Abstract: A method and system for passive quality of service monitoring of a network are described. In one embodiment, a number of signatures are extracted from a number of network packets at a number of monitoring points. In addition, at least one quality of service parameter is generated based upon the signatures.

Abstract: A method of providing a set of desired application functions to a plurality of network-coupled computing appliances. A set of code resident on a network-connected application management server is identified that when executed in a network appliance provide the desired application functions. A first application management agent in a first of the network-coupled computing appliances and a second application management agent in a second of the network-coupled computing appliances are executed. The first application management agent repetitively checks for updates of the identified code. Updates of the identified code are downloaded from the application management server into the first network-coupled computing appliance as the updates become available. Updates of the identified code are downloaded from the first network-coupled computing device into the second network-coupled computing appliance.

Abstract: A system and method for transacting a validated application session in a networked computing environment is described. A hierarchical protocol stack having a plurality of interfaced protocol layers is defined. A connection-based session protocol layer is included. A session is opened with a requesting client responsive to a request packet containing a source address of uncertain trustworthiness. A client connection with the requesting client is negotiated. A stateless validation of the source address contained in the request packet is performed using encoded information obtained from the request packet headers. A server connection is negotiated with a responding server upon successful validation of the requesting client. The session is facilitated by translating packets independently exchanged over the client connection and the server connection. The session is closed through a controlled termination of each of the client connection and the server connection.

Abstract: One embodiment of the present invention provides a system for determining whether software is likely to exhibit malicious behavior by analyzing patterns of system calls made during emulation of the software. The system operates by emulating the software within an insulated environment in a computer system so that the computer system is insulated from malicious actions of the software. During the emulation process, the system records a pattern of system calls directed to an operating system of the computer system. The system compares the pattern of system calls against a database containing suspect patterns of system calls. Based upon this comparison, the system determines whether the software is likely to exhibit malicious behavior. In one embodiment of the present invention, if the software is determined to be likely to exhibit malicious behavior, the system reports this fact to a user of the computer system.

Abstract: A system and method for preventing a spoofed remote procedure call denial of service attack in a networked computing environment is described. A hierarchical protocol stack defines a plurality of communicatively interfaced protocol layers. At least one protocol layer provides a client service via a remote procedure call interface. A request packet sent from a requesting client is intercepted. The request packet contains a service request being sent to a remote server via a remote procedure call. A token uniquely identifying the request packet is generated using data contained therein. The token is included with the request packet. The request packet and the included token is forwarded to the remote server indicated in the remote procedure call. A response packet containing a response sent from a remote server via the remote procedure call interface for the provided client service is received.

Abstract: A system and a method for preventing a spoofed denial of service attack in a networked computing environment is described. A hierarchical protocol stack is defined. The hierarchical protocol stack includes a plurality of communicatively interfaced protocol layers with at least one session-oriented protocol layer. A packet requesting a session with the session-oriented protocol layer is received from the networked computing environment. The request packet includes headers containing a source address of uncertain trustworthiness. The request packet is acknowledged by performing the following operations. First, a checksum is calculated from information included in the request packet headers. A request acknowledgement packet is generated. The request acknowledgement packet includes headers containing the checksum as a pseudo sequence number and the source address in the request packet headers as a destination address. Finally, the request acknowledgement packet is sent into the networked computing environment.

Abstract: A method, system, and computer program product for malware scanning of data that is being transferred or downloaded to a computer system that is performed at the protocol level, and is capable of blocking the spread of malwares that may not be blocked by operating system level scanning. A method of detecting a malware comprises the steps of: a) receiving a data stream, b) scanning the data stream at a protocol level to detect a malware, c) removing the detected malware from the data stream, and d) transmitting the data stream without the malware.

Abstract: A system, method and computer program product are provided for detecting an unwanted message. First, an electronic mail message is received. Text in the electronic mail message is decomposed. Statistics associated with the text are gathered using a statistical analyzer. A neural network engine coupled to the statistical analyzer is taught to recognize unwanted messages based on statistical indicators. The statistical indicators are analyzed utilizing the neural network engine for determining whether the electronic mail message is an unwanted message.

Abstract: An analyzer for a wireless network is configured for surfing a plurality of channels, each for an individually selectable period of time, for monitoring each channel to obtain packet information for analysis, to detect any defects in communication over each respective channel.

Abstract: A modified Boyer-Moore searching algorithm used within an E-mail filtering system for detecting the presence of a plurality of target band strings during a single traversal of the character data to be searched. A single jump table for the combined set of strings for which a search is being made is used. A hierarchical match table starting with the possible terminating letters of strings for which a search is being made is traversed to identify any strings as they are encountered.

Abstract: A computer program for checking user configurable security settings operates as either an on-demand application or a memory resident application. The security checking program may enforce the recommended settings or may generate a report to the user as to where the recommended settings are not in place.

Abstract: A system and method update client computers of various end users with software updates for software products installed on the client computers, the software products manufacturered by diverse, unrelated software vendors. The system includes a service provider computer system, a number of client computers and software vendor computer systems communicating on a common network. The service provider computer system stores in an update database information about the software updates of the diverse software vendors, identifying the software products for which software updates are available, their location on the network at the various software vendor computer systems, information for identifying in the client computers the software products stored thereon, and information for determining for such products, which have software updates available. Users of the client computers connect to the service provider computer and obtain a current version of portions of the database.

Abstract: Anti-virus state information for a file is stored within an associated data structure that is created and/or maintained by the file system of the computer. The data structure can be a file directory entry with the anti-virus state information being stored in unused fields of the entry. For file systems that maintain separate entities for the data and resource information of a file, the anti-virus state information can be stored in the resource entity or in a specifically created entity.

Abstract: A system, method and computer program product are provided for analyzing a network. Initially, network traffic information relating to network traffic is collected. Next, the network traffic information is encrypted. In use, the network traffic information is capable of being analyzed by a network analyzer adapted for decrypting the network traffic information.

Abstract: A system, method and computer program product are provided for filtering communications over a network. Initially, a user is allowed to select from a plurality of network communication protocol layers associated with communications over a network. This may be accomplished in any manner such as allowing the user to select from the layers themselves, various faults that are inherent to certain layers, etc. An adaptive filter is then generated which is capable of collecting communications only involving the selected network communication protocol layers based on the user selection. Such adaptive filter is then used to collect the communications involving the selected network communication protocol layers. Further, an analysis process is executed for analyzing information at the selected network communication protocol layers of the collected communications for the detection of faults therein.

Abstract: Received e-mail messages are subject to a minimum delay period determined in dependence upon characteristics of the e-mail message received. Prior to release of the e-mail message upon expiry of the minimum delay period a check is made that the most up-to-date anti-virus and anti-spamming tests have been applied to the e-mail message. Characteristics that may be used to determine the minimum delay period applied include sender characteristics, recipient characteristics, attachment type characteristics and message content type characteristics.

Abstract: A system, method and computer program product are provided for managing the use of a plurality of security service providers during network communication. A first security service provider is utilized for affording secure communication between applications using a network. During operation, the system is monitored for events relating to the secure communication between the applications. Upon the detection of an event, a second security service provider is utilized for affording secure communication between the applications using the network.

Abstract: A system and associated method and computer program product are provided for analyzing a network. Included is a plurality of agents coupled to a plurality of computers interconnected via a network. Each agent is adapted to collect information relating to at least one of the computers. Further provided is a plurality of host controllers coupled to the agents for collecting the information from the agents. Still yet, a plurality of zone controllers is coupled to the host controllers for collecting the information from the host controllers.

Abstract: A system, method and computer program product are provided for ascertaining the location of an access point in a wireless network. Initially, a strength of a radio frequency signal of an access point of a wireless network is monitored at a position utilizing a wireless network analyzer. Next, the wireless network analyzer is moved about the position. The foregoing operations may be repeated to allow the location of the access point to be ascertained based on the monitored strength of the radio frequency signal.

Abstract: A method, system and computer program product for detecting when insufficient RAM is available in a computer system, and estimating the additional RAM needed to avoid excess paging. The invention uses memory management parameters to estimate the number of frequently-used pages stored in “virtual memory” on disk. If this estimate is nonzero for an appreciable period the amount of RAM is insufficient, and RAM equal to the estimate should be added to the system.