggregated based on selected aggregation groups (block 710). These aggregation groups may be subsets or supersets of the grouping supported by the management platform. After aggregating the data associated with the detected IOC(s) and the corresponding threat level information, the management platform generates reports that provide such information according to the selected aggregation groups (block 720).
[0069] In the foregoing description, the invention is described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended claims. For instance, the above-described analysis is applicable to electronic messages as well as other types of objects under analysis (e.g. Portable Document Format “PDF” documents, executables, web downloads, etc.).
Claims
What is claimed is:
1. An electronic device, comprising:
a communication interface;
a processor coupled to the communication interface; and
a memory coupled to the processor, the memory includes
a first logic that, when executed by the processor, organizes (i) a set of indicators of compromise (IOCs) received from a first source via the communication interface, where the set of IOCs have been caused by a known malware associated with a first message type, and (ii) one or more IOCs received from a second source via the communication interface, the second source being different from the first source where a cause of the one or more IOCs is unknown, and
a second logic that, when executed by the processor, (i) conducts a predictive analysis that evaluates whether the one or more IOCs have a prescribed degree of correlation with the set of IOCs caused by the known malware associated with the first message type, and (ii) determine a threat level, which signifies a degree of confidence that the one or more IOCs received from the second source are caused by the known malware.
2. The electronic device of claim 1, wherein the set of IOCs caused by the known malware includes a plurality of IOCs associated with an electronic mail message that has been previously detected at the first source as being malicious.
3. The electronic device of claim 1, wherein the set of IOCs caused by the known malware includes a plurality of IOCs associated with a text message that has been previously detected at the first source as being malicious.
4. The electronic device of claim 1, wherein the communication interface is a wireless transceiver that establishes a communicative coupling to a network and receives the set of IOCs and the one or more IOCs via the network.
5. The electronic device of claim 4, wherein the network is a public network.
6. The electronic device of claim 1, wherein the second logic determines whether the one or more IOCs received from the second source have the prescribed degree of correlation to the set of IOCs received from the first source in response to a triggering event that signifies a prescribed likelihood that the one or more IOCs from the second source are caused by an undetected malicious electronic message present at the second source.
7. The electronic device of claim 6, wherein the triggering event includes a shift in volume of a given type of IOC at the second source.
8. The electronic device of claim 7, wherein the shift in volume of the given type of IOC at the second source includes an increase in volume of the given type of IOC at the second source that exceeds a prescribed threshold.
9. The electronic device of claim 1, wherein the second logic, when executed by the processor, evaluates whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source by determining whether a particular number of the one or more IOCs received from the second source are present and in the same chronological order as in the set of IOCs associated with the known malware.
10. The electronic device of claim 9, wherein the degree of correspondence for evaluating whether the one or more IOCs from the second source correspond to the set of IOCs received from the first source is dynamic.
11. The electronic device of claim 1, wherein the conducting of the predictive analysis to determine whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source further comprises
determining the degree of correlation between the one or more IOCs and the set of IOCs identified as being caused by the known malware;
generating at least one alert in response to the degree of correlation exceeding a prescribed threshold.
12. The electronic device of claim 11, wherein the second logic, after determining the threat level, selects a particular type of alert based on the determined threat level.
13. The electronic device of claim 12, wherein the second logic, after determining the threat level, generates (i) a first type of alert being a transmission of a message to security personnel of the second source in response to a first threat level and (ii) a second type of alert being multiple transmissions of a message through different mediums that include at least any two of a group consisting of (a) an electronic message via the network, (b) a text message, and (c) an automated cellular telephone call.
14. The electronic device of claim 1, wherein the second logic, when executed by the processor, determines the threat level based, at least in part, on a timing of the one or more IOCs compared to a timing of the set of IOCs, the first message type includes an electronic message.
15. The electronic device of claim 1, wherein the communication interface is communicatively coupled to the first source and the second source via a network, the first source being a network device that includes message analysis logic and the second source being a network device operating as a web-based security appliance.
16. A computerized method for malware detection conducted by a network device including processing circuitry and a data store, comprising:
receiving a plurality of indicators of compromise (IOCs) from a first source, the plurality of IOCs identified as being caused by a known malware associated with a first message type;
receiving one or more IOCs from a second source that is different from the first source; and
conducting a predictive analysis of the one or more IOCs received from the second source to determine whether the one or more IOCs from the second source correspond to the plurality of IOCs received from the first source, the predictive analysis includes (i) determining a threat level associated with the one or more IOCs, the threat level signifies a degree of confidence that the one or more IOCs are caused by a malicious electronic message, and (ii) selecting a particular type of response based on the determined threat level,
wherein information associated with at least the plurality of IOCs is used to determine a presence of malware associated with the first message type at the second source that is currently undetected and is the cause of the one or more IOCs at the second source.
17. The computerized method of claim 16, wherein the plurality of IOCs includes a plurality of IOCs associated with either an email message or a text message that has been previously detected at the first source as being malicious.
18. The computerized method of claim 16, wherein the conducting the predictive analysis of the one or more IOCs received from the second source occurs in response to a triggering event, the triggering event includes an increase in volume of a given type of IOC at the second source that exceeds a prescribed threshold.
19. The computerized method of claim 16, wherein the conducting the predictive analysis of the one or more IOCs received from the second source comprises determining whether the one or more IOCs received from the second source are present and in the same chronological order as a corresponding set of IOCs of the plurality of IOCs associated with the known malware.
20. An electronic device, comprising:
one or more hardware processors; and
a memory coupled to the one or more hardware processors, the memory includes
a first logic that, when executed by the one or more hardware processors, organizes (i) a set of indicators of compromise (IOCs) received from a first source, where the set of IOCs have been caused by a known malware associated with a first message type, and (ii) one or more IOCs received from a second source, the second source being different from the first source where a cause of the one or more IOCs is unknown, and
a second logic that, when executed by the one or more hardware processors, (i) conducts an analysis that evaluates whether the one or more IOCs have a prescribed degree of correlation with the set of IOCs caused by the known malware associated with the first message type, and (ii) determine a threat level, which signifies a degree of confidence that the one or more IOCs received from the second source are caused by the known malware.
21. A non-transitory storage medium implemented with software for execution by one or more hardware processors, the non-transitory storage medium comprising:
a first logic that, stored in the non-transitory storage medium and upon execution by the one or more hardware processors, organizes (i) a set of indicators of compromise (IOCs) received from a first source, where the set of IOCs have been caused by a known malware associated with a first message type, and (ii) one or more IOCs received from a second source, the second source being different from the first source where a cause of the one or more IOCs is unknown, and
a second logic that, stored in the non-transitory storage medium and upon execution by the one or more hardware processors, (i) conducts an analysis that evaluates whether the one or more IOCs have a prescribed degree of correlation with the set of IOCs caused by the known malware associated with the first message type, and (ii) determine a threat level, which signifies a degree of confidence that the one or more IOCs received from the second source are caused by the known malware.
22. The non-transitory storage medium of claim 21, wherein the set of IOCs caused by the known malware includes a plurality of IOCs associated with an electronic mail message that has been previously detected at the first source as being malicious.
23. The non-transitory storage medium of claim 21, wherein the set of IOCs caused by the known malware includes a plurality of IOCs associated with a text message that has been previously detected at the first source as being malicious.
24. The non-transitory storage medium of claim 21 being implemented within an electronic device that comprises a communication interface communicatively coupled to the one or more hardware processors, the communication interface includes a wireless transceiver that establishes a communicative coupling to a network and receives the set of IOCs and the one or more IOCs via the network.
25. The non-transitory storage medium of claim 24 being implemented within the electronic device including the wireless transceiver communicatively coupled to the network being a public network.
26. The non-transitory storage medium of claim 24 being implemented within the electronic device including the communication interface that is communicatively coupled to the first source and the second source via a network, the first source being a network device that includes message analysis logic and the second source being a network device operating as a web-based security appliance.
27. The non-transitory storage medium of claim 21, wherein the second logic determines whether the one or more IOCs received from the second source have the prescribed degree of correlation to the set of IOCs received from the first source in response to a triggering event that signifies a prescribed likelihood that the one or more IOCs from the second source are caused by an undetected malicious electronic message present at the second source.
28. The non-transitory storage medium of claim 27, wherein the triggering event includes a shift in volume of a given type of IOC at the second source.
29. The non-transitory storage medium of claim 28, wherein the shift in volume of the given type of IOC at the second source includes an increase in volume of the given type of IOC at the second source that exceeds a threshold.
30. The non-transitory storage medium of claim 21, wherein the second logic, when executed by the one or more hardware processors, evaluates whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source by determining whether a particular number of the one or more IOCs received from the second source are present and in the same chronological order as in the set of IOCs associated with the known malware.
31. The non-transitory storage medium of claim 30, wherein the degree of correspondence for evaluating whether the one or more IOCs from the second source correspond to the set of IOCs received from the first source is dynamic.
32. The non-transitory storage medium of claim 21, wherein the conducting of the analysis to determine whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source further comprises
determining the degree of correlation between the one or more IOCs and the set of IOCs identified as being caused by the known malware;
generating at least one alert in response to the degree of correlation exceeding a threshold.
33. The non-transitory storage medium of claim 21, wherein the second logic, after determining the threat level, selects a particular type of alert based on the determined threat level.
34. The non-transitory storage medium of claim 33, wherein the second logic, after determining the threat level, generates (i) a first type of alert being a transmission of a message to security personnel of the second source in response to a first threat level and (ii) a second type of alert being multiple transmissions of a message through different mediums that include at least any two of a group consisting of (a) an electronic message via the network, (b) a text message, and (c) an automated cellular telephone call.
35. The non-transitory storage medium of claim 21, wherein the second logic, when executed by the processor, determines the threat level based, at least in part, on a timing of the one or more IOCs compared to a timing of the set of IOCs, the first message type includes an electronic message.
Patent Citations (557)
| Patent | Date | Inventor | Cited By |
|---|---|---|---|
| US4292580(A) | 1981-09-01 | Ott et al. | Applicant |
| US5175732(A) | 1992-12-01 | Hendel et al. | Applicant |
| US5440723(A) | 1995-08-01 | Arnold et al. | Applicant |
| US5490249(A) | 1996-02-01 | Miller | Applicant |
| US5657473(A) | 1997-08-01 | Killean et al. | Applicant |
| US5842002(A) | 1998-11-01 | Schnurer et al. | Applicant |
| US5978917(A) | 1999-11-01 | Chi | Applicant |
| US6088803(A) | 2000-07-01 | Tso et al. | Applicant |
| US6094677(A) | 2000-07-01 | Capek et al. | Applicant |
| US6108799(A) | 2000-08-01 | Boulay et al. | Applicant |
| US6118382(A) | 2000-09-01 | Hibbs et al. | Applicant |
| US6269330(B1) | 2001-07-01 | Cidon et al. | Applicant |
| US6272641(B1) | 2001-08-01 | Ji | Applicant |
| US6279113(B1) | 2001-08-01 | Vaidya | Applicant |
| US6298445(B1) | 2001-10-01 | Shostack et al. | Applicant |
| US6357008(B1) | 2002-03-01 | Nachenberg | Applicant |
| US6417774(B1) | 2002-07-01 | Hibbs et al. | Applicant |
| US6424627(B1) | 2002-07-01 | Sørhaug et al. | Applicant |
| US6442696(B1) | 2002-08-01 | Wray et al. | Applicant |
| US6484315(B1) | 2002-11-01 | Ziese | Applicant |
| US6487666(B1) | 2002-11-01 | Shanklin et al. | Applicant |
| US6493756(B1) | 2002-12-01 | O'Brien et al. | Applicant |
| US6550012(B1) | 2003-04-01 | Villa et al. | Applicant |
| US6700497(B2) | 2004-03-01 | Hibbs et al. | Applicant |
| US6775657(B1) | 2004-08-01 | Baker | Applicant |
| US6831893(B1) | 2004-12-01 | Ben Nun et al. | Applicant |
| US6832367(B1) | 2004-12-01 | Choi et al. | Applicant |
| US6895550(B2) | 2005-05-01 | Kanchirayappa et al. | Applicant |
| US6898632(B2) | 2005-05-01 | Gordy et al. | Applicant |
| US6907396(B1) | 2005-06-01 | Muttik et al. | Applicant |
| US6941348(B2) | 2005-09-01 | Petry et al. | Applicant |
| US6971097(B1) | 2005-11-01 | Wallman | Applicant |
| US6981279(B1) | 2005-12-01 | Arnold et al. | Applicant |
| US6995665(B2) | 2006-02-01 | Appelt et al. | Applicant |
| US7007107(B1) | 2006-02-01 | Ivchenko et al. | Applicant |
| US7028179(B2) | 2006-04-01 | Anderson et al. | Applicant |
| US7043757(B2) | 2006-05-01 | Hoefelmeyer et al. | Applicant |
| US7069316(B1) | 2006-06-01 | Gryaznov | Applicant |
| US7080407(B1) | 2006-07-01 | Zhao et al. | Applicant |
| US7080408(B1) | 2006-07-01 | Pak et al. | Applicant |
| US7093239(B1) | 2006-08-01 | van der Made | Applicant |
| US7096498(B2) | 2006-08-01 | Judge | Applicant |
| US7100201(B2) | 2006-08-01 | Izatt | Applicant |
| US7107617(B2) | 2006-09-01 | Hursey et al. | Applicant |
| US7159149(B2) | 2007-01-01 | Spiegel et al. | Applicant |
| US7213260(B2) | 2007-05-01 | Judge | Applicant |
| US7231667(B2) | 2007-06-01 | Jordan | Applicant |
| US7240364(B1) | 2007-07-01 | Branscomb et al. | Applicant |
| US7240368(B1) | 2007-07-01 | Roesch et al. | Applicant |
| US7243371(B1) | 2007-07-01 | Kasper et al. | Applicant |
| US7249175(B1) | 2007-07-01 | Donaldson | Applicant |
| US7287278(B2) | 2007-10-01 | Liang | Applicant |
| US7308716(B2) | 2007-12-01 | Danford et al. | Applicant |
| US7328453(B2) | 2008-02-01 | Merkle, Jr. et al. | Applicant |
| US7346486(B2) | 2008-03-01 | Ivancic et al. | Applicant |
| US7356736(B2) | 2008-04-01 | Natvig | Applicant |
| US7386888(B2) | 2008-06-01 | Liang et al. | Applicant |
| US7392542(B2) | 2008-06-01 | Bucher | Applicant |
| US7418729(B2) | 2008-08-01 | Szor | Applicant |
| US7424745(B2) | 2008-09-01 | Cheston | Examiner |
| US7428300(B1) | 2008-09-01 | Drew et al. | Applicant |
| US7441272(B2) | 2008-10-01 | Durham et al. | Applicant |
| US7448084(B1) | 2008-11-01 | Apap et al. | Applicant |
| US7458098(B2) | 2008-11-01 | Judge et al. | Applicant |
| US7464404(B2) | 2008-12-01 | Carpenter et al. | Applicant |
| US7464407(B2) | 2008-12-01 | Nakae et al. | Applicant |
| US7467408(B1) | 2008-12-01 | O'Toole, Jr. | Applicant |
| US7478428(B1) | 2009-01-01 | Thomlinson | Applicant |
| US7480773(B1) | 2009-01-01 | Reed | Applicant |
| US7487543(B2) | 2009-02-01 | Arnold et al. | Applicant |
| US7496960(B1) | 2009-02-01 | Chen et al. | Applicant |
| US7496961(B2) | 2009-02-01 | Zimmer et al. | Applicant |
| US7519990(B1) | 2009-04-01 | Xie | Applicant |
| US7523493(B2) | 2009-04-01 | Liang et al. | Applicant |
| US7530104(B1) | 2009-05-01 | Thrower et al. | Applicant |
| US7540025(B2) | 2009-05-01 | Tzadikario | Applicant |
| US7565550(B2) | 2009-07-01 | Liang et al. | Applicant |
| US7568233(B1) | 2009-07-01 | Szor et al. | Applicant |
| US7584455(B2) | 2009-09-01 | Ball | Applicant |
| US7603715(B2) | 2009-10-01 | Costa et al. | Applicant |
| US7607171(B1) | 2009-10-01 | Marsden et al. | Applicant |
| US7639714(B2) | 2009-12-01 | Stolfo et al. | Applicant |
| US7644441(B2) | 2010-01-01 | Schmid et al. | Applicant |
| US7657419(B2) | 2010-02-01 | van der Made | Applicant |
| US7676841(B2) | 2010-03-01 | Sobchuk et al. | Applicant |
| US7698548(B2) | 2010-04-01 | Shelest et al. | Applicant |
| US7707633(B2) | 2010-04-01 | Danford et al. | Applicant |
| US7712136(B2) | 2010-05-01 | Sprosts et al. | Applicant |
| US7730011(B1) | 2010-06-01 | Deninger et al. | Applicant |
| US7739740(B1) | 2010-06-01 | Nachenberg et al. | Applicant |
| US7779463(B2) | 2010-08-01 | Stolfo et al. | Applicant |
| US7784097(B1) | 2010-08-01 | Stolfo et al. | Applicant |
| US7836502(B1) | 2010-11-01 | Zhao et al. | Applicant |
| US7849506(B1) | 2010-12-01 | Dansey et al. | Applicant |
| US7854007(B2) | 2010-12-01 | Sprosts et al. | Applicant |
| US7869073(B2) | 2011-01-01 | Oshima | Applicant |
| US7877803(B2) | 2011-01-01 | Enstone et al. | Applicant |
| US7904959(B2) | 2011-03-01 | Sidiroglou et al. | Applicant |
| US7908660(B2) | 2011-03-01 | Bahl | Applicant |
| US7930738(B1) | 2011-04-01 | Petersen | Applicant |
| US7937761(B1) | 2011-05-01 | Bennett | Applicant |
| US7949849(B2) | 2011-05-01 | Lowe et al. | Applicant |
| US7996556(B2) | 2011-08-01 | Raghavan et al. | Applicant |
| US7996836(B1) | 2011-08-01 | McCorkendale et al. | Applicant |
| US7996904(B1) | 2011-08-01 | Chiueh et al. | Applicant |
| US7996905(B2) | 2011-08-01 | Arnold et al. | Applicant |
| US8006303(B1) | 2011-08-01 | Dennerline et al. | Applicant |
| US8006305(B2) | 2011-08-01 | Aziz | Applicant |
| US8010667(B2) | 2011-08-01 | Zhang et al. | Applicant |
| US8020206(B2) | 2011-09-01 | Hubbard et al. | Applicant |
| US8028338(B1) | 2011-09-01 | Schneider et al. | Applicant |
| US8042184(B1) | 2011-10-01 | Batenin | Applicant |
| US8045094(B2) | 2011-10-01 | Teragawa | Applicant |
| US8045458(B2) | 2011-10-01 | Alperovitch et al. | Applicant |
| US8069484(B2) | 2011-11-01 | McMillan et al. | Applicant |
| US8087086(B1) | 2011-12-01 | Lai et al. | Applicant |
| US8171553(B2) | 2012-05-01 | Aziz et al. | Applicant |
| US8176049(B2) | 2012-05-01 | Deninger et al. | Applicant |
| US8176480(B1) | 2012-05-01 | Spertus | Applicant |
| US8204984(B1) | 2012-06-01 | Aziz et al. | Applicant |
| US8214905(B1) | 2012-07-01 | Doukhvalov et al. | Applicant |
| US8220055(B1) | 2012-07-01 | Kennedy | Applicant |
| US8225373(B2) | 2012-07-01 | Kraemer | Applicant |
| US8233882(B2) | 2012-07-01 | Rogel | Applicant |
| US8234640(B1) | 2012-07-01 | Fitzgerald et al. | Applicant |
| US8234709(B2) | 2012-07-01 | Viljoen et al. | Applicant |
| US8239944(B1) | 2012-08-01 | Nachenberg et al. | Applicant |
| US8260914(B1) | 2012-09-01 | Ranjan | Applicant |
| US8266091(B1) | 2012-09-01 | Gubin et al. | Applicant |
| US8272060(B2) | 2012-09-01 | Milliken | Examiner |
| US8286251(B2) | 2012-10-01 | Eker et al. | Applicant |
| US8291499(B2) | 2012-10-01 | Aziz et al. | Applicant |
| US8307435(B1) | 2012-11-01 | Mann et al. | Applicant |
| US8307443(B2) | 2012-11-01 | Wang et al. | Applicant |
| US8312545(B2) | 2012-11-01 | Tuvell et al. | Applicant |
| US8321936(B1) | 2012-11-01 | Green et al. | Applicant |
| US8321941(B2) | 2012-11-01 | Tuvell et al. | Applicant |
| US8332571(B1) | 2012-12-01 | Edwards, Sr. | Applicant |
| US8365286(B2) | 2013-01-01 | Poston | Applicant |
| US8365297(B1) | 2013-01-01 | Parshin et al. | Applicant |
| US8370938(B1) | 2013-02-01 | Daswani et al. | Applicant |
| US8370939(B2) | 2013-02-01 | Zaitsev et al. | Applicant |
| US8375444(B2) | 2013-02-01 | Aziz et al. | Applicant |
| US8381299(B2) | 2013-02-01 | Stolfo et al. | Applicant |
| US8402529(B1) | 2013-03-01 | Green et al. | Applicant |
| US8464340(B2) | 2013-06-01 | Ahn et al. | Applicant |
| US8479174(B2) | 2013-07-01 | Chiriac | Applicant |
| US8479276(B1) | 2013-07-01 | Vaystikh et al. | Applicant |
| US8479291(B1) | 2013-07-01 | Bodke | Applicant |
| US8510827(B1) | 2013-08-01 | Leake et al. | Applicant |
| US8510828(B1) | 2013-08-01 | Guo et al. | Applicant |
| US8510842(B2) | 2013-08-01 | Amit et al. | Applicant |
| US8516478(B1) | 2013-08-01 | Edwards et al. | Applicant |
| US8516590(B1) | 2013-08-01 | Ranadive et al. | Applicant |
| US8516593(B2) | 2013-08-01 | Aziz | Applicant |
| US8522348(B2) | 2013-08-01 | Chen et al. | Applicant |
| US8528086(B1) | 2013-09-01 | Aziz | Applicant |
| US8533824(B2) | 2013-09-01 | Hutton et al. | Applicant |
| US8539582(B1) | 2013-09-01 | Aziz et al. | Applicant |
| US8549638(B2) | 2013-10-01 | Aziz | Applicant |
| US8555391(B1) | 2013-10-01 | Demir et al. | Applicant |
| US8561177(B1) | 2013-10-01 | Aziz et al. | Applicant |
| US8566928(B2) | 2013-10-01 | Dagon | Examiner |
| US8566946(B1) | 2013-10-01 | Aziz et al. | Applicant |
| US8578497(B2) | 2013-11-01 | Antonakakis | Examiner |
| US8584094(B2) | 2013-11-01 | Dadhia et al. | Applicant |
| US8584234(B1) | 2013-11-01 | Sobel et al. | Applicant |
| US8584239(B2) | 2013-11-01 | Aziz et al. | Applicant |
| US8595834(B2) | 2013-11-01 | Xie et al. | Applicant |
| US8627476(B1) | 2014-01-01 | Satish et al. | Applicant |
| US8635696(B1) | 2014-01-01 | Aziz | Applicant |
| US8682054(B2) | 2014-03-01 | Xue et al. | Applicant |
| US8682812(B1) | 2014-03-01 | Ranjan | Applicant |
| US8689333(B2) | 2014-04-01 | Aziz | Applicant |
| US8695096(B1) | 2014-04-01 | Zhang | Applicant |
| US8713631(B1) | 2014-04-01 | Pavlyushchik | Applicant |
| US8713681(B2) | 2014-04-01 | Silberman et al. | Applicant |
| US8726392(B1) | 2014-05-01 | McCorkendale et al. | Applicant |
| US8739280(B2) | 2014-05-01 | Chess et al. | Applicant |
| US8776180(B2) | 2014-07-01 | Kumar | Examiner |
| US8776229(B1) | 2014-07-01 | Aziz | Applicant |
| US8782792(B1) | 2014-07-01 | Bodke | Applicant |
| US8789172(B2) | 2014-07-01 | Stolfo et al. | Applicant |
| US8789178(B2) | 2014-07-01 | Kejriwal et al. | Applicant |
| US8793787(B2) | 2014-07-01 | Ismael et al. | Applicant |
| US8805947(B1) | 2014-08-01 | Kuzkin et al. | Applicant |
| US8806647(B1) | 2014-08-01 | Daswani et al. | Applicant |
| US8832829(B2) | 2014-09-01 | Manni et al. | Applicant |
| US8850570(B1) | 2014-09-01 | Ramzan | Applicant |
| US8850571(B2) | 2014-09-01 | Staniford et al. | Applicant |
| US8881234(B2) | 2014-11-01 | Narasimhan et al. | Applicant |
| US8881282(B1) | 2014-11-01 | Aziz et al. | Applicant |
| US8898788(B1) | 2014-11-01 | Aziz et al. | Applicant |
| US8935779(B2) | 2015-01-01 | Manni et al. | Applicant |
| US8984638(B1) | 2015-03-01 | Aziz et al. | Applicant |
| US8990939(B2) | 2015-03-01 | Staniford et al. | Applicant |
| US8990944(B1) | 2015-03-01 | Singh et al. | Applicant |
| US8997219(B2) | 2015-03-01 | Staniford et al. | Applicant |
| US9009822(B1) | 2015-04-01 | Ismael et al. | Applicant |
| US9009823(B1) | 2015-04-01 | Ismael et al. | Applicant |
| US9027135(B1) | 2015-05-01 | Aziz | Applicant |
| US9071638(B1) | 2015-06-01 | Aziz et al. | Applicant |
| US9104867(B1) | 2015-08-01 | Thioux et al. | Applicant |
| US9106694(B2) | 2015-08-01 | Aziz et al. | Applicant |
| US9118715(B2) | 2015-08-01 | Staniford et al. | Applicant |
| US9159035(B1) | 2015-10-01 | Ismael et al. | Applicant |
| US9171160(B2) | 2015-10-01 | Vincent et al. | Applicant |
| US9176843(B1) | 2015-11-01 | Ismael et al. | Applicant |
| US9189627(B1) | 2015-11-01 | Islam | Applicant |
| US9195829(B1) | 2015-11-01 | Goradia et al. | Applicant |
| US9197664(B1) | 2015-11-01 | Aziz et al. | Applicant |
| US9223972(B1) | 2015-12-01 | Vincent et al. | Applicant |
| US9225740(B1) | 2015-12-01 | Ismael et al. | Applicant |
| US9241010(B1) | 2016-01-01 | Bennett et al. | Applicant |
| US9251343(B1) | 2016-02-01 | Vincent et al. | Applicant |
| US9262635(B2) | 2016-02-01 | Paithane et al. | Applicant |
| US9282109(B1) | 2016-03-01 | Aziz et al. | Applicant |
| US9294501(B2) | 2016-03-01 | Mesdaq et al. | Applicant |
| US9300686(B2) | 2016-03-01 | Pidathala et al. | Applicant |
| US9306960(B1) | 2016-04-01 | Aziz | Applicant |
| US9306974(B1) | 2016-04-01 | Aziz et al. | Applicant |
| US9311479(B1) | 2016-04-01 | Manni et al. | Applicant |
| US9363280(B1) | 2016-06-01 | Rivlin | Examiner |
| US2001/0005889(A1) | 2001-06-01 | Albrecht | Applicant |
| US2001/0047326(A1) | 2001-11-01 | Broadbent et al. | Applicant |
| US2002/0018903(A1) | 2002-02-01 | Kokubo et al. | Applicant |
| US2002/0038430(A1) | 2002-03-01 | Edwards et al. | Applicant |
| US2002/0091819(A1) | 2002-07-01 | Melchione et al. | Applicant |
| US2002/0095607(A1) | 2002-07-01 | Lin-Hendel | Applicant |
| US2002/0116627(A1) | 2002-08-01 | Tarbotton et al. | Applicant |
| US2002/0144156(A1) | 2002-10-01 | Copeland | Applicant |
| US2002/0162015(A1) | 2002-10-01 | Tang | Applicant |
| US2002/0166063(A1) | 2002-11-01 | Lachman et al. | Applicant |
| US2002/0169952(A1) | 2002-11-01 | DiSanto et al. | Applicant |
| US2002/0184528(A1) | 2002-12-01 | Shevenell et al. | Applicant |
| US2002/0188887(A1) | 2002-12-01 | Largman et al. | Applicant |
| US2002/0194490(A1) | 2002-12-01 | Halperin et al. | Applicant |
| US2003/0074578(A1) | 2003-04-01 | Ford et al. | Applicant |
| US2003/0084318(A1) | 2003-05-01 | Schertz | Applicant |
| US2003/0101381(A1) | 2003-05-01 | Mateev et al. | Applicant |
| US2003/0115483(A1) | 2003-06-01 | Liang | Applicant |
| US2003/0188190(A1) | 2003-10-01 | Aaron et al. | Applicant |
| US2003/0191957(A1) | 2003-10-01 | Hypponen et al. | Applicant |
| US2003/0200460(A1) | 2003-10-01 | Morota et al. | Applicant |
| US2003/0212902(A1) | 2003-11-01 | van der Made | Applicant |
| US2003/0229801(A1) | 2003-12-01 | Kouznetsov et al. | Applicant |
| US2003/0237000(A1) | 2003-12-01 | Denton et al. | Applicant |
| US2004/0003323(A1) | 2004-01-01 | Bennett et al. | Applicant |
| US2004/0015712(A1) | 2004-01-01 | Szor | Applicant |
| US2004/0019832(A1) | 2004-01-01 | Arnold et al. | Applicant |
| US2004/0047356(A1) | 2004-03-01 | Bauer | Applicant |
| US2004/0083408(A1) | 2004-04-01 | Spiegel et al. | Applicant |
| US2004/0088581(A1) | 2004-05-01 | Brawn et al. | Applicant |
| US2004/0093513(A1) | 2004-05-01 | Cantrell et al. | Applicant |
| US2004/0111531(A1) | 2004-06-01 | Staniford et al. | Applicant |
| US2004/0117478(A1) | 2004-06-01 | Triulzi et al. | Applicant |
| US2004/0117624(A1) | 2004-06-01 | Brandt et al. | Applicant |
| US2004/0128355(A1) | 2004-07-01 | Chao et al. | Applicant |
| US2004/0165588(A1) | 2004-08-01 | Pandya | Applicant |
| US2004/0236963(A1) | 2004-11-01 | Danford et al. | Applicant |
| US2004/0243349(A1) | 2004-12-01 | Greifeneder et al. | Applicant |
| US2004/0249911(A1) | 2004-12-01 | Alkhatib et al. | Applicant |
| US2004/0255161(A1) | 2004-12-01 | Cavanaugh | Applicant |
| US2004/0268147(A1) | 2004-12-01 | Wiederin et al. | Applicant |
| US2005/0005159(A1) | 2005-01-01 | Oliphant | Applicant |
| US2005/0021740(A1) | 2005-01-01 | Bar et al. | Applicant |
| US2005/0033960(A1) | 2005-02-01 | Vialen et al. | Applicant |
| US2005/0033989(A1) | 2005-02-01 | Poletto et al. | Applicant |
| US2005/0050148(A1) | 2005-03-01 | Mohammadioun et al. | Applicant |
| US2005/0086523(A1) | 2005-04-01 | Zimmer et al. | Applicant |
| US2005/0091513(A1) | 2005-04-01 | Mitomo et al. | Applicant |
| US2005/0091533(A1) | 2005-04-01 | Omote et al. | Applicant |
| US2005/0091652(A1) | 2005-04-01 | Ross et al. | Applicant |
| US2005/0108562(A1) | 2005-05-01 | Khazan et al. | Applicant |
| US2005/0114663(A1) | 2005-05-01 | Cornell et al. | Applicant |
| US2005/0125195(A1) | 2005-06-01 | Brendel | Applicant |
| US2005/0149726(A1) | 2005-07-01 | Joshi et al. | Applicant |
| US2005/0157662(A1) | 2005-07-01 | Bingham et al. | Applicant |
| US2005/0183143(A1) | 2005-08-01 | Anderholm et al. | Applicant |
| US2005/0201297(A1) | 2005-09-01 | Peikari | Applicant |
| US2005/0210533(A1) | 2005-09-01 | Copeland et al. | Applicant |
| US2005/0238005(A1) | 2005-10-01 | Chen et al. | Applicant |
| US2005/0240781(A1) | 2005-10-01 | Gassoway | Applicant |
| US2005/0262562(A1) | 2005-11-01 | Gassoway | Applicant |
| US2005/0265331(A1) | 2005-12-01 | Stolfo | Applicant |
| US2005/0283839(A1) | 2005-12-01 | Cowburn | Applicant |
| US2006/0010495(A1) | 2006-01-01 | Cohen et al. | Applicant |
| US2006/0015416(A1) | 2006-01-01 | Hoffman et al. | Applicant |
| US2006/0015715(A1) | 2006-01-01 | Anderson | Applicant |
| US2006/0015747(A1) | 2006-01-01 | Van de Ven | Applicant |
| US2006/0021029(A1) | 2006-01-01 | Brickell et al. | Applicant |
| US2006/0021054(A1) | 2006-01-01 | Costa et al. | Applicant |
| US2006/0031476(A1) | 2006-02-01 | Mathes et al. | Applicant |
| US2006/0047665(A1) | 2006-03-01 | Neil | Applicant |
| US2006/0070130(A1) | 2006-03-01 | Costea et al. | Applicant |
| US2006/0075496(A1) | 2006-04-01 | Carpenter et al. | Applicant |
| US2006/0095968(A1) | 2006-05-01 | Portolani et al. | Applicant |
| US2006/0101516(A1) | 2006-05-01 | Sudaharan et al. | Applicant |
| US2006/0101517(A1) | 2006-05-01 | Banzhof et al. | Applicant |
| US2006/0117385(A1) | 2006-06-01 | Mester et al. | Applicant |
| US2006/0123477(A1) | 2006-06-01 | Raghavan et al. | Applicant |
| US2006/0143709(A1) | 2006-06-01 | Brooks et al. | Applicant |
| US2006/0150249(A1) | 2006-07-01 | Gassen et al. | Applicant |
| US2006/0161983(A1) | 2006-07-01 | Cothrell et al. | Applicant |
| US2006/0161987(A1) | 2006-07-01 | Levy-Yurista | Applicant |
| US2006/0161989(A1) | 2006-07-01 | Reshef et al. | Applicant |
| US2006/0164199(A1) | 2006-07-01 | Gilde et al. | Applicant |
| US2006/0173992(A1) | 2006-08-01 | Weber et al. | Applicant |
| US2006/0179147(A1) | 2006-08-01 | Tran et al. | Applicant |
| US2006/0184632(A1) | 2006-08-01 | Marino et al. | Applicant |
| US2006/0191010(A1) | 2006-08-01 | Benjamin | Applicant |
| US2006/0221956(A1) | 2006-10-01 | Narayan et al. | Applicant |
| US2006/0236393(A1) | 2006-10-01 | Kramer et al. | Applicant |
| US2006/0242709(A1) | 2006-10-01 | Seinfeld et al. | Applicant |
| US2006/0248519(A1) | 2006-11-01 | Jaeger et al. | Applicant |
| US2006/0248582(A1) | 2006-11-01 | Panjwani et al. | Applicant |
| US2006/0251104(A1) | 2006-11-01 | Koga | Applicant |
| US2006/0288417(A1) | 2006-12-01 | Bookbinder et al. | Applicant |
| US2007/0006288(A1) | 2007-01-01 | Mayfield et al. | Applicant |
| US2007/0006313(A1) | 2007-01-01 | Porras et al. | Applicant |
| US2007/0011174(A1) | 2007-01-01 | Takaragi et al. | Applicant |
| US2007/0016951(A1) | 2007-01-01 | Piccard et al. | Applicant |
| US2007/0033645(A1) | 2007-02-01 | Jones | Applicant |
| US2007/0038943(A1) | 2007-02-01 | FitzGerald et al. | Applicant |
| US2007/0064689(A1) | 2007-03-01 | Shin et al. | Applicant |
| US2007/0074169(A1) | 2007-03-01 | Chess et al. | Applicant |
| US2007/0094730(A1) | 2007-04-01 | Bhikkaji et al. | Applicant |
| US2007/0101435(A1) | 2007-05-01 | Konanka et al. | Applicant |
| US2007/0128855(A1) | 2007-06-01 | Cho et al. | Applicant |
| US2007/0142030(A1) | 2007-06-01 | Sinha et al. | Applicant |
| US2007/0143827(A1) | 2007-06-01 | Nicodemus et al. | Applicant |
| US2007/0156895(A1) | 2007-07-01 | Vuong | Applicant |
| US2007/0157180(A1) | 2007-07-01 | Tillmann et al. | Applicant |
| US2007/0157306(A1) | 2007-07-01 | Elrod et al. | Applicant |
| US2007/0168988(A1) | 2007-07-01 | Eisner et al. | Applicant |
| US2007/0171824(A1) | 2007-07-01 | Ruello et al. | Applicant |
| US2007/0174915(A1) | 2007-07-01 | Gribble et al. | Applicant |
| US2007/0192500(A1) | 2007-08-01 | Lum | Applicant |
| US2007/0192858(A1) | 2007-08-01 | Lum | Applicant |
| US2007/0198275(A1) | 2007-08-01 | Malden et al. | Applicant |
| US2007/0208822(A1) | 2007-09-01 | Wang et al. | Applicant |
| US2007/0220607(A1) | 2007-09-01 | Sprosts et al. | Applicant |
| US2007/0240218(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240219(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240220(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240222(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0250930(A1) | 2007-10-01 | Aziz et al. | Applicant |
| US2007/0256132(A2) | 2007-11-01 | Oliphant | Applicant |
| US2007/0271446(A1) | 2007-11-01 | Nakamura | Applicant |
| US2008/0005782(A1) | 2008-01-01 | Aziz | Applicant |
| US2008/0028463(A1) | 2008-01-01 | Dagon et al. | Applicant |
| US2008/0032556(A1) | 2008-02-01 | Schreier | Applicant |
| US2008/0040710(A1) | 2008-02-01 | Chiriac | Applicant |
| US2008/0046781(A1) | 2008-02-01 | Childs et al. | Applicant |
| US2008/0066179(A1) | 2008-03-01 | Liu | Applicant |
| US2008/0072326(A1) | 2008-03-01 | Danford et al. | Applicant |
| US2008/0077793(A1) | 2008-03-01 | Tan et al. | Applicant |
| US2008/0080518(A1) | 2008-04-01 | Hoeflin et al. | Applicant |
| US2008/0086720(A1) | 2008-04-01 | Lekel | Applicant |
| US2008/0098476(A1) | 2008-04-01 | Syversen | Applicant |
| US2008/0120722(A1) | 2008-05-01 | Sima et al. | Applicant |
| US2008/0134178(A1) | 2008-06-01 | Fitzgerald et al. | Applicant |
| US2008/0134334(A1) | 2008-06-01 | Kim et al. | Applicant |
| US2008/0141376(A1) | 2008-06-01 | Clausen et al. | Applicant |
| US2008/0184367(A1) | 2008-07-01 | McMillan et al. | Applicant |
| US2008/0184373(A1) | 2008-07-01 | Traut et al. | Applicant |
| US2008/0189787(A1) | 2008-08-01 | Arnold et al. | Applicant |
| US2008/0201778(A1) | 2008-08-01 | Guo et al. | Applicant |
| US2008/0209557(A1) | 2008-08-01 | Herley et al. | Applicant |
| US2008/0215742(A1) | 2008-09-01 | Goldszmidt et al. | Applicant |
| US2008/0222729(A1) | 2008-09-01 | Chen et al. | Applicant |
| US2008/0263665(A1) | 2008-10-01 | Ma et al. | Applicant |
| US2008/0295172(A1) | 2008-11-01 | Bohacek | Applicant |
| US2008/0301810(A1) | 2008-12-01 | Lehane et al. | Applicant |
| US2008/0307524(A1) | 2008-12-01 | Singh et al. | Applicant |
| US2008/0313738(A1) | 2008-12-01 | Enderby | Applicant |
| US2008/0320594(A1) | 2008-12-01 | Jiang | Applicant |
| US2009/0003317(A1) | 2009-01-01 | Kasralikar et al. | Applicant |
| US2009/0007100(A1) | 2009-01-01 | Field et al. | Applicant |
| US2009/0013408(A1) | 2009-01-01 | Schipka | Applicant |
| US2009/0031423(A1) | 2009-01-01 | Liu et al. | Applicant |
| US2009/0036111(A1) | 2009-02-01 | Danford et al. | Applicant |
| US2009/0037835(A1) | 2009-02-01 | Goldman | Applicant |
| US2009/0044024(A1) | 2009-02-01 | Oberheide et al. | Applicant |
| US2009/0044274(A1) | 2009-02-01 | Budko et al. | Applicant |
| US2009/0064332(A1) | 2009-03-01 | Porras et al. | Applicant |
| US2009/0077666(A1) | 2009-03-01 | Chen et al. | Applicant |
| US2009/0083369(A1) | 2009-03-01 | Marmor | Applicant |
| US2009/0083855(A1) | 2009-03-01 | Apap et al. | Applicant |
| US2009/0089879(A1) | 2009-04-01 | Wang et al. | Applicant |
| US2009/0094697(A1) | 2009-04-01 | Provos et al. | Applicant |
| US2009/0113425(A1) | 2009-04-01 | Ports et al. | Applicant |
| US2009/0125976(A1) | 2009-05-01 | Wassermann et al. | Applicant |
| US2009/0126015(A1) | 2009-05-01 | Monastyrsky et al. | Applicant |
| US2009/0126016(A1) | 2009-05-01 | Sobko et al. | Applicant |
| US2009/0133125(A1) | 2009-05-01 | Choi et al. | Applicant |
| US2009/0144823(A1) | 2009-06-01 | Lamastra et al. | Applicant |
| US2009/0158430(A1) | 2009-06-01 | Borders | Applicant |
| US2009/0172815(A1) | 2009-07-01 | Gu et al. | Applicant |
| US2009/0187992(A1) | 2009-07-01 | Poston | Applicant |
| US2009/0193293(A1) | 2009-07-01 | Stolfo et al. | Applicant |
| US2009/0198651(A1) | 2009-08-01 | Shiffer et al. | Applicant |
| US2009/0198670(A1) | 2009-08-01 | Shiffer et al. | Applicant |
| US2009/0198689(A1) | 2009-08-01 | Frazier et al. | Applicant |
| US2009/0199274(A1) | 2009-08-01 | Frazier et al. | Applicant |
| US2009/0199296(A1) | 2009-08-01 | Xie et al. | Applicant |
| US2009/0228233(A1) | 2009-09-01 | Anderson et al. | Applicant |
| US2009/0241187(A1) | 2009-09-01 | Troyansky | Applicant |
| US2009/0241190(A1) | 2009-09-01 | Todd et al. | Applicant |
| US2009/0265692(A1) | 2009-10-01 | Godefroid et al. | Applicant |
| US2009/0271867(A1) | 2009-10-01 | Zhang | Applicant |
| US2009/0300415(A1) | 2009-12-01 | Zhang et al. | Applicant |
| US2009/0300761(A1) | 2009-12-01 | Park et al. | Applicant |
| US2009/0328185(A1) | 2009-12-01 | Berg et al. | Applicant |
| US2009/0328221(A1) | 2009-12-01 | Blumfield et al. | Applicant |
| US2010/0005146(A1) | 2010-01-01 | Drako et al. | Applicant |
| US2010/0011205(A1) | 2010-01-01 | McKenna | Applicant |
| US2010/0017546(A1) | 2010-01-01 | Poo et al. | Applicant |
| US2010/0030996(A1) | 2010-02-01 | Butler, II | Applicant |
| US2010/0031353(A1) | 2010-02-01 | Thomas et al. | Applicant |
| US2010/0037314(A1) | 2010-02-01 | Perdisci et al. | Applicant |
| US2010/0054278(A1) | 2010-03-01 | Stolfo et al. | Applicant |
| US2010/0115621(A1) | 2010-05-01 | Staniford et al. | Applicant |
| US2010/0180344(A1) | 2010-07-01 | Malyshev et al. | Applicant |
| US2010/0192223(A1) | 2010-07-01 | Ismael et al. | Applicant |
| US2010/0220863(A1) | 2010-09-01 | Dupaquis et al. | Applicant |
| US2010/0235831(A1) | 2010-09-01 | Dittmer | Applicant |
| US2010/0281541(A1) | 2010-11-01 | Stolfo et al. | Applicant |
| US2010/0281542(A1) | 2010-11-01 | Stolfo et al. | Applicant |
| US2010/0299754(A1) | 2010-11-01 | Amit et al. | Applicant |
| US2010/0306173(A1) | 2010-12-01 | Frank | Applicant |
| US2011/0004737(A1) | 2011-01-01 | Greenebaum | Applicant |
| US2011/0055907(A1) | 2011-03-01 | Narasimhan et al. | Applicant |
| US2011/0078794(A1) | 2011-03-01 | Manni et al. | Applicant |
| US2011/0093951(A1) | 2011-04-01 | Aziz | Applicant |
| US2011/0099620(A1) | 2011-04-01 | Stavrou et al. | Applicant |
| US2011/0099633(A1) | 2011-04-01 | Aziz | Applicant |
| US2011/0099635(A1) | 2011-04-01 | Silberman et al. | Applicant |
| US2011/0113231(A1) | 2011-05-01 | Kaminsky | Applicant |
| US2011/0145918(A1) | 2011-06-01 | Jung et al. | Applicant |
| US2011/0145920(A1) | 2011-06-01 | Mahaffey et al. | Applicant |
| US2011/0145934(A1) | 2011-06-01 | Abramovici et al. | Applicant |
| US2011/0167493(A1) | 2011-07-01 | Song et al. | Applicant |
| US2011/0167494(A1) | 2011-07-01 | Bowen et al. | Applicant |
| US2011/0173213(A1) | 2011-07-01 | Frazier et al. | Applicant |
| US2011/0173460(A1) | 2011-07-01 | Ito et al. | Applicant |
| US2011/0219449(A1) | 2011-09-01 | St. Neitzel et al. | Applicant |
| US2011/0219450(A1) | 2011-09-01 | McDougal et al. | Applicant |
| US2011/0225624(A1) | 2011-09-01 | Sawhney et al. | Applicant |
| US2011/0225655(A1) | 2011-09-01 | Niemela et al. | Applicant |
| US2011/0247072(A1) | 2011-10-01 | Staniford et al. | Applicant |
| US2011/0265182(A1) | 2011-10-01 | Peinado et al. | Applicant |
| US2011/0289582(A1) | 2011-11-01 | Kejriwal et al. | Applicant |
| US2011/0302587(A1) | 2011-12-01 | Nishikawa et al. | Applicant |
| US2011/0307954(A1) | 2011-12-01 | Melnik et al. | Applicant |
| US2011/0307955(A1) | 2011-12-01 | Kaplan et al. | Applicant |
| US2011/0307956(A1) | 2011-12-01 | Yermakov et al. | Applicant |
| US2011/0314546(A1) | 2011-12-01 | Aziz et al. | Applicant |
| US2012/0023593(A1) | 2012-01-01 | Puder et al. | Applicant |
| US2012/0054869(A1) | 2012-03-01 | Yen et al. | Applicant |
| US2012/0066698(A1) | 2012-03-01 | Yanoo | Applicant |
| US2012/0079596(A1) | 2012-03-01 | Thomas et al. | Applicant |
| US2012/0084859(A1) | 2012-04-01 | Radinsky et al. | Applicant |
| US2012/0110667(A1) | 2012-05-01 | Zubrilin et al. | Applicant |
| US2012/0117652(A1) | 2012-05-01 | Manni et al. | Applicant |
| US2012/0121154(A1) | 2012-05-01 | Xue et al. | Applicant |
| US2012/0124426(A1) | 2012-05-01 | Maybee et al. | Applicant |
| US2012/0174186(A1) | 2012-07-01 | Aziz et al. | Applicant |
| US2012/0174196(A1) | 2012-07-01 | Bhogavilli et al. | Applicant |
| US2012/0174218(A1) | 2012-07-01 | McCoy et al. | Applicant |
| US2012/0198279(A1) | 2012-08-01 | Schroeder | Applicant |
| US2012/0210423(A1) | 2012-08-01 | Friedrichs et al. | Applicant |
| US2012/0222121(A1) | 2012-08-01 | Staniford et al. | Applicant |
| US2012/0255015(A1) | 2012-10-01 | Sahita et al. | Applicant |
| US2012/0255017(A1) | 2012-10-01 | Sallam | Applicant |
| US2012/0260342(A1) | 2012-10-01 | Dube et al. | Applicant |
| US2012/0266244(A1) | 2012-10-01 | Green et al. | Applicant |
| US2012/0278886(A1) | 2012-11-01 | Luna | Applicant |
| US2012/0297489(A1) | 2012-11-01 | Dequevy | Applicant |
| US2012/0330801(A1) | 2012-12-01 | McDougal et al. | Applicant |
| US2012/0331553(A1) | 2012-12-01 | Aziz et al. | Applicant |
| US2013/0014259(A1) | 2013-01-01 | Gribble et al. | Applicant |
| US2013/0036472(A1) | 2013-02-01 | Aziz | Applicant |
| US2013/0047257(A1) | 2013-02-01 | Aziz | Applicant |
| US2013/0074185(A1) | 2013-03-01 | McDougal et al. | Applicant |
| US2013/0086684(A1) | 2013-04-01 | Mohler | Applicant |
| US2013/0097699(A1) | 2013-04-01 | Balupari et al. | Applicant |
| US2013/0097706(A1) | 2013-04-01 | Titonis et al. | Applicant |
| US2013/0111587(A1) | 2013-05-01 | Goel et al. | Applicant |
| US2013/0117852(A1) | 2013-05-01 | Stute | Applicant |
| US2013/0117855(A1) | 2013-05-01 | Kim et al. | Applicant |
| US2013/0139264(A1) | 2013-05-01 | Brinkley et al. | Applicant |
| US2013/0160125(A1) | 2013-06-01 | Likhachev et al. | Applicant |
| US2013/0160127(A1) | 2013-06-01 | Jeong et al. | Applicant |
| US2013/0160130(A1) | 2013-06-01 | Mendelev et al. | Applicant |
| US2013/0160131(A1) | 2013-06-01 | Madou et al. | Applicant |
| US2013/0167236(A1) | 2013-06-01 | Sick | Applicant |
| US2013/0174214(A1) | 2013-07-01 | Duncan | Applicant |
| US2013/0185789(A1) | 2013-07-01 | Hagiwara et al. | Applicant |
| US2013/0185795(A1) | 2013-07-01 | Winn et al. | Applicant |
| US2013/0185798(A1) | 2013-07-01 | Saunders et al. | Applicant |
| US2013/0191915(A1) | 2013-07-01 | Antonakakis et al. | Applicant |
| US2013/0196649(A1) | 2013-08-01 | Paddon et al. | Applicant |
| US2013/0227691(A1) | 2013-08-01 | Aziz et al. | Applicant |
| US2013/0246370(A1) | 2013-09-01 | Bartram et al. | Applicant |
| US2013/0247186(A1) | 2013-09-01 | LeMasters | Applicant |
| US2013/0263260(A1) | 2013-10-01 | Mahaffey et al. | Applicant |
| US2013/0291109(A1) | 2013-10-01 | Staniford et al. | Applicant |
| US2013/0298243(A1) | 2013-11-01 | Kumar et al. | Applicant |
| US2013/0318038(A1) | 2013-11-01 | Shiffer et al. | Applicant |
| US2013/0318073(A1) | 2013-11-01 | Shiffer et al. | Applicant |
| US2013/0325791(A1) | 2013-12-01 | Shiffer et al. | Applicant |
| US2013/0325792(A1) | 2013-12-01 | Shiffer et al. | Applicant |
| US2013/0325871(A1) | 2013-12-01 | Shiffer et al. | Applicant |
| US2013/0325872(A1) | 2013-12-01 | Shiffer et al. | Applicant |
| US2014/0032875(A1) | 2014-01-01 | Butler | Applicant |
| US2014/0053260(A1) | 2014-02-01 | Gupta et al. | Applicant |
| US2014/0053261(A1) | 2014-02-01 | Gupta et al. | Applicant |
| US2014/0130158(A1) | 2014-05-01 | Wang et al. | Applicant |
| US2014/0137180(A1) | 2014-05-01 | Lukacs et al. | Applicant |
| US2014/0169762(A1) | 2014-06-01 | Ryu | Applicant |
| US2014/0179360(A1) | 2014-06-01 | Jackson et al. | Applicant |
| US2014/0181131(A1) | 2014-06-01 | Ross | Applicant |
| US2014/0189687(A1) | 2014-07-01 | Jung et al. | Applicant |
| US2014/0189866(A1) | 2014-07-01 | Shiffer et al. | Applicant |
| US2014/0189882(A1) | 2014-07-01 | Jung et al. | Applicant |
| US2014/0237600(A1) | 2014-08-01 | Silberman et al. | Applicant |
| US2014/0280245(A1) | 2014-09-01 | Wilson | Applicant |
| US2014/0283037(A1) | 2014-09-01 | Sikorski et al. | Applicant |
| US2014/0283063(A1) | 2014-09-01 | Thompson et al. | Applicant |
| US2014/0328204(A1) | 2014-11-01 | Klotsche et al. | Applicant |
| US2014/0337836(A1) | 2014-11-01 | Ismael | Applicant |
| US2014/0344926(A1) | 2014-11-01 | Cunningham et al. | Applicant |
| US2014/0351935(A1) | 2014-11-01 | Shao et al. | Applicant |
| US2014/0380473(A1) | 2014-12-01 | Bu et al. | Applicant |
| US2014/0380474(A1) | 2014-12-01 | Paithane et al. | Applicant |
| US2015/0007312(A1) | 2015-01-01 | Pidathala et al. | Applicant |
| US2015/0096022(A1) | 2015-04-01 | Vincent et al. | Applicant |
| US2015/0096023(A1) | 2015-04-01 | Mesdaq et al. | Applicant |
| US2015/0096024(A1) | 2015-04-01 | Haq et al. | Applicant |
| US2015/0096025(A1) | 2015-04-01 | Ismael | Applicant |
| US2015/0180886(A1) | 2015-06-01 | Staniford et al. | Applicant |
| US2015/0186645(A1) | 2015-07-01 | Aziz et al. | Applicant |
| US2015/0220735(A1) | 2015-08-01 | Paithane et al. | Applicant |
| US2015/0372980(A1) | 2015-12-01 | Eyada | Applicant |
| US2016/0044000(A1) | 2016-02-01 | Cunningham | Applicant |
| US2016/0127393(A1) | 2016-05-01 | Aziz et al. | Applicant |
| GB2439806(A) | 2008-01-01 | Applicant | |
| GB2490431(A) | 2012-10-01 | Applicant | |
| WO2/06928(A2) | 2002-01-01 | Applicant | |
| WO2/23805(A2) | 2002-03-01 | Applicant | |
| WO2007117636(A2) | 2007-10-01 | Applicant | |
| WO2008041950(A2) | 2008-04-01 | Applicant | |
| WO2011084431(A2) | 2011-07-01 | Applicant | |
| WO2011/112348(A1) | 2011-09-01 | Applicant | |
| WO2012/075336(A1) | 2012-06-01 | Applicant | |
| WO2013/067505(A1) | 2013-05-01 | Applicant |
Non-Patent Literature (76)
- “Network Security: NetDetector—Network Intrusion Forensic System (NIFS) Whitepaper”, (“NetDetector Whitepaper”), (2003).Applicant
- “Packet”, Microsoft Computer Dictionary, Microsoft Press, (Mar. 2002), 1 page.Applicant
- “When Virtual is Better Than Real”, IEEEXplore Digital Library, available at, http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumbe- r=990073, (Dec. 7, 2013).Applicant
- Abdullah, et al., Visualizing Network Data for Intrusion Detection, 2005 IEEE Workshop on Information Assurance and Security, pp. 100-108.Applicant
- Adetoye, Adedayo , et al., “Network Intrusion Detection & Response System”, (“Adetoye”), (Sep. 2003).Applicant
- Adobe Systems Incorporated, “PDF 32000-1:2008, Document management—Portable document format—Part1:PDF 1.7”, First Edition, Jul. 1, 2008, 756 pages.Applicant
- AltaVista Advanced Search Results. “attack vector identifier”. Http://www.altavista.com/web/results?ltag=ody&pg=aq&aqmode=aqa=Event+Orch- estrator . . . , (Accessed on Sep. 15, 2009).Applicant
- AltaVista Advanced Search Results. “Event Orchestrator”. Http://www.altavista.com/web/results?ltag=ody&pg=aq&aqmode=aqa=Event+Orch- esrator . . . , (Accessed on Sep. 3, 2009).Applicant
- Apostolopoulos, George; hassapis, Constantinos; “V-eM: A cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation”, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126.Applicant
- Aura, Tuomas, “Scanning electronic documents for personally identifiable information”, Proceedings of the 5th ACM workshop on Privacy in electronic society. ACM, 2006.Applicant
- Baecher, “The Nepenthes Platform: An Efficient Approach to collect Malware”, Springer-verlag Berlin Heidelberg, (2006), pp. 165-184.Applicant
- Baldi, Mario; Risso, Fulvio; “A Framework for Rapid Development and Portable Execution of Packet-Handling Applications”, 5th IEEE International Symposium Processing and Information Technology, Dec. 21, 2005, pp. 233-238.Applicant
- Bayer, et al., “Dynamic Analysis of Malicious Code”, J Comput Virol, Springer-Verlag, France., (2006), pp. 67-77.Applicant
- Boubalos, Chris , “extracting syslog data out of raw pcap dumps, seclists.org, Honeypots mailing list archives”, available at http://seclists.org/honeypots/2003/q2/319 (“Boubalos”), (Jun. 5, 2003).Applicant
- Chaudet, C. , et al., “Optimal Positioning of Active and Passive Monitoring Devices”, International Conference on Emerging Networking Experiments and Technologies, Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology, CoNEXT '05, Toulousse, France, (Oct. 2005), pp. 71-82.Applicant
- Chen, P. M. and Noble, B. D., “When Virtual is Better Than Real, Department of Electrical Engineering and Computer Science”, University of Michigan (“Chen”) (2001).Applicant
- Cisco “Intrusion Prevention for the Cisco ASA 5500-x Series” Data Sheet (2012).Applicant
- Cisco, Configuring the Catalyst Switched Port Analyzer (SPAN) (“Cisco”), (1992).Applicant
- Clark, John, Sylvian Leblanc,and Scott Knight. “Risks associated with usb hardware trojan devices used by insiders.” Systems Conference (SysCon), 2011 IEEE International. IEEE, 2011.Applicant
- Cohen, M.I. , “PyFlag—An advanced network forensic framework”, Digital investigation 5, Elsevier, (2008), pp. S112-S120.Applicant
- Costa, M. , et al., “Vigilante: End-to-End Containment of Internet Worms”, SOSP '05, Association for Computing Machinery, Inc., Brighton U.K., (Oct. 23-26, 2005).Applicant
- Crandall, J.R. , et al., “Minos:Control Data Attack Prevention Orthogonal to Memory Model”, 37th International Symposium on Microarchitecture, Portland, Oregon, (Dec. 2004).Applicant
- Deutsch, P. , “Zlib compressed data format specification version 3.3” RFC 1950, (1996).Applicant
- Distler, “Malware Analysis: An Introduction”, SANS Institute InfoSec Reading Room, SANS Institute, (2007).Applicant
- Dunlap, George W. , et al., “ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay”, Proceeding of the 5th Symposium on Operating Systems Design and Implementation, USENIX Association, (“Dunlap”), (Dec. 9, 2002).Applicant
- Excerpt regarding First Printing Date for Merike Kaeo, Designing Network Security (“Kaeo”), (2005).Applicant
- Filiol, Eric , et al., “Combinatorial Optimisation of Worm Propagation on an Unknown Network”, International Journal of Computer Science 2.2 (2007).Applicant
- FireEye Malware Analysis & Exchange Network, Malware Protection System, FireEye Inc., 2010.Applicant
- FireEye Malware Analysis, Modern Malware Forensics, FireEye Inc., 2010.Applicant
- FireEye v.6.0 Security Target, pp. 1-35, Version 1.1, FireEye Inc., May 2011.Applicant
- Gibler, Clint, et al. AndroidLeaks: automatically detecting potential privacy leaks in android applications on a large scale. Springer Berlin Heidelberg, 2012.Applicant
- Goel, et al., Reconstructing System State for Intrusion Analysis, Apr. 2008 SIGOPS Operating Systems Review, vol. 42 Issue 3, pp. 21-28.Applicant
- Gregg Keizer: “Microsoft's HoneyMonkeys Show Patching Windows Works”, Aug. 8, 2005, XP055143386, Retrieved from the Internet: URL:http://www.informationweek.com/microsofts-honeymonkeys-show-patching-windows-works/d/d-id/1035069? [retrieved on Jun. 1, 2016].Applicant
- Heng Yin et al, Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis, Research Showcase @ CMU, Carnegie Mellon University, 2007.Applicant
- Hjelmvik, Erik , “Passive Network Security Analysis with NetworkMiner”, (IN)Secure, Issue 18, (Oct. 2008), pp. 1-100.Applicant
- Idika et al., A-Survey-of-Malware-Detection-Techniques, Feb. 2, 2007, Department of Computer Science, Purdue University.Applicant
- IEEE Xplore Digital Library Sear Results for “detection of unknown computer worms”. Http//ieeexplore.ieee.org/searchresult.jsp?SortField=Score&SortOrder=desc- &ResultC . . . , (Accessed on Aug. 28, 2009).Applicant
- Isohara, Takamasa, Keisuke Takemori, and Ayumu Kubota. “Kernel-based behavior analysis for android malware detection.” Computational intelligence and Security (CIS), 2011 Seventh International Conference on. IEEE, 2011.Applicant
- Kaeo, Merike , “Designing Network Security”, (“Kaeo”), (Nov. 2003).Applicant
- Kevin A Roundy et al: “Hybrid Analysis and Control of Malware”, Sep. 15, 2010, Recent Advances in Intrusion Detection, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 317-338, XP019150454 ISBN:978-3-642-15511-6.Applicant
- Kim, H. , et al., “Autograph: Toward Automated, Distributed Worm Signature Detection”, Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, (Aug. 2004), pp. 271-286.Applicant
- King, Samuel T., et al., “Operating System Support for Virtual Machines”, (“King”) (2003).Applicant
- Krasnyansky, Max , et al., Universal TUN/TAP driver, available at https://www.kemel.org/doc/Documentation/networking/tuntap.txt (2002) (“Krasnyansky”).Applicant
- Kreibich, C. , et al., “Honeycomb-Creating Intrusion Detection Signatures Using Honeypots”, 2nd Workshop on Hot Topics in Networks (HotNets-11), Boston, USA, (2003).Applicant
- Kristoff, J. , “Botnets, Detection and Mitigation: DNS-Based Techniques”, NU Security Day, (2005), 23 pages.Applicant
- Leading Colleges Select FireEye to Stop Malware-Related Data Breaches, FireEye Inc., 2009.Applicant
- Li et al., A VMM-Based System Call Interposition Framework for Program Monitoring, Dec. 2010, IEEE 16th Intemational Conference on Parallel and Distributed Systems, pp. 706-711.Applicant
- Liljenstam, Michael , et al., “Simulating Realistic Network Traffic for Worm Warning System Design and Testing”, Institute for Security Technology studies, Dartmouth College (“Liljenstam”), (Oct. 27, 2003).Applicant
- Lindorfer, Martina, Clemens Kolbitsch, and Paolo Milani Comparetti. “Detecting environment-sensitive malware.” Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2011.Applicant
- Lok Kwong et al: “DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis”, Aug. 10, 2012, XP055158513, Retrieved from the Internet: URL:https://www.usenix.org/system/files/conference/usenixsecurity12/sec12- -final107.pdf [retrieved on Dec. 15, 2014].Applicant
- Marchette, David J., “Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint”, (“Marchette”), (2001).Applicant
- Margolis, P.E. , “Random House Webster's ‘Computer & Internet Dictionary 3rd Edition’”, ISBN 0375703519, (Dec. 1998).Applicant
- Moore, D. , et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, INFOCOM, vol. 3, (Mar. 30-Apr. 3, 2003), pp. 1901-1910.Applicant
- Morales, Jose A., et al., “Analyzing and exploiting network behaviors of malware.”, Security and Privacy in Communication Networks. Springer Berlin Heidelberg, 2010. 20-34.Applicant
- Mori, Detecting Unknown Computer Viruses, 2004, Springer-Verlag Berlin Heidelberg.Applicant
- Natvig, Kurt , “SANDBOXII: Internet”, Virus Bulletin Conference, (“Natvig”), (Sep. 2002).Applicant
- NetBIOS Working Group. Protocol Standard for a NetBIOS Service on a TCP/UDP transport: Concepts and Methods. STD 19, RFC 1001, Mar. 1987.Applicant
- Newsome, J. , et al., “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”, In Proceedings of the 12th Annual Network and Distributed System Security, Symposium (NDSS '05), (Feb. 2005).Applicant
- Newsome, J. , et al., “Polygraph: Automatically Generating Signatures for Polymorphic Worms”, In Proceedings of the IEEE Symposium on Security and Privacy, (May 2005).Applicant
- Nojiri, D. , et al., “Cooperation Response Strategies for Large Scale Attack Mitigation”, DARPA Information Survivability Conference and Exposition, vol. 1, (Apr. 22-24, 2003), pp. 293-302.Applicant
- Oberheide et al., CloudAV.sub.--N-Version Antivirus in the Network Cloud, 17th USENIX Security Symposium USENIX Security '08 Jul. 28-Aug. 1, 2008 San Jose, CA.Applicant
- Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Roonald Perez, Leendert van Doom, John Linwood Griffin, Stefan Berger., sHype: Secure Hypervisor Appraoch to Trusted Virtualized Systems (Feb. 2, 2005) (“Sailer”).Applicant
- Silicon Defense, “Worm Containment in the Internal Network”, (Mar. 2003), pp. 1-25.Applicant
- Singh, S. , et al., “Automated Worm Fingerprinting”, Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, California, (Dec. 2004).Applicant
- Spitzner, Lance , “Honeypots: Tracking Hackers”, (“Spizner”), (Sep. 17, 2002).Applicant
- The Sniffers's Guide to Raw Traffic available at: yuba.stanford.edu/about.casado/pcap/section1.html, (Jan. 6, 2014).Applicant
- Thomas H. Ptacek, and Timothy N. Newsham , “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, Secure Networks, (“Ptacek”), (Jan. 1998).Applicant
- U.S. Appl. No. 14/466,898, filed Aug. 22, 2014 Non-Final Office Action dated Oct. 8, 2015.Applicant
- U.S. Pat. No. 8,171,553 filed Apr. 20, 2006, Inter Parties Review Decision dated Jul. 10, 2015.Applicant
- U.S. Pat. No. 8,291,499 filed Mar. 16, 2012, Inter Parties Review Decision dated Jul. 10, 2015.Applicant
- Venezia, Paul , “NetDetector Captures Intrusions”, InfoWorld Issue 27, (“Venezia”), (Jul. 14, 2003).Applicant
- Wahid et al., Characterising the Evolution in Scanning Activity of Suspicious Hosts, Oct. 2009, Third International Conference on Network and System Security, pp. 344-350.Applicant
- Whyte, et al., “DNS-Based Detection of Scanning Works in an Enterprise Network”, Proceedings of the 12th Annual Network and Distributed System Security Symposium, (Feb. 2005), 15 pages.Applicant
- Williamson, Matthew M., “Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code”, ACSAC Conference, Las Vegas, NV, USA, (Dec. 2002), pp. 1-9.Applicant
- Yuhei Kawakoya et al: “Memory behavior-based automatic malware unpacking in stealth debugging environment”, Malicious and Unwanted Software (Malware), 2010 5th International Conference on, IEEE, Piscataway, NJ, USA, Oct. 19, 2010, pp. 39-46, XP031833827, ISBN:978-1-4244-8-9353-1.Applicant
- Zhang et al., The Effects of Threading, Infection Time, and Multiple-Attacker Collaboration on Malware Propagation, Sep. 2009, IEEE 28th International Symposium on Reliable Distributed Systems, pp. 73-82.Applicant