Abstract: The present disclosure includes a detection method for files infected by malware, especially ransomware, and an anti-malware system implemented with the method during file transmission, especially for backup or synchronization. Applying the detection method in the present disclosure before file transmission may prevent infection spreading by replace uninfected files with infected files. In one embodiment, the method includes: creating files as “baits” for being accessed by ransomware; and detecting whether files being to be transmitted due to updates including the “baits”. The present disclosure also includes file recovery method while finding malware infection by the detection method of in the present disclosure.

Abstract: A technique for protecting a high availability device in a computer network includes deploying an appliance between the high availability device and a network connection. The high availability device may be a device configured for a manufacturing operation, such as wafer fabrication, for example. The appliance may be a transparent security appliance with a scanning engine for scanning packets for malicious content, such as computer viruses or worms, for example. Scanning control information can be supplied to the appliance by way of either a removable storage medium or a secure server coupled to the appliance, for example. The scanning control information can include a patch update, perhaps with signatures of viruses and associated control instructions. The appliance can then block any malicious content entering the appliance in response to the scanning control information.

Abstract: The invention provides an antivirus network or Internet appliance and methods therefor. A preferred embodiment of the Internet appliance according to the invention comprises an interface connecting the Internet appliance to a terminal, a memory, and a network connection connecting the Internet appliance to a network (such as a wide area network (WAN) or the Internet) wherein data in the network are operable with a corresponding network protocol (such as TCP/IP). Protocol-level programs are stored in the memory for receiving data being transmitted from the network to the terminal through the Internet appliance wherein the protocol-level programs are compatibly operable with the network protocol. Application-level antivirus programs are stored in the memory for detecting computer viruses in the received data serving as a firewall against the detected computer viruses for the terminal.

Abstract: Systems and methods for configuring a set of devices at layer 2 are disclosed. The configuration employs a deployment tool disposed at the computer and a deployment agent disposed at the devices. Using DLTP (Data Layer Transport Protocol), network discovery and configuration data transfer are facilitated even if the devices do not have IP addresses or protocol drivers to communicate at layer 3. Each deployment agent automatically configures its associated device after receiving the configuration data via layer 2. Other embodiments permit configuration of devices using data stored in a portable storage apparatus. In this manner, devices can be configured automatically without the need to manually configure devices one-by-one.

Abstract: Debugging of a network security appliance is facilitated by allowing for generation of debug information in a user-friendly manner. In one embodiment, the network security appliance automatically detects a presence of a file in a removable non-volatile memory and, in response, places at least one of its components in debug mode. This allows the component to write debug information to the removable non-volatile memory. Removal of the removable non-volatile memory from the network security appliance automatically triggers placement of the component in non-debug mode. The debug information generated in the network security appliance may be forwarded to a server computer for analysis.

Abstract: In one embodiment, a technique for configuring a network component in a computer network includes coupling the network component to a first computer and a second computer. The network component may be an appliance while the second computer may be a management server for the appliance, for example. A data unit, such as an Internet Protocol (IP) packet, can be sent from the first computer and the data unit can be observed by the appliance such that a source of the data unit may be determined. The source address of the data unit can then be adopted as an appliance address. Also, the appliance address may be forwarded from the appliance to the management server for registration. The appliance may be a transparent security appliance or device, for example. Among other advantages, the technique allows for plug-and-play accommodation of network components with good usability across different network configurations.

Abstract: The invention provides an antivirus network or Internet appliance and methods therefor. A preferred embodiment of the Internet appliance according to the invention comprises an interface connecting the Internet appliance to a terminal, a memory, and a network connection connecting the Internet appliance to a network (such as a wide area network (WAN) or the Internet) wherein data in the network are operable with a corresponding network protocol (such as TCP/IP). Protocol-level programs are stored in the memory for receiving data being transmitted from the network to the terminal through the Internet appliance wherein the protocol-level programs are compatibly operable with the network protocol. Application-level antivirus programs are stored in the memory for detecting computer viruses in the received data serving as a firewall against the detected computer viruses for the terminal.