Abstract: Representative of the various embodiments is a method for implementation during a computer's boot sequence to load a selected operating system (OS) of interest. For purposes of such a method the computer includes a system BIOS, a video BIOS, and a customary boot loader accessible from a pre-determined address pointed to by a system interrupt pointer. During system BIOS execution, the system interrupt pointer is redirected to an alternate address from which a replacement boot loader is accessible. The selected OS of interest is then loaded via the replacement boot loader rather than the customary boot loader.

Abstract: Methods are provided for categorizing input data into a selected data type category. Exemplary embodiments are directed to the categorization of binary input data, for example random input data, as either compressed or encrypted based on statistical analysis. To this end, at least a portion of the input data is analyzed to derive a statistical test result for the portion that is indicative of a degree of randomness of the data. The data is then categorized as either compressed or encrypted based on the statistical test result.

Abstract: An approach is described for the compression of input data, and particularly one which is suited for providing a lossless method for compressing random input data. Both a compression algorithm is described, as well as a decompression algorithm for restoring the original uncompressed data. The decompression algorithm allows for its parameters to be adjusted to suit one's needs as they relate, for example, to the ratio of compression as a function of the decompression speed.

Abstract: A method, computer readable medium and system for determining whether a data stream is in cyphertext format statistically analyzes the data stream to compute a resultant value indicative of a level of uniformity for a frequency distribution of the data stream's byte values. When applied to one or more files an average byte value may be computed for the data stream and a chi-square statistical analysis of the data bytes performed, with the resultant value computed based on the chi-square value. The resultant is then compared to a pre-determined threshold value to determine whether the file has been encrypted. The computer-readable medium has executable instructions for reading the data stream portions of files to compute a resultant value for each file and control an output device to display appropriate output. The encryption detection system comprises a storage device, an output device and a processor programmed in accordance with the foregoing.

Abstract: Representative is a computer-implemented method of detecting a buffer overflow condition. In accordance with the method, a destination address for a computer process' desired right operation is received and a determination is made as to whether the destination address is within an illegitimate writable memory segment within the process' virtual address space (VAS). If so, the process is preferably alerted of the potential buffer overflow condition. A determination may also be made as to whether the destination address is legitimate, in which case the process may be informed of the memory segment which corresponds to the destination address.

Abstract: An approach is described for the compression of input data, and particularly one which is suited for providing a lossless method for compressing random input data. Both a compression algorithm is described, as well as a decompression algorithm for restoring the original uncompressed data. The decompression algorithm allows for its parameters to be adjusted to suit one's needs as they relate, for example, to the ratio of compression as a function of the decompression speed.

Abstract: Methods are provided for categorizing input data into a selected data type category. Exemplary embodiments are directed to the categorization of binary input data, for example random input data, as either compressed or encrypted based on statistical analysis. To this end, at least a portion of the input data is analyzed to derive a statistical test result for the portion that is indicative of a degree of randomness of the data. The data is then categorized as either compressed or encrypted based on the statistical test result.

Abstract: Systems and methods are provided for resolving Internet Protocol (IP) address conflicts using agents in the zero configuration network. Agent's originate at respective nodes on the zero configuration network. Each agent and each node logs a localized shared memory table (SMT) providing identifying information pertaining to other nodes on the network. When a sending node transmits an SMT to one or more target nodes on the network, it is analyzed by the target node to ascertain whether a localized IP address conflict exists involving the target node and a remote node. If it is deemed appropriate to resolve the conflict, the target node resolves the conflict by selecting a new IP address for itself.

Abstract: The present invention relates to methods and a system for enhancing DHCP to promote a more secure IP address allocation model. The invention advantageously accomplishes this through the utilization of an address generator which is compatible with the existing DHCP protocol, and which incorporates an algorithm for use in producing a selected IP address as one of a sub-set of allocable addresses that are non-sequentially distributed within an address pool. As such, the invention offers robust security and allows for the rapid detection of unauthorized activity such as network intrusion, worms, virus propagation, network scanners, and SPAM.

Abstract: Methods are provided relating to the exchange of a cipher key between devices on a network segment to enable encrypted transmissions between the devices. In preferred embodiments the cipher key is a random key which is commonly used by the devices for synchronous encryption/decryption of data.

Abstract: Provided are systems, devices and methods pertaining to the relaying of communications between a launch computer and a target computer in a manner which obscures at least the launch computer as a participant in the communications. Outbound traffic from the launch follows an outbound relay route which includes at least one intermediary relay computer, while reply traffic from the target computer follows a return relay route also including at least one intermediary relay computer. The outbound and return routes may be either the same or different, and one or more of the intermediary computer(s) may be kept unwitting of their role in the communications.

Abstract: The present invention relates to the manipulation or monitoring of one communications device from another via a network. More particularly, the invention relates to remote control or administration of a target computer from a launch computer via predetermined relay routes therebetween. To this end, systems, devices and methodologies are provided.

Abstract: Methods and systems are provided for remotely administering a target network communications device (NCD) from a launch NCD. System level access to the target NCD is obtained and sets of launch and target tools are respectively installed on the launch and target NCDs. A trigger command corresponding to a data request is transmitted from the launch NCD to the target NCD. Reply data responsive to the request is retrieved at the target NCD and transmitted to the launch NCD. Provided also is a system wherein the first NCD includes a front end trigger component for generating selected trigger commands, and the second NCD includes a response component for the replies. A data transmission component is interfaced between the first and second NCDs.

Abstract: Methods, test systems and computer-readable media are provided each relating to the collection of runtime data during code execution. This is accomplished without the need to reload the executable from its stored media image. The executable is instead altered while in memory, allowing program flow to be dynamically diverted without having to recompile the program, effect its binary, halt its execution, restart the program or otherwise change its fundamental behavior.

Abstract: A computerized instant messaging (IM) methodology allows secure data transmission between sending and recipient client computer systems each residing on a common network infrastructure. Each computer system has an installed client application program, and the network infrastructure includes a network server having an associated server application program installed thereon. A computer-readable medium is also provided for use as a component of a client computer system that has a graphical user interface including a monitor and at least one data input device, with the client computer system being one of a plurality of computer systems each residing as a respective node on a network infrastructure that includes a network server for interfacing with the client computer systems to enable an exchange of messages therebetween as part of a client/server IM application. A client computer system for use as a component in a client/server messaging application is also provided.