Abstract: A method and system for unified communications threat management (UCTM) for converged voice and video over IP is disclosed. A computer-implemented method for threat management receives an incoming packet. The incoming packet is broken into sub-packets and fed to a plurality of packet processing engines. Each packet processing engine inspects the sub-packets and annotate the sub-packets with meta-data. The annotated sub-packets are combined and processed by a plurality of application engine to generate a processed packet. The processed packet is classified and stored in a database.

Abstract: A method and system for unified communications threat management (UCTM) for converged voice and video over IP is disclosed. A computer-implemented method for threat management receives an incoming packet. The incoming packet is broken into sub-packets and fed to a plurality of packet processing engines. Each packet processing engine inspects the sub-packets and annotate the sub-packets with meta-data. The annotated sub-packets are combined and processed by a plurality of application engine to generate a processed packet. The processed packet is classified and stored in a database.

Abstract: A system and method to precisely learn and enforce security rules for Unified Communication (UC) applications and endpoints is disclosed. According to one embodiment, a behavioral learning system learns and abstracts positive flow behaviors of UC applications and endpoints. The properties of previously received messages from the endpoints and learned behaviors of the plurality of endpoints are stored in a database. A message from a endpoint is received by a message scanner and correlated with the AOR records in the database. The message is classified into one of a whitelist, a blacklist, and a graylist based on the results of analysis by the analysis engine. The whitelist contains the AOR records that are legitimate, the blacklist contains the AOR records that are a potential attack, and the graylist contains the AOR records that belong to neither the whitelist nor the blacklist.

Abstract: A method and system for detecting a spam over internet telephony (SPIT) is disclosed. Incoming call requests are received and analyzed using heuristic algorithms. A runtime action is provided based on the analysis using the heuristic algorithms. The heuristic algorithms include zero-touch heuristic algorithms that require no human intervention, one-touch heuristic algorithms that require human intervention one time, and multi-touch heuristic algorithms that require human intervention more than one time. Cumulative probability is calculated for each incoming call request, and the incoming call request is classified as a spam if the cumulative probability exceeds a threshold.

Abstract: A method and system for unified communications threat management (UCTM) for converged voice and video over IP is disclosed. A computer-implemented method for threat management receives an incoming packet. The incoming packet is broken into sub-packets and fed to a plurality of packet processing engines. Each packet processing engine inspects the sub-packets and annotate the sub-packets with meta-data. The annotated sub-packets are combined and processed by a plurality of application engine to generate a processed packet. The processed packet is classified and stored in a database.

Abstract: A method and system for detecting a spam over internet telephony (SPIT) is disclosed. Incoming call requests are received and analyzed using heuristic algorithms. A runtime action is provided based on the analysis using the heuristic algorithms. The heuristic algorithms include zero-touch heuristic algorithms that require no human intervention, one-touch heuristic algorithms that require human intervention one time, and multi-touch heuristic algorithms that require human intervention more than one time. Cumulative probability is calculated for each incoming call request, and the incoming call request is classified as a spam if the cumulative probability exceeds a threshold.

Abstract: Protected software, such as an application and/or DLL, is monitored by protective software to guard against attacks, while distinguishing spurious, benign events from attacks. In a 1-touch approach, the protected software is monitored in a testing environment to detect spurious, benign events caused by, e.g., incompatibility or interoperability problems. The spurious events can be remediated in different ways, such as by applying a relaxed security policy. In a production mode, or 0-touch mode, when the protected software is subject to attacks, the corresponding remediation can be applied when the spurious events are again detected. Security events which occur in production mode can also be treated as benign when they occur within a specified time window. The applications and/or DLLs can further be classified according to whether they are known to have bad properties, known to be well-behaved, or unknown. Appropriate treatment is provided based on the classification.

Abstract: A method and system for unified communications threat management (UCTM) for converged voice and video over IP is disclosed. A computer-implemented method for threat management receives an incoming packet. The incoming packet is broken into sub-packets and fed to a plurality of packet processing engines. Each packet processing engine inspects the sub-packets and annotate the sub-packets with meta-data. The annotated sub-packets are combined and processed by a plurality of application engine to generate a processed packet. The processed packet is classified and stored in a database.

Abstract: Protected software, such as an application and/or DLL, is monitored by protective software to guard against attacks, while distinguishing spurious, benign events from attacks. In a 1-touch approach, the protected software is monitored in a testing environment to detect spurious, benign events caused by, e.g., incompatibility or interoperability problems. The spurious events can be remediated in different ways, such as by applying a relaxed security policy. In a production mode, or 0-touch mode, when the protected software is subject to attacks, the corresponding remediation can be applied when the spurious events are again detected. Security events which occur in production mode can also be treated as benign when they occur within a specified time window. The applications and/or DLLs can further be classified according to whether they are known to have bad properties, known to be well-behaved, or unknown. Appropriate treatment is provided based on the classification.

Abstract: Protected software, such as an application and/or DLL, is monitored by protective software to guard against attacks, while distinguishing spurious, benign events from attacks. In a 1-touch approach, the protected software is monitored in a testing environment to detect spurious, benign events caused by, e.g., incompatibility or interoperability problems. The spurious events can be remediated in different ways, such as by applying a relaxed security policy. In a production mode, or 0-touch mode, when the protected software is subject to attacks, the corresponding remediation can be applied when the spurious events are again detected. Security events which occur in production mode can also be treated as benign when they occur within a specified time window. The applications and/or DLLs can further be classified according to whether they are known to have bad properties, known to be well-behaved, or unknown. Appropriate treatment is provided based on the classification.

Abstract: A method and system for detecting a spam over internet telephony (SPIT) is disclosed. Incoming call requests are received and analyzed using heuristic algorithms. A runtime action is provided based on the analysis using the heuristic algorithms. The heuristic algorithms include zero-touch heuristic algorithms that require no human intervention, one-touch heuristic algorithms that require human intervention one time, and multi-touch heuristic algorithms that require human intervention more than one time. Cumulative probability is calculated for each incoming call request, and the incoming call request is classified as a spam if the cumulative probability exceeds a threshold.

Abstract: A system and method to precisely learn and enforce security rules for Unified Communication (UC) applications and endpoints is disclosed. According to one embodiment, a behavioral learning system learns and abstracts positive flow behaviors of UC applications and endpoints. The properties of previously received messages from the endpoints and learned behaviors of the plurality of endpoints are stored in a database. A message from a endpoint is received by a message scanner and correlated with the AOR records in the database. The message is classified into one of a whitelist, a blacklist, and a graylist based on the results of analysis by the analysis engine. The whitelist contains the AOR records that are legitimate, the blacklist contains the AOR records that are a potential attack, and the graylist contains the AOR records that belong to neither the whitelist nor the blacklist.

Abstract: A method and system for unified communications threat management (UCTM) for converged voice and video over IP is disclosed. A computer-implemented method for threat management receives an incoming packet. The incoming packet is broken into sub-packets and fed to a plurality of packet processing engines. Each packet processing engine inspects the sub-packets and annotate the sub-packets with meta-data. The annotated sub-packets are combined and processed by a plurality of application engine to generate a processed packet. The processed packet is classified and stored in a database.

Abstract: Protected software, such as an application and/or DLL, is monitored by protective software to guard against attacks, while distinguishing spurious, benign events from attacks. In a 1-touch approach, the protected software is monitored in a testing environment to detect spurious, benign events caused by, e.g., incompatibility or interoperability problems. The spurious events can be remediated in different ways, such as by applying a relaxed security policy. In a production mode, or 0-touch mode, when the protected software is subject to attacks, the corresponding remediation can be applied when the spurious events are again detected. Security events which occur in production mode can also be treated as benign when they occur within a specified time window. The applications and/or DLLs can further be classified according to whether they are known to have bad properties, known to be well-behaved, or unknown. Appropriate treatment is provided based on the classification.

Abstract: A system for optimizing computing code containing procedures identifies code blocks as hot blocks or cold blocks in each procedure based on the local block weights of the code blocks in the procedure. The hot blocks are grouped into an intraprocedure hot section and an intraprocedure cold section for each procedure to optimize the procedure. The intraprocedure hot sections in the procedures are selectively grouped into an interprocedure hot section and the intraprocedure cold sections are selectively grouped into an interprocedure cold section, based on global block weights of the code blocks, to optimize the computing code. Additionally, code sections from called procedures can be duplicated into calling procedures to further optimize the computing code.