Abstract: Systems and methods for detecting malicious or potentially malicious script data are provided. Script data is extracted from a data stream at the network level and emulated in a controlled environment. Based upon a comparison of features extracted from emulation of the script to a set of heuristics, malicious script data can be identified for further analysis or processing.

Abstract: Systems and methods for detecting malicious or potenitally malicious script data are provided. Script data is extracted from a data stream at the network level and emulated in a controlled environment. Based upon a comparison of features extracted from emulation of the script to a set of heuristics, malicious script data can be identified for further analysis or processing.

Abstract: Systems and methods for detecting malicious or potenitally malicious script data are provided. Script data is extracted from a data stream at the network level and emulated in a controlled environment. Based upon a comparison of features extracted from emulation of the script to a set of heuristics, malicious script data can be identified for further analysis or processing.

Abstract: A system and method classifies packets with a programmably fixed network processor program and dynamically updated data structures. The network processor program selects predetermined packet field values of the packets transmitted across the network and classifies the packets by matching one or more packet field values with a data structure. New packet classifications are dynamically created by updating the data structure to associate one or more predetermined packet field values with the new packet classification. For instance, a parse tree program extracts packet header information and matches the packet header information to the data structure. A pattern tree data structure provides longest prefix matches and an ordered tree data structure provides combination matches so that classification of arbitrary Boolean combinations of extracted header fields can be formed.

Abstract: A system and method classifies packets with a programmably fixed network processor program and dynamically updated data structures. The network processor program selects predetermined packet field values of the packets transmitted across the network and classifies the packets by matching one or more packet field values with a data structure. New packet classifications are dynamically created by updating the data structure to associate one or more predetermined packet field values with the new packet classification. For instance, a parse tree program extracts packet header information and matches the packet header information to the data structure. A pattern tree data structure provides longest prefix matches and an ordered tree data structure provides combination matches so that classification of arbitrary Boolean combinations of extracted header fields can be formed.