Abstract: In one embodiment, a method includes determining a user context of at least one user device currently accessing an enterprise communication platform. The method further includes selecting a dynamic data loss prevention (DLP) policy applicable to the at least one user device based, at least in part, on the user context. The dynamic DLP policy specifies one or more communication events of interest. In addition, the method includes monitoring communication events initiated by the at least one user device for the one or more communication events of interest. Moreover, the method includes, responsive to each communication event of interest: assessing the communication event of interest based, at least in part, on a content-based classification of a communication associated with the communication event of interest; and responsive to a risk assessment meeting certain criteria, taking at least one action specified by the dynamic DLP policy.

Abstract: In one embodiment, a method includes operating at least one distributed software application. The method further includes receiving a web request from an end-user information handling system in connection with the at least one distributed software application. Further, the method includes generating a transaction identifier for the transaction. Moreover, the method includes processing the transaction. The processing includes generating backend-performance data indexed by the transaction identifier. Additionally, the method includes injecting the transaction identifier into a web response to the web request. Also, the method includes transmitting the web response to the end-user information handling system along a transmission path. In addition, the method includes, at a node along the transmission path, passively observing the response and generating end-user experience data therefrom.

Abstract: A scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network. Each access filter uses a local copy of an access control data base to determine whether an access request is made by a user. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to access policies which define access in terms of the user groups and information sets. The first access filter in the path performs the access check, encrypts and authenticates the request; the other access filters in the path do not repeat the access check. The interface used by applications to determine whether a user has access to an entity is now an SQL entity. The policy server assembles the information needed for the response to the query from various information sources, including source external to the policy server.

Abstract: Detecting infectious messages comprises performing an individual characteristic analysis of a message to determine whether the message is suspicious, determining whether a similar message has been noted previously in the event that the message is determined to be suspicious, classifying the message according to its individual characteristics and its similarity to the noted message in the event that a similar message has been noted previously.

Abstract: Systems and methods for processing a message are provided. A message may be processed to generate a message summary by removing or replacing certain words, phrases, sentences, punctuation, and the like. Message signatures based upon the message summary may be generated and stored in a signature database, which may be used to identify and/or classify spam messages. Subsequently received messages may be classified by signature and processed based on classification.

Abstract: In one embodiment, a method includes collecting communications from a plurality of sources. The method further includes selecting a set of topics and a set of users. In addition, the method includes, for each user, identifying, from the collected communications, conversations in which the user has participated. Moreover, the method includes, for each topic, for each user: measuring a proportion of the identified conversations that contain content suggestive of the topic; analyzing timing of the identified conversations; and examining relationships among data attributes of the identified conversations. Further, the method includes generating multidimensional expertise data. The multidimensional expertise data is representative of the user's expertise on the topic. The multidimensional expertise data includes a topical dimension, an expertise-scope dimension, and a timeline dimension. The method also includes, for each topic, ranking the set of users by expertise index.

Abstract: Systems and methods for compacting a virtual machine file are presented. In one example, the system accesses a source virtual machine file associated with a guest file system. The system creates a destination virtual machine file based on the guest file system and initializes a block allocation table of the destination virtual machine file. The system accesses a block allocation table of the source virtual machine file and, for each block of the source virtual machine file, determines whether the block is in use. If so, the system copies the block to the destination virtual machine file and updates the block allocation table of the destination virtual machine file. If not, the system does not copy the block or update the block allocation table of the destination virtual machine file, thereby reducing the destination virtual machine file's size compared to the source virtual machine file's size.

Abstract: Improved backup and storage operations are disclosed for virtual computing environments using a backup proxy server to perform storage operations on one or more virtual machine disks. The proxy server can include a module that intercepts application programming interface (API) calls, for writing backup data to a first location, prior to the data arriving on the proxy disk. During the intercept process, the data can be compressed in memory pages of the proxy server and redirected to an alternative backup disk location. The proxy server can also include a differential engine that identifies changes to the virtual machine disk at the block level since the last full backup. The differential engine can advantageously leverage memory pages of the proxy server to compare differences between signatures of blocks of the last full backup with signatures of new blocks. Subsequently, only blocks with non-matching signatures are processed for backup.

Abstract: A system and method are disclosed for registering a email sender for the purpose of sending an email message to an email receiver including receiving a challenge message wherein the challenge message includes a machine answerable question; processing the challenge message to determine that it is a challenge message sent for the purpose of authorizing delivery of the email message; analyzing the question to determine a valid response to the challenge message; and sending the valid response that includes the answer wherein a nontrivial amount of resources are required to send the valid response.

Abstract: Methods and systems are provided for detecting dead tunnels associated with a VPN. An indicator of a tunnel capability, for example, a DPD vendor ID, is received from a peer through a VPN connection. The tunnel capability is associated with one or more phase II tunnels associated with the VPN. Traffic generated by the peer is detected, and if traffic is detected at a tunnel, the tunnel is presumed to be alive. When no traffic is detected in a tunnel, a DPD packet exchange with the tunnel is initiated. A determination is made, based on the packet exchange, whether the tunnel is alive.

Abstract: One or more user service tickets are obtained (i.e. pre-fetched) from an authentication server and stored in a ticket cache. The user service tickets facilitate a login device communicating with one or more users or group members associated with the login device. Login credentials for the users or group members may be subsequently authenticated against the user service tickets within the ticket cache thereby eliminating the need for immediate access to the authentication server or a previous login session by the users or group members. The user service tickets within the ticket cache may be refreshed as needed. In one embodiment, the user service tickets are refreshed daily and also in response to login attempts if the authentication service is readily accessible.

Abstract: In one embodiment, a method includes enrolling a supplicant device as an authentication factor for a user. The enrolling includes storing a public key of an asymmetric key pair generated by an authentication application on the supplicant device. The method also includes receiving, from an access device, a request to access a service using an identity of the user. In addition, the method includes, responsive to the receiving, publishing an authentication code to the access device. The method further includes receiving an authentication package from the authentication application without contacting the authentication application. The authentication package includes a digital signature of the authentication code. The method additionally includes validating the digital signature using the public key. Moreover, the method includes, responsive to a determination that the validating is successful, allowing the access device to access the service.

Abstract: In one embodiment, a method is performed by a computer system. The method includes providing a performance-monitoring platform as a service, the performance-monitoring platform comprising at least one agent manager. The method further includes facilitating creation of a customized performance-monitoring application, the performance-monitoring application comprising an agent and at least one user dashboard. The agent is configured to collect performance data related to a specified monitored resource. The agent parses the collected performance data to a monitoring server for storage according to at least one standard data model. The at least one user dashboard allows users to view information related to the collected performance data. The facilitating includes configuring deployment attributes of the customized performance-monitoring application responsive to developer input. Moreover, the method includes deploying the customized performance-monitoring application on the performance-monitoring platform.

Abstract: Intelligent monitoring systems and methods for virtual environments are disclosed that understand various components of a virtual infrastructure and how the components interact to provide improved performance analysis to users. In certain examples, a monitoring system assesses the performance of virtual machine(s) in the context of the overall performance of the physical server(s) and the environment in which the virtual machine(s) are running. For instance, the monitoring system can track performance metrics over a determined period of time to view changes to the allocation of resources to virtual machines and their location(s) on physical platforms. Moreover, monitoring systems can utilize past performance information from separate virtual environments to project a performance impact resulting from the migration of a virtual machine from one physical platform to another.

Abstract: A scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network. Each access filter uses a local copy of an access control data base to determine whether an access request is made by a user. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to access policies which define access in terms of the user groups and information sets. The first access filter in the path performs the access check, encrypts and authenticates the request; the other access filters in the path do not repeat the access check. The interface used by applications to determine whether a user has access to an entity is now an SQL entity. The policy server assembles the information needed for the response to the query from various information sources, including source external to the policy server.

Abstract: Method and apparatus for multimedia content filtering are described herein. In one embodiment, an example of a network access device, in response to multimedia content transmitted from a source over a first network and destined to a destination over a second network, opens the multimedia content within the network access device interfacing the first and second networks. A content rating operation is performed on the opened multimedia content to determine whether the multimedia content should be transmitted to the destination over the second network. Other methods and apparatuses are also described.

Abstract: Systems and methods for routing communications to a platform service are provided. A message including payload data is received. The information in the payload data of the message is examined in order to determine the type of message. The message is then relayed to an appropriate platform service based on the type of message. Some embodiments assign numbers to the packets that make up the message.

Abstract: Network system provides a real-time adaptive recommendation set of documents with a high statistical measure of relevancy to the requestor device. The recommendation set is optimized based on analyzing text of documents of the interest set, categorizing these documents into clusters, extracting keywords representing the themes or concepts of documents in the clusters, and filtering a population of eligible documents accessible to the system utilizing site and or Internet-wide search engines. The system is either automatically or manually invoked and it develops and presents the recommendation set in real-time. The recommendation set may be presented as a greeting, notification, alert, HTML fragment, fax, voicemail, or automatic classification or routing of customer e-mail, personal e-mail, job postings, and offers for sale or exchange.

Abstract: In one embodiment, a method includes receiving an identity of a metric of interest and a future time point. The method further includes retrieving a prediction configuration previously associated with the metric of interest. The prediction configuration comprising a period combination. The period combination comprises a plurality of time periods, each time period comprises one or more segments, and each segment of the one or more segments comprises adapted historical values of the metric of interest incrementally inserted therein. The method also includes, for each time period of the plurality of time periods, identifying, for the future time point, a corresponding segment of the one or more segments, accessing a set of adapted historical values from the corresponding segment, and computing an intermediate predicted value from the set of adapted historical values. Moreover, the method includes calculating a predicted value for the metric of interest based on the computing.

Abstract: The present invention relates to a method and system for performing deep packet inspection of messages transmitted through a network switch in a Software Defined Network (SDN). Embodiments of the invention include a network switch, a controller, and a firewall in a software defined networking environment. In the present invention, the network switch is a simple network switch that is physically separate from the controller and the firewall. The invention may include a plurality of physically distinct network switches communicating with one or more controllers and firewalls. In certain instances, communications between the network switch, the controller, and the firewall are performed using the Open Flow standard communication protocol.