Abstract: Systems and methods for managing forwarded infectious messages are provided. Managing electronic message comprises receiving a message, forwarding the message, determining that the forwarded message is infectious after the message has been forwarded and preventing the infectious forwarded message from spreading.

Abstract: Systems and methods for identifying content in electronic messages are provided. An electronic message may include certain content. The content is detected and analyzed to identify any metadata. The metadata may include a numerical signature characterizing the content. A thumbprint is generated based on the numerical signature. The thumbprint may then be compared to thumbprints of previously received messages. The comparison allows for classification of the electronic message as spam or not spam.

Abstract: Embodiments of systems and methods are described for performing community analysis of computing performance. These systems and methods can collect and analyze community performance data from a plurality of physical or virtual infrastructure installations. The systems and methods can leverage this community performance data to identify and recommend areas where individual physical or virtual infrastructures can improve performance.

Abstract: A system and method are disclosed for routing a message through a plurality of test methods. The method includes: receiving a message; applying a first test method to the message; updating a state of the message based on the first test method; and determining a second test method to be applied to the message based on the state.

Abstract: Information concerning a plurality of identified threats provided by a plurality of preselected sources is stored in memory. An e-mail message may be received over a communication network. The received e-mail message is separated into a plurality of components. The stored information is searched to identify a reputation score associated with each of the plurality of components. It is then determined whether the e-mail is a threat based on the identified reputation score of each of the plurality of components. The determination is sent to a designated recipient.

Abstract: A self-service system is provided that can automatically identify one or more existing groups to which a user can self-select to access a resource. The self-service system can identify any suitable existing group without requiring an administrator to predefine groups according to roles. In some implementations, the system intelligently identifies one or more suitable groups for a user from a list of available groups by analyzing a set of rules or criteria. For instance, the system can perform a weighted analysis of various rules and/or criteria to automatically and dynamically identify groups that have a closest fit to the access rights needed or requested by the user. Further, the system can evaluate certain best or preferred grouping practices to identify suitable groups. As a result, in certain embodiments, the self-service system alleviates planning burdens on administrators and provides greater flexibility in providing users with access to resources.

Abstract: A local gateway device receives email across the internet from a sender of the email and forwards it across the internet to an email filtering system. The email filtering system analyzes the email to determine whether it is spam, phishing or contains a virus and sends it back to the local gateway device along with the filtered determination. The local gateway device forwards the received email and the filtered determination to a local junk store which handles the email appropriately. For example, if the email has been determined to be spam, phishing or containing a virus, the junk store can quarantine the email and if the email has been determined to be non-spun and/or not phishing and/or not containing a virus, the junk store can forward the email to a local mail server for delivery.

Abstract: Some embodiments of cloud-based gateway security scanning have been presented. In one embodiment, some data packets are received sequentially at a gateway device. The data packets constitute at least a part of a file being addressed to a client machine coupled to the gateway device. The gateway device forwards an identification of the file to a remote datacenter in parallel with forwarding the data packets to the client machine. The datacenter performs signature matching on the identification and returns a result of the signature matching to the gateway device. The gateway device determining whether to block the file from the client machine based on the result of the signature matching from the datacenter.

Abstract: A system for detecting creation of a program instance includes an interceptor routine that obtains a parameter corresponding to a characteristic of a program instance and an interceptor module that can be injected into a native operating system process. In certain examples, the interceptor module can replace an address of a selected routine in an address table with an address to the interceptor routine, such that the native operating system process can call the interceptor routine in place of the selected routine. Additionally, the system can include a comparison module that compares the parameter to a set of identified programs to determine whether the program instance corresponds to at least one of the identified programs. The system can also include a security module that can modify execution of the program instance based at least in part on a determination that the program instance corresponds to at least one identified program.

Abstract: In one embodiment, a method is performed on a multitenant shared-resources system for each managed domain of a plurality of managed domains. The method includes collecting configuration data for the managed domain via a configuration interface provided to an authorized user. The method further includes identifying domain-information sources for the managed domain based, at least in part, on the configuration data. The domain-information sources include a catalog server and an authentication server. In addition, the method includes acquiring domain information for the managed domain from at least one domain-information source of the domain-information sources. Further, the method includes enumerating users for the managed domain. The method also includes assigning at least a portion of the users to shared resources maintained by the multitenant shared-resources system. At least a portion of the plurality of domains have independent security boundaries.

Abstract: A system and method are disclosed for classifying a message. The method includes receiving the message, identifying in the message a distinguishing property; generating a signature using the distinguishing property; and comparing the signature to a database of signatures generated by previously classified messages.

Abstract: In one embodiment, a method includes defining a slice of a dimensional database. The slice includes at least one dimension and at least one measurement and is expressable as a table. The method further includes building, in a structured query language (SQL) dialect, a single query that queries the slice and one or more non-dimensional databases. The SQL dialect represents the at least one dimension, the at least one measurement, and data attributes of the one or more non-dimensional databases. In addition, the method includes parsing the single query. The parsing includes generating a dimensional query for the dimensional database and a non-dimensional query for each of the one or more non-dimensional databases. Furthermore, the method includes executing the dimensional query on the dimensional database. Moreover, the method includes, for each non-dimensional database of the one or more non-dimensional databases, executing the non-dimensional query on the non-dimensional database.

Abstract: Systems and methods for extending the capability of a directory processor by, for example, registering a control are presented. This control can be a non-native control, or a modification to a native control. Further, this disclosure describes example of systems and methods for performing a directory operation, which may include one or more controls. At least some of the one or more controls may be non-native or dynamic controls. In some cases, some of the controls may be native controls.

Abstract: In one embodiment, a method includes receiving a scrambled message over a network connection. The method further includes detecting one or more embedded responses in the scrambled message. In addition, the method includes discovering any streamed embedded responses of the one or more embedded responses. Further, the method includes, responsive to the discovering of any streamed embedded responses, determining whether all of the one or more embedded responses validate. Moreover, the method includes, responsive to a determination that fewer than all of the one or more embedded responses validate, discovering any interleaved embedded responses of the one or more embedded responses. The method also includes, responsive to the discovering of any interleaved embedded responses, determining whether all of the one or more embedded responses validate. Additionally, the method includes, responsive to a determination that all of the one or more embedded responses validate, retaining the one or more responses.

Abstract: A scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network. Each access filter uses a local copy of an access control data base to determine whether an access request is made by a user. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to access policies which define access in terms of the user groups and information sets. The first access filter in the path performs the access check, encrypts and authenticates the request; the other access filters in the path do not repeat the access check. The interface used by applications to determine whether a user has access to an entity is now an SQL entity. The policy server assembles the information needed for the response to the query from various information sources, including source external to the policy server.

Abstract: Network system provides a real-time adaptive recommendation set of documents with a high statistical measure of relevancy to the requestor device. The recommendation set is optimized based on analyzing text of documents of the interest set, categorizing these documents into clusters, extracting keywords representing the themes or concepts of documents in the clusters, and filtering a population of eligible documents accessible to the system utilizing site and or Internet-wide search engines. The system is either automatically or manually invoked and it develops and presents the recommendation set in real-time. The recommendation set may be presented as a greeting, notification, alert, HTML fragment, fax, voicemail, or automatic classification or routing of customer e-mail, personal e-mail, job postings, and offers for sale or exchange.

Abstract: Detecting infectious messages comprises performing an individual characteristic analysis of a message to determine whether the message is suspicious, determining whether a similar message has been noted previously in the event that the message is determined to be suspicious, classifying the message according to its individual characteristics and its similarity to the noted message in the event that a similar message has been noted previously.

Abstract: Systems and methods for automating or at least partially automating the creation of connectors for a provisioning system are described. A provisioning system can include a connector creation module that analyzes an application programming interface (API) of a target system. Based on this analysis, the provisioning system can automatically create a connector module that can communicate with the target system. The connector creator may also provide a user interface that enables users to customize the functionality of the connector module. For example, a user can specify which routines of the target system API will be called by the connector module, which user identity parameters of the target system will be updated, and so forth. The connector creation module can automatically generate code for the connector module that implements the user-specified functionality. The finished connector module can be executed to provision the target system.

Abstract: An apparatus, system, and method are disclosed for managing policies on a computer having a foreign operating system. Policies may specify hardware or software configuration information. Policies on a first computer with a native operating system are translated into configuration information usable on a second computer having a foreign operating system. In an embodiment, a translator manager manages the association between the policy on the first computer and the translator on the second computer. Computer management complexity and information technology management costs are reduced by centralizing computer management on the native operating system. Further reductions in management complexity are realized when the present invention is used in conjunction with network directory services.

Abstract: Systems and methods for extending the capability of a directory processor by, for example, registering a control are presented. This control can be a non-native control, or a modification to a native control. Further, this disclosure describes example of systems and methods for performing a directory operation, which may include one or more controls. At least some of the one or more controls may be non-native or dynamic controls. In some cases, some of the controls may be native controls.