Abstract: A modified Boyer-Moore searching algorithm used within an E-mail filtering system for detecting the presence of a plurality of target band strings during a single traversal of the character data to be searched. A single jump table for the combined set of strings for which a search is being made is used. A hierarchical match table starting with the possible terminating letters of strings for which a search is being made is traversed to identify any strings as they are encountered.

Abstract: An analyzer for a wireless network is configured for surfing a plurality of channels, each for an individually selectable period of time, for monitoring each channel to obtain packet information for analysis, to detect any defects in communication over each respective channel.

Abstract: A system, method and computer program product are provided for detecting an unwanted message. First, an electronic mail message is received. Text in the electronic mail message is decomposed. Statistics associated with the text are gathered using a statistical analyzer. A neural network engine coupled to the statistical analyzer is taught to recognize unwanted messages based on statistical indicators. The statistical indicators are analyzed utilizing the neural network engine for determining whether the electronic mail message is an unwanted message.

Abstract: A computer program for checking user configurable security settings operates as either an on-demand application or a memory resident application. The security checking program may enforce the recommended settings or may generate a report to the user as to where the recommended settings are not in place.

Abstract: A system and method update client computers of various end users with software updates for software products installed on the client computers, the software products manufacturered by diverse, unrelated software vendors. The system includes a service provider computer system, a number of client computers and software vendor computer systems communicating on a common network. The service provider computer system stores in an update database information about the software updates of the diverse software vendors, identifying the software products for which software updates are available, their location on the network at the various software vendor computer systems, information for identifying in the client computers the software products stored thereon, and information for determining for such products, which have software updates available. Users of the client computers connect to the service provider computer and obtain a current version of portions of the database.

Abstract: Anti-virus state information for a file is stored within an associated data structure that is created and/or maintained by the file system of the computer. The data structure can be a file directory entry with the anti-virus state information being stored in unused fields of the entry. For file systems that maintain separate entities for the data and resource information of a file, the anti-virus state information can be stored in the resource entity or in a specifically created entity.

Abstract: A system, method and computer program product are provided for analyzing a network. Initially, network traffic information relating to network traffic is collected. Next, the network traffic information is encrypted. In use, the network traffic information is capable of being analyzed by a network analyzer adapted for decrypting the network traffic information.

Abstract: Received e-mail messages are subject to a minimum delay period determined in dependence upon characteristics of the e-mail message received. Prior to release of the e-mail message upon expiry of the minimum delay period a check is made that the most up-to-date anti-virus and anti-spamming tests have been applied to the e-mail message. Characteristics that may be used to determine the minimum delay period applied include sender characteristics, recipient characteristics, attachment type characteristics and message content type characteristics.

Abstract: A system, method and computer program product are provided for managing the use of a plurality of security service providers during network communication. A first security service provider is utilized for affording secure communication between applications using a network. During operation, the system is monitored for events relating to the secure communication between the applications. Upon the detection of an event, a second security service provider is utilized for affording secure communication between the applications using the network.

Abstract: A system, method and computer program product are provided for filtering communications over a network. Initially, a user is allowed to select from a plurality of network communication protocol layers associated with communications over a network. This may be accomplished in any manner such as allowing the user to select from the layers themselves, various faults that are inherent to certain layers, etc. An adaptive filter is then generated which is capable of collecting communications only involving the selected network communication protocol layers based on the user selection. Such adaptive filter is then used to collect the communications involving the selected network communication protocol layers. Further, an analysis process is executed for analyzing information at the selected network communication protocol layers of the collected communications for the detection of faults therein.

Abstract: A system, method and computer program product are provided for ascertaining the location of an access point in a wireless network. Initially, a strength of a radio frequency signal of an access point of a wireless network is monitored at a position utilizing a wireless network analyzer. Next, the wireless network analyzer is moved about the position. The foregoing operations may be repeated to allow the location of the access point to be ascertained based on the monitored strength of the radio frequency signal.

Abstract: A system and associated method and computer program product are provided for analyzing a network. Included is a plurality of agents coupled to a plurality of computers interconnected via a network. Each agent is adapted to collect information relating to at least one of the computers. Further provided is a plurality of host controllers coupled to the agents for collecting the information from the agents. Still yet, a plurality of zone controllers is coupled to the host controllers for collecting the information from the host controllers.

Abstract: A method, system and computer program product for detecting when insufficient RAM is available in a computer system, and estimating the additional RAM needed to avoid excess paging. The invention uses memory management parameters to estimate the number of frequently-used pages stored in “virtual memory” on disk. If this estimate is nonzero for an appreciable period the amount of RAM is insufficient, and RAM equal to the estimate should be added to the system.

Abstract: One embodiment of the present invention provides a system that facilitates accessing a network management protocol table. The system operates by first collecting a network management protocol tuple that includes data related to a network connection. Next, the system creates a hash index from the network management protocol tuple. This network management protocol tuple is inserted into the network management protocol table. The system then saves a pointer to the row indexed by the hash index in a hash table. The system also forms a search index using data within the network management protocol tuple that identifies the data pointed to by the hash index in the hash table. This search index is inserted into a search tree, so that the hash index provides fast insertion into the network management protocol table and the search index in the search table provides fast ordered retrieval from the network management protocol table.

Abstract: A system and a method for performing partitioned scanning of a dataset for malware in a distributed computing environment is disclosed. A dataset is maintained in a plurality of structured databases in the distributed computing environment. Each database stores a plurality of data item groups which each include a plurality of individual data items. Each such data item is uniquely identified within the dataset by a data item identifier. A set of indices is stored in a centralized database. The set of indices includes a list of scanned data item identifiers for each data item within the dataset scanned for malware and a list of last entry numbers for each data item group stored in each database. Each last entry number corresponds to one such data item within the data item group last scanned for malware. A plurality of malware scanners are executed in substantial concurrency.

Abstract: The present invention is a method of allocating clusters of a disk or other computer readable medium containing a plurality of clusters to minimize fragmentation. To accomplish this, at least one available block is identified in the computer readable medium. Each block includes one or more contiguous available clusters, where each cluster comprises one or more units of storage space. A request is received to allocate one or more clusters to a file. At least one of the available blocks is selected based on a location of the available block. At least some of the clusters are allocated, and the file is written to the allocated clusters.

Abstract: A system and method for providing a multi-tiered hierarchical transient message store accessed using multiply hashed unique filenames is described. A hierarchical message store is maintained. The hierarchical message store is logically structured with a plurality of storage nodes. Each storage node is dependently linked to one of a plurality of index nodes. Each index node is dependently linked to a root node. An incoming message is intercepted at a network domain boundary and assigning a unique filename. An index hash of the unique filename, corresponding to one such index node, and a storage hash of the unique filename, corresponding to one such storage node, are generated. The message is stored in the hierarchical message store at the one such index node and the one such storage node.

Abstract: A system, method and computer program product are provided for assessing threats to a network utilizing a plurality of data sources. Initially, network data is collected from a plurality of different network data sources. Such data is then aggregated and correlated, after which it is stored. Threats to a network are then assessed utilizing the aggregated and correlated network data.

Abstract: A real-time sequence-based anomaly detection system is disclosed. In a preferred embodiment, the intrusion detection system is incorporated as part of a software wrapper. Event abstraction in the software wrapper enables the intrusion detection system to apply generically across various computing platforms. Real-time anomaly detection is enabled through the definition of a distance matrix that defines allowable separation distances between pairs of system calls. The distance matrix indirectly specifies known sequences of system calls and can be used to determine whether a sequence of system calls in an event window represents an anomaly. Anomalies that are detected are further analyzed through levenshtein distance calculations that also rely on the contents of the distance matrix.

Abstract: A unique session key is created for each execution of anti-virus software and is used to create a session stamp for each file scanned during that execution. The session stamp is stored in the directory entry for the file. When a request for the file is made, the anti-virus software uses the current session key to validate the session stamp. An invalid or absent session stamp indicates that the file needs to be scanned.