Abstract: A method, system and computer program product for tamper-proofing an executable assembly, including identifying assembly-time constants in source code; encrypting the assembly-time constants during the assembly process using public key cryptography; and signing the executable assembly using a digital signature. The executable assembly, at run-time, decrypts the assembly-time constants using the digital signature. A hashing function, a compression function or a one-way cryptographic block function is used to encrypt the assembly-time constants. Different keys or the same keys can be used to launch the assembly and to encrypt the assembly-time variables. The assembly-time constants are placed into a heap prior to the encrypting step. The assembly-time constants include strings and databases.

Abstract: A method, system and computer program product for tracking and isolating botnets are described. A statistical method for tracking botnets is provided. The proposed method uses the fact that a computer in a botnet has to distribute content which resembles to some degree the content distributed by the other computers in the same botnet over same time period. The size of the messages sent by a particular computer over particular period of time can be tracked. The resulting distribution of message numbers by size is, then, associated with that computer. The distribution statistical data obtained for different sources are then compared using approximation of graphical data. Based on comparison it is determined whether the computer belongs to a botnet.

Abstract: A method, system and computer program for controlling propagation of content throughout the Internet, social and mobile networks. Publisher's content is assigned a unique identifier in a form of a URI (Uniform Resource Identifier) or a URL (Uniform Resource Locator). The unique identifier is modified each time the content is accessed by a user. The content parameters in the identifier are modified in order to keep track of number of accesses to the content by users. By changing the parameters assigned to the content, a publisher or an advertiser can determine a number of recipients of the content and keep track of the entire process of content distribution and its propagation throughout a network.

Abstract: A system for consolidation of backups. Each backup includes data and a map with offsets or addresses that point to data of current and/or previous backups. Backup are selected for consolidation. The offsets in the maps of the selected backups are combined into a single set of offsets; consolidating the selected backups to a new backup that contains the latest data from the selected backups, determined based on the offsets in the single set. The offsets in the single set are updated to point to the data in the new backup. The updated offsets are stored in the new backup as part of a backup map of the new backup. The selected backups comprise one initial full backup and at least one backup. Offsets from the maps of first backup of the selected sequence of backups up to the last created backup are checked.

Abstract: Managing dynamic content of a website, including creating static content assigned to dynamic content of the website, with unmodifiable scripts; creating an active content for processing dynamic content, with hidden elements and elements with only visual marks representation; transmitting the static content to a user; selecting references to the active content within the static content; requesting description of the active content from a server; transmitting the active content to the user; displaying the active content; editing dynamic content and visual representations of data requested by user; representing a first document form generated from an HTML representation of server data and unmodifiable scripts, and which includes the elements; generating a request for data needed for a current visualization of the form; generating a second related data representation of another form; delivering second related data representation for display in browser; storing content of the website on server and making it public

Abstract: Methods and systems for safe execution of guest code in virtual machine context are presented. A method for running a virtual machine in a computing system includes (a) launching a virtual machine monitor (VMM) that uses a software debugger; (b) launching a virtual machine (VM) that can natively run safe instructions; (c) determining, at runtime, if the instruction is safe or potentially unsafe; (d) executing safe instructions in a native mode; and (e) activating control logic to process potentially unsafe instructions in the software debugger. The software debugger can bypass at least one of the potentially unsafe instructions. The potentially unsafe instructions include instructions that cannot be safely executed in the context of the VM, and instructions that can cause unpredictable results in the context of the VM.

Abstract: A method, system and computer program product for providing driver functionality in computing system includes installing an operating system on the computing system; forming a plurality of isolated sandboxes running on the computing system under control of the operating system; during an attempt to install a driver, installing driver stub in the operating system; installing the driver in one of the isolated sandboxes, wherein the driver directly uses at least part of system resources; using a gateway between the driver stub and the installed driver to provide an interface for transmitting requests from the driver stub to driver.

Abstract: A system, method and computer program product for virtualizing a processor include a virtualization system running on a computer system and controlling memory paging through hardware support for maintaining real paging structures. A Virtual Machine (VM) is running guest code and has at least one set of guest paging structures that correspond to guest physical pages in guest virtualized linear address space. At least some of the guest paging structures are mapped to the real paging structures. A cache of connection structures represents cached paths to the real paging structures. The mapped paging tables are protected using RW-bit. A paging cache is validated according to TLB resets. Non-active paging tree tables can be also protected at the time when they are activated. Tracking of access (A) bits and of dirty (D) bits is implemented along with synchronization of A and D bits in guest physical pages.

Abstract: A system for maximizing the efficiency of a load balancing server for an asymmetric web farm utilizes a TCP stack and data packets to send and receive client service requests. An internal buffer enables each web server in the web farm to balance their loading based on the contents of the client service request. Data switching between the address portion of the user space and the address portion of the kernel space within the load balancing server is eliminated.

Abstract: A system for secure distributed data storage that uses a network, where the system includes a file stored on a plurality of storage elements that are accessible over the network. An access control list associated with the file includes a list of users with read access to the file and a list of users with write access to the file. Data representing contents of the file, metadata associated with the file, data related to functioning of distributed data storage and the access control list is available to users of the network.

Abstract: This invention relates to a method, system and computer program product for restoration of a real hardware server or a Virtual Machine server from hibernation. The method starts with running the execution environment on the hardware platform and suspending the execution environment and storing a state of the execution environment; then updating the stored state with drivers corresponding to a new hardware platform; then restoring an updated state on the computing system on the new hardware platform; then continuing operation of the execution environment on the new hardware platform. The state of execution environment includes operating memory state and nonvolatile storage stage.

Abstract: A system, method and computer program product for backup and restore of MS Exchange server. The method for MS Exchange Server backup and restore comprises launching a system filter and applying logs; mounting a data base from files located in a virtual folder; moving the file data from the archive into the real folder while the MS Exchange Server remains open and the database being restored is mounted. The data is moved into the real folder from the archive by blocks. The database files of the MS Exchange Server are divided into data sets (i.e., blocks). For each block a special bit in its bitmap is marked to indicate, whether this block has been moved to the real folder or still remains in the archive (i.e., backup). When the blocks are moved, the updated blocks do not need to be transferred from the archive into the real folder. After the data blocks are moved into the real folder, the restored database is dismounted and the virtual folder is dismounted.

Abstract: A computing system includes a physical server having a single instance of an operating system; and a plurality of virtual environments running on the physical server and directly supported by the single instance of the operating system. Each virtual environment responds to requests from users and appears to the users as a stand-alone server having its own instance of the operating system. Each virtual environment has a plurality of objects associated with it and supported by the operating system. Some of the objects are private and other objects are shared between multiple virtual environments. One virtual environment cannot access private objects of another virtual environment.

Abstract: A system, method and computer program product for managing computer resources in a computer system running an operating system and a plurality of processes grouped into at least two groups. A set of resource limits corresponds to the processes. A scheduler of resource allocation allocates resources to each process such that total resource allocation to a group to which that process belongs remains constant. The scheduler reallocates the resources based on a request for resources over an established limit, a predictive algorithm, or process priority, or based on relative weighting of the processes. The scheduler can reallocate to one of an increase and a decrease of the resources available to a particular process. The scheduler can reallocate the resources to exceed the resource allocation to a particular process while keeping the resource allocation to the group to which that process belongs constant.

Abstract: A method of producing carbon nanotubes, comprising, in a reaction chamber: evaporating at least a partially melted electrode comprising a catalyst by an electrical arc discharge; condensing the evaporated catalyst vapors to form nanoparticles comprising the catalyst; and decomposing gaseous hydrocarbons in the presence of the nanoparticles to form carbon nanotubes on the surface of the nanoparticles. Also a system for producing carbon nanotubes, comprising: a reactor comprising two electrodes, wherein at least one of the electrodes is at least a partially melted electrode comprising a catalyst, the reactor adapted for evaporating the at least partially melted electrode by an electrical arc discharge and for condensing its vapors to form nanoparticles comprising the catalyst, wherein the electrodes are disposed in a reaction chamber for decomposing gaseous hydrocarbons in the presence of the nanoparticles to form carbon nanotubes on the surface of the nanoparticles.

Abstract: A system, method and computer program product for virtualizing a processor and its memory, including a host operating system (OS); and virtualization software that maintains a virtualization environment for running a Virtual Machine (VM) without system level privileges and having a guest operating system running within the Virtual Machine. A plurality of processes are running within the host OS, each process having its own virtual memory, wherein the virtualization software is one of the processes. A host OS swap file is stored in persistent storage and maintained by the host operating system. The host OS swap file represents virtualized physical memory of the VM. A plurality of memory pages are aggregated into blocks, the blocks being stored in the host OS swap file and addressable in block form. The virtualization software manages the blocks so that blocks can be mapped to the virtualization software process virtual memory and released when the blocks are no longer necessary.

Abstract: A computer system includes a first portion of a Hypervisor is loaded into the memory as a part of an Extensible Firmware Interface upon start up and prior to loading of an operating system. The first portion is responsible for context switching, at least some interrupt handling, and memory protection fault handling. The first portion runs on a root level. An operating system is loaded into a highest privilege level. A second portion of the Hypervisor is loaded into operating system space together with the operating system, and runs on the highest privilege level, and is responsible for (a) servicing the VMM, (b) servicing the VMs, (c) enabling communication between code launched on non-root level with the second portion of the Hypervisor to perform security checks of trusted code portions and to enable root mode for the code portions if allowable. The VMM runs on the highest privilege level. A Virtual Machine is running under control of the VMM. Trusted code runs on non-root level.

Abstract: A method and system for accelerating malware emulator by using an accelerator. The accelerator allows for a potentially malicious component (i.e., process) containing dummy processes to be executed in a real CPU of a computer system using its operating memory. A special memory area is allocated for the process based on the memory requested by the process in the emulator. The state of the CPU and the memory is loaded in the emulator prior to executing the suspicious process. The system can be restored to its initial state in case of malicious actions performed by the process. The dummy instructions of the process are processed by the CPU at its own speed and as soon as the process performs a malicious instruction it is stopped by the emulator. The emulation process is accelerated to a speed of a regular CPU.

Abstract: A method, system and computer program product recorded on a computer-readable medium for execution on at least one processor, for seamless integration of a non-native application into a host OS, including launching a first Virtual Execution Environment (VEE) on a computing system that has a host operating system and a host desktop displayed to a user; displaying a window corresponding to the VEE on the host desktop; upon a user invoking a user application that is non-native to both the host OS and the first VEE, (a) installing a second VEE that is compatible with the user application, (b) installing the user application into the second VEE, (c) launching the application inside the second VEE, and (d) displaying the non-native application window within a window of the second VEE. The VEE can be a Virtual Private Server or a Virtual Machine.

Abstract: A method, computer program product and system for monitoring execution behavior of a program product in a data processing system include development of a trace tool having trace strings written in a human language and provided with data fields for diagnostic information relevant to executable portions of the program product. Identifiers of the trace tool, trace strings, and data fields and components of the diagnostic information are encoded using a coded binary language. After monitoring execution of the program product, a trace report of the trace tool is translated for an intended recipient from the coded binary language into the human language, whereas an unauthorized access to the contents of the trace record is restricted. The encoding or decoding operations are performed using databases containing the respective identifiers and components of the diagnostic information in the coded binary language and the human language.