Abstract: An apparatus, system, and method for measuring the similarity of binary objects is disclosed. The method determines at least one pattern signature in an Nth binary object, accessing a location in a similarity store which has object identifiers for each of the previous N?1 binary objects which contain the corresponding pattern, and writing the object identifier of the Nth binary object at that same location in the similarity store. Reporting the number of locations in similarity store which contain the object identifiers of two apparently diverse binary objects is a measure of similarity to each other.

Abstract: Domain Name Service (DNS) requests are used as the reporting vehicle for ensuring that security-related information can be transferred from a network. As one possibility, a central facility for a security provider may maintain a data collection capability that is based upon receiving the DNS requests containing the information being reported. In an email application, if a data block is embedded within or attached to an email message, an algorithm is applied to the data block to generate an indicator that is specifically related to the contents of the data block. As one possibility, the algorithm may generate a hash that provides a “digital fingerprint” having a reasonable likelihood that the hash is unique to the data block. By embedding the hash within a DNS request, the request becomes a report that the data block has been accessed.

Abstract: A cloud file event server transmits file events necessary to synchronize a file system of a file share client. A tree queue director circuit receives file events and stores each one into a tree data structure which represents the hierarchical paths of files within the file share client. An event normalization circuit sorts the file events stored at each node into sequential order and moots file events which do not have to be performed because a later file event makes them inconsequential. A thread scheduling circuit assigns a resource to perform file events at a first node in a hierarchical path before assigning one or more resources to a second node which is a child of the first node until interrupted by the tree queue director circuit or until all file events in the tree data structure have been performed.

Abstract: Secure Remote Support Automation Process wherein a remote support server receives a support task request and schedules a predefined task to a predefined actor who also has a predefined escalation policy and notifies the support actor of the scheduled task along with a key, a key seed, or a credential to use in authentication. The method enabling privileged access to an Internet security appliance using public/private key pairs through a firewall and network address translation by a support server and an assigned support task actor.

Abstract: A new approach is proposed that contemplates systems and methods to support encryption and decryption of files including data and source code associated with a software application running in a virtual environment on a per-file basis outside of a kernel of an operating system. The proposed approach utilizes metadata of the files associated with the software application to determine the files to be encrypted and decrypted and to monitor various properties of the files including the sizes of the unencrypted files for accurate reporting of information about the files. Under such an approach, the source code of the applications are encrypted and decrypted transparently at the file level without modifying or altering any of the source code of the application, the kernel and libraries of the operating system, and/or any components which are proprietary to the virtual environment.

Abstract: A wireless device is communicatively coupled via SMS text protocol to a network control device by a data modem. Authentication of the operator enables a limited number of fixed operations such as status reports, initializing a new network connection, and modifications to a routing table to be carried out.

Abstract: A transmission apparatus operation method for optimizing a virtual private network operates by defragmenting and de-duplicating transfer of variable sized blocks. A large data object is converted to a plurality of data paragraphs by a fingerprinting method. Each data paragraph is cached and hashed. The hashes are transmitted to at least one satellite apparatus. Only data paragraphs which were not previously cached at each satellite are transferred.

Abstract: A network gateway coupled to a backup server on a wide area network which receives and de-duplicates binary objects. The backup server provides selected data segments of binary objects to the gateway to store into a prescient cache (p-cache) store. The network gateway optimizes network traffic by fulfilling a local client request from its local p-cache store instead of requiring further network traffic when it matches indicia of stored data segments stored in its p-cache store with indicia of a first segment of a binary object requested from and received from a remote server.

Abstract: A new approach is proposed that contemplates systems and methods to support providing a mobile device associated with a user a plurality of file segments retrieved based on the location of the mobile device. Under the approach, when the user arrives at a location, a remote file/copy server receives a location indicia of the mobile device independent of and separated from a request for an electronic document by the mobile device. The remote server determines a geo-fenced area based on the location indicia of the mobile device, searches for and retrieves from a database one or more geo-tagged file segments that match the location of the mobile device.

Abstract: A system enables booting a virtual machine and browsing files from a de-duplicated backup server by initializing a virtual machine process, and setting up NFS services connecting the NFS service to a fake disk. The fake disk is actualized by a backup server and an overlay store. Writing into the fake disk is supported by an overlay store. Reading from the fake disk is supported by file reads from the backup server or from the overlay store.

Abstract: A new approach is proposed that contemplates systems and methods to support backing up only portions of data associated with a virtual machine that have been changed since the last backup of the data was performed. During a backup process, the proposed approach looks for a journal record of a file system located within one of the partitions on a virtual disk of the virtual machine, wherein the journal record reflects disk operations that have been performed to a storage device associated with a host device/machine running the virtual machine. Once portions of the storage device which data have been modified since the last data backup are identified based on the journal of the file system, only the modified portions of the storage device are submitted to the backup process to be backed up to a backup storage device.

Abstract: An apparatus and system for scoring and grading websites and method of operation. An apparatus receives one or more Uniform Resource Identifiers (URI), requests and receives a resource such as a webpage, and observes the behaviors of an enhanced browser emulator as controlled by javascript provided by the webpage. The enhanced browser emulator tracks behaviors which when aggregated imply malicious intent.

Abstract: A method for operating an apparatus to recall email which has already passed through a spam filter to user mailboxes. An apparatus stores a highly efficient database for a brief period of time after an email is received, filtered, and transmitted to an email server. Message id, recipient, connecting IP address and other spam attributes are stored in a searchable format. After receiving updated spam attributes, a spam filter apparatus under software control queries the database for messages that were not detected as spam before transmittal to the email clients and servers, and sends spam recall messages. Improved email clients and servers adapted by software instructions, move or modify email user mailboxes upon receipt of the spam recall.

Abstract: An apparatus to scale for multiple petabyte backup in redundant locations. Workload is automatically shared among many servers by a characteristic derived from the content itself. Duplicate storage is eliminated by checking for the existence or absence of simple files and appending client identification to files shared among multiple subscribers. Replication depends on simple atomic file operations rather than use of tables or databases. An efficient storage method for much larger quantities of data than conventional services.

Abstract: Domain Name Service (DNS) requests are used as the reporting vehicle for ensuring that security-related information can be transferred from a network. As one possibility, a central facility for a security provider may maintain a data collection capability that is based upon receiving the DNS requests containing the information being reported. In an email application, if a data block is embedded within or attached to an email message, an algorithm is applied to the data block to generate an indicator that is specifically related to the contents of the data block. As one possibility, the algorithm may generate a hash that provides a “digital fingerprint” having a reasonable likelihood that the hash is unique to the data block. By embedding the hash within a DNS request, the request becomes a report that the data block has been accessed.

Abstract: A mobile wireless safe browser receives a destination link, host, uniform resource identifier, or Internet Protocol address. Prior to requesting a resource from the destination, the safe browser transmits a query over the air to a reputation service and receives a messages enabling or disabling conventional browser request for IP address or resources at the destination host. The user is identified to a reputation service which maintains categories of websites and a policy file for each user which enables or disables access to each category .

Abstract: A system at a central server and at a plurality of web filters is installed to observe traffic and to protect users from attempting connection to suspicious, malicious, and/or infectious targets. Targets are defined as Uniform Resource Identifiers (URI) and Internet Protocol (IP) addresses. Traffic is collected, analyzed, and reported for further analysis. Behavior is analyzed for each client attempting a connection to an uncategorized target. IP addresses and URIs are evaluated toward placement in either a Trusted target store or an Anomalous target store. The accumulated content of Anomalous target store is provided back to the Network Service Subscriber Clients. Warnings and tools are presented when appropriate.

Abstract: An apparatus which receives client-server transactions such as HTTP REQUESTS and transforms them into a synopsis format for archival storage. HTTP transactions are logged and parsed for key words called HTTP METHODS. For each HTTP METHOD, data is extracted from the message or the resources provided by the transaction. The data is efficiently stored into a transaction store. The data is also indexed and the index is stored into the transaction store. A record is kept for all concurrent sessions by usernames associated with a directory entry.

Abstract: A system for providing video intelligence as a service to a plurality of small and medium sized enterprises to distributed video recordation equipment, comprising an apparatus and computer-implemented method. An apparatus comprises a point of recordation terminal apparatus coupled to a public network. A method for operating a system for video intelligence in a public network in a secure manner.

Abstract: Network security administrators are enabled to revoke certificates with their customizable certificate authority reputation policy store which is informed by an independent certificate authority reputation server when a CA is deprecated or has fraudulent certificate generation. The custom policy store overrides trusted root certificate stores accessible to an operating system web networking layer or to a third party browser. Importing revocation lists or updating browsers or operating system is made redundant. The apparatus protects an endpoint from a man-in-the-middle attack when a certificate authority has lost control over certificates used in TLS.