Abstract: The present invention is directed to a method and apparatus for storing and reconstructing data. In one embodiment of the present invention, both real-time (i.e., dynamic) information and static information are stored in a Digital Video Disk (DVD) to replicate or restore an information system. The dynamic and static information are considered trust-support data. The trust-support data provides a complete view of the information system. For example, the state of current transactions operating in the information system is part of the trust-support data. The trust-support data may include GUI information, timestamp information, network information, authentication information, generalized receipts, and specialized receipts.

Abstract: An efficient method and apparatus for rapidly detecting anomalies from massive data streams is disclosed. In one embodiment, the method enables near real time detection of anomaly behavior in networks. The invention rapidly identifies the addresses that require further analysis and reduces the cost of monitoring, the cost of managing the security of the network as well as reduces the time needed to initiate mitigation steps.

Abstract: An efficient method and apparatus for rapidly detecting anomalies from massive data streams is disclosed. In one embodiment, the method enables near real time detection of anomaly behavior in networks. The invention rapidly identifies the addresses that require further analysis and reduces the cost of monitoring, the cost of managing the security of the network as well as reduces the time needed to initiate mitigation steps.

Abstract: A system and method for high resolution access control for packetized information. A packet is received at a firewall. A rule corresponding to header information in the packet prescribes referring the packet to an access control proxy. The access control proxy analyzes the contents of the packet, and identifies a rule based upon the contents. The rule is implemented at the firewall.

Abstract: A system for and method of pre-filtering data to create and/or maintain data in a working memory such that the data can be more efficiently used by an expert system. In one example, event triggers are used to enable efficient management of faults that occur in an expert system, such as faults that occur in connection with the interaction between a central system and a number of remote systems controlled by the central system. The event triggers filter data that is potentially relevant to the operation of the expert system, each event trigger comprising a match portion and an action portion. A processor compares the match portion of at least one of the event triggers to the potentially relevant data, and executes the action portion of any event trigger whose match portion matches the potentially relevant data, the execution comprising modifying the working memory. The evaluation of and execution of the event triggers occurs independently of other event triggers.

Abstract: A system and method for interacting a central host with at least one remote processor, wherein each remote processor executes software that generates remote screen data to maintain a screen display, the system comprising: a central processor; a memory connected to the central processor; a communications link connecting the central processor to a remote processor; wherein the central processor receives the remote screen data from the remote processor and stores the remote screen data in the memory, the system executing predetermined actions based on the remote screen data.