Abstract: Systems and methods for flowlet switching using memory instructions. One embodiment is a method of distributing packets over multiple paths. The method includes determining an elapsed time between a packet and a previous packet. The method further includes, in response to determining that the elapsed time is less than an inter-packet gap threshold: retaining a previously selected path value indicated in the flow record, and providing the previously selected path value to the processing thread for transmitting the packet over a previously selected path associated with the previous packet. The method also further includes, in response to determining that the elapsed time is greater than the inter-packet gap threshold: updating the flow record by replacing the previously selected path value with the path value of the selected path of the memory instruction, and providing the path value to the processing thread for transmitting the packet over the selected path.

Abstract: Systems and methods for flowlet switching using memory instructions. One embodiment is a method of distributing packets over multiple paths. The method includes determining an elapsed time between a packet and a previous packet. The method further includes, in response to determining that the elapsed time is less than an inter-packet gap threshold: retaining a previously selected path value indicated in the flow record, and providing the previously selected path value to the processing thread for transmitting the packet over a previously selected path associated with the previous packet. The method also further includes, in response to determining that the elapsed time is greater than the inter-packet gap threshold: updating the flow record by replacing the previously selected path value with the path value of the selected path of the memory instruction, and providing the path value to the processing thread for transmitting the packet over the selected path.

Abstract: A scalable, malware detection system features at least one sensor and a cluster including at least one computing node. The computing node includes an analysis coordination system and an object analysis system. The analysis coordination system, when activated as a broker computing node, (i) receives metadata from a sensor, (ii) analyzes the metadata, and (iii) places at least a portion of the metadata into a data store for subsequent use in retrieval of the suspicious object by the object analysis system from the sensor. The object analysis system is configured to (i) retrieve the portion of the metadata, which includes at least a sensor identifier, from the data store, (ii) retrieve the suspicious object from the sensor using at least part of the portion of the metadata retrieved from the data store, and (iii) analyze the suspicious object for malware.

Abstract: A computerized method to coordinate the detection capabilities of an email-based malware detection system with the detection capabilities of a network-based malware detection system and prevent multi-vector cyber-security attacks. The described system detects and analyzes suspicious objects via the email vector and monitors and analyzes associated objects via the network vector, collecting features of each object. The features of associated objects are analyzed, correlated and classified to determine if they are malicious.