Abstract: A new approach is proposed that contemplates systems and methods to support interactive moderation of network traffic, where authorization to access certain web media content is approved or denied on a per-content item basis in real time. When a content requester initiates a request for a piece of web media content from a content provider over the Internet, the request is intercepted and either allowed, denied, or marked as requiring further approval based on content access policies and restrictions specific to the content requester. If the content request is marked as requiring further approval, it will be forwarded to a traffic moderator, which will make a decision on the request based on policies related to the content requester and the requested web media content in real time. The requester is then either allowed or denied access to the web media content based on the decision by the traffic moderator.

Abstract: A store for virus and malware fingerprints is coupled to a backup server apparatus which receives hashes and file shards from backup clients through a network. A circuit compares hashes received from backup clients to determine matches with file shards previously stored and matches with file shards with virus or malware infections. File shards not previously stored are received for backup and inspection by a virus filter. When a received file shard is determined to match a virus or malware fingerprint, a process is initiated to restore the file on the backup client to a clean version and notify the user and the network security administrator. The hashes of file shards determined to match a virus or malware fingerprint are stored for future reference. The data of a file shard which has been determined to be infected is also stored in case of a false-positive determination.

Abstract: An apparatus, system, and method for measuring the similarity of communication packet binary objects to classified object binary objects is disclosed. The method determines at least one pattern signature in an Nth binary object, accessing a location in a similarity store which has object identifiers for each of the previous N?1 binary objects which contain the corresponding pattern, and writing the object identifier of the Nth binary object at that same location in the similarity store. Reporting the number of locations in similarity store which contain the object identifiers of a communication packet and a classified object is a measure of similarity to each other. Outgoing packets are blocked if they correlate highly with confidential documents or objects.

Abstract: An apparatus, system, and method for measuring the similarity of binary objects is disclosed. The method determines at least one pattern signature in an Nth binary object, accessing a location in a similarity store which has object identifiers for each of the previous N?1 binary objects which contain the corresponding pattern, and writing the object identifier of the Nth binary object at that same location in the similarity store. Reporting the number of locations in similarity store which contain the object identifiers of two apparently diverse binary objects is a measure of similarity to each other.

Abstract: Domain Name Service (DNS) requests are used as the reporting vehicle for ensuring that security-related information can be transferred from a network. As one possibility, a central facility for a security provider may maintain a data collection capability that is based upon receiving the DNS requests containing the information being reported. In an email application, if a data block is embedded within or attached to an email message, an algorithm is applied to the data block to generate an indicator that is specifically related to the contents of the data block. As one possibility, the algorithm may generate a hash that provides a “digital fingerprint” having a reasonable likelihood that the hash is unique to the data block. By embedding the hash within a DNS request, the request becomes a report that the data block has been accessed.

Abstract: Secure Remote Support Automation Process wherein a remote support server receives a support task request and schedules a predefined task to a predefined actor who also has a predefined escalation policy and notifies the support actor of the scheduled task along with a key, a key seed, or a credential to use in authentication. The method enabling privileged access to an Internet security appliance using public/private key pairs through a firewall and network address translation by a support server and an assigned support task actor.

Abstract: A method for operating an apparatus to recall email which has already passed through a spam filter to user mailboxes. An apparatus stores a highly efficient database for a brief period of time after an email is received, filtered, and transmitted to an email server. Message id, recipient, connecting IP address and other spam attributes are stored in a searchable format. After receiving updated spam attributes, a spam filter apparatus under software control queries the database for messages that were not detected as spam before transmittal to the email clients and servers, and sends spam recall messages. Improved email clients and servers adapted by software instructions, move or modify email user mailboxes upon receipt of the spam recall.

Abstract: Domain Name Service (DNS) requests are used as the reporting vehicle for ensuring that security-related information can be transferred from a network. As one possibility, a central facility for a security provider may maintain a data collection capability that is based upon receiving the DNS requests containing the information being reported. In an email application, if a data block is embedded within or attached to an email message, an algorithm is applied to the data block to generate an indicator that is specifically related to the contents of the data block. As one possibility, the algorithm may generate a hash that provides a “digital fingerprint” having a reasonable likelihood that the hash is unique to the data block. By embedding the hash within a DNS request, the request becomes a report that the data block has been accessed.

Abstract: An apparatus which receives client-server transactions such as HTTP REQUESTS and transforms them into a synopsis format for archival storage. HTTP transactions are logged and parsed for key words called HTTP METHODS. For each HTTP METHOD, data is extracted from the message or the resources provided by the transaction. The data is efficiently stored into a transaction store. The data is also indexed and the index is stored into the transaction store. A record is kept for all concurrent sessions by usernames associated with a directory entry.

Abstract: An apparatus, system, and method for measuring the similarity of diverse binary objects, such as files, is disclosed. The method comprises determining a plurality of digital signatures in each of a plurality of dissimilar objects, for each digital signature, accessing a location in a store which has object identifiers for each object which also exhibits at least one instance of the digital signature, writing into the store the object identifiers of all the objects which have the corresponding pattern and the number of times the pattern is found, and making a list of all the objects which share a pattern found in each object. Analyzing the list determines the degree of similarity of a particular object with each of a plurality of diverse binary objects.

Abstract: An apparatus which receives client-server transactions such as HTTP REQUESTS and transforms them into a synopsis format for archival storage. HTTP transactions are logged and parsed for key words called HTTP METHODS. For each HTTP METHOD, data is extracted from the message or the resources provided by the transaction. The data is efficiently stored into a transaction store. The data is also indexed and the index is stored into the transaction store. A record is kept for all concurrent sessions by usernames associated with a directory entry.

Abstract: A system and method for provisioning enhanced security/privacy functions into a user client to detect, warn, and avoid man in the middle attacks and to improve privacy and security of data transmitted across the Internet without certificate authorities.

Abstract: Requesting a service such as querying a database or communicating content by sending a plurality of arguments concatenated to a dns request and receiving a reply in the form of text or an IPv4 or an IPv6 address.

Abstract: Duplicate deliveries of email messages are prevented when a transient failure prevents delivery to some of a plurality of intended recipients but delivery to an other one or more of the intended recipients is successful. After receiving a list of recipients, an email body, and an “end of data” sequence, but prior to responding to the “end of data” sequence, an email server determines a transient failure reply code when any one of the address mailboxes of intended recipients is not available. A message-memorandum, such as the globally unique message-id and the address of one or more successful recipients is stored into a memorandum store. A subsequent transmission of the corresponding message will only be delivered to recipients who have not previously received it.

Abstract: Facilitating email transmission by extracting email parameters, requesting data in the form of a dns query, and receiving a sender reputation as an IP address. Querying a database by sending a plurality of arguments concatenated to a dns request and receiving an IP address in reply. Operating a remote database as a dns server, receiving queries as domains and transmitting replies in the format of IPv4 or IPv6 addresses. Filtering email by querying a database with email parameters comprising an IP address and a domain of an email sender which may be extracted from an email header in the HELO, EHLO, MAIL FROM, or RETURN PATH. The smtp session is continued, modified or interrupted according to the result of the query submitted to a database operating as a dns server.

Abstract: An apparatus, system, and method for measuring the similarity of diverse binary objects, such as files, is disclosed. The method comprises determining a plurality of digital signatures in each of a plurality of dissimilar objects, for each digital signature, accessing a location in a store which has object identifiers for each object which also exhibits at least one instance of the digital signature, writing into the store the object identifiers of all the objects which have the corresponding pattern and the number of times the pattern is found, and making a list of all the objects which share a pattern found in each object. Analyzing the list determines the degree of similarity of a particular object with each of a plurality of diverse binary objects.

Abstract: A method for filtering email which contains links to uniform resource identifiers which disguise the content and identity of spam sites by multiple serial redirection.

Abstract: Facilitating email transmission by extracting email parameters, requesting data in the form of a dns query, and receiving a sender reputation as an IP address. Querying a database by sending a plurality of arguments concatenated to a dns request and receiving an IP address in reply. Filtering email by querying a database with email parameters comprising an IP address and a domain of an email sender which may be extracted from an packet headers in the SMTP sequence up to and including the MAIL command and prior to the DATA command. The smtp session is continued, modified or interrupted according to the result of the query submitted to a database operating as a dns server.

Abstract: The invention provides a method and system for filtering email which may contain links to a large number of rapidly synthesized domains serving spam content by referencing a database of categorized authoritative servers, querying a domain name system server for an authoritative server associated with domain names embedded in email, and accessing the database of categorized authoritative servers for a match.

Abstract: Facilitating email transmission by extracting email parameters, requesting data in the form of a dns query, and receiving a sender reputation as an IP address. Querying a database by sending a plurality of arguments concatenated to a dns request and receiving an IP address in reply. Operating a remote database as a dns server, receiving queries as domains and transmitting replies in the format of IPv4 or IPv6 addresses. Filtering email by querying a database with email parameters comprising an IP address and a domain of an email sender which may be extracted from an email header in the HELO, EHLO, MAIL FROM, or RETURN PATH. The smtp session is continued, modified or interrupted according to the result of the query submitted to a database operating as a dns server.