Abstract: An exemplary method for translating non-comparable values into comparable values for use in heuristics may include: 1) identifying a data object, 2) identifying a non-comparable value associated with the data object, 3) translating the non-comparable value into a comparable value, and then 4) processing the comparable value in a heuristic. In some examples, the heuristic may include a malware-detection heuristic, such as a decision tree.

Abstract: User-generated web content is received prior to posting by a client system, such as a web content hosting system. The user-generated web content is executed in a virtual environment and monitored for malicious behavior. Execution of the web content in the virtual environment forces code in the web content to run such that the actions the code takes, especially malicious behavior, are not obfuscated. If malicious behavior is detected, the user-generated web content is blocked from posting to the web content hosting system. Alternatively, when malicious behavior is not detected, the user-generated web content is permitted to be posted to the web content hosting system.

Abstract: Method and apparatus for monitoring instant messaging with visual identification are described. In some examples, monitoring of instant message (IM) traffic at a node on a network is performed. Video content in the IM traffic is detected at the node. A facial recognition analysis is performed on the video content to extract at least one image having human facial features. At least one user identity is extracted from the IM traffic. The at least one image and the at least one user identity are stored in a log implemented in a memory on the network.

Abstract: A method and apparatus for automatically classifying an unknown web site to improve internet browsing control is described. In one embodiment, a method for classifying an unknown web site to control internet browsing comprising processing web site control data associated with at least one user that requested access to an unknown web site, wherein the web site control data comprises a web browsing behavior history and applying at least one metric to the web browsing behavior history to classify the unknown website.

Abstract: A method for managing rights associated with data is described. A request to access encrypted data is intercepted. Credentials associated with the request are verified. The data is decrypted if the credentials are verified. The decrypted data is marked with an identifier. Predetermined operations directed to the decrypted data are monitored.