Abstract: A correlation manager correlates network traffic with corresponding file input/output activity. In some embodiments, a correlation manager filters both remote network traffic received by a kernel level fileserver and file input/output operations executed by the kernel level fileserver. The correlation manager correlates a thread requesting performance of a file input/output operation with a worker thread that performs the requested file input/output operation, and is thus able to correlate the remote request to perform the file input/output operation with the resulting performed file input/output operation itself. In some embodiments, the correlation manager correlates a transport driver interface thread requesting a file input/output operation with its corresponding system worker thread that implements the requested file input/output operation.

Abstract: A public version of content includes information to access a private version. The private version is typically of higher value, as it is a complete version and/or of higher audio or video quality than the public version. The public version can be shared or played without restriction, which enables the content to be promoted, yet provides an incentive for the user to access the private version. The public version can include information that enables a user to obtain software necessary to get the private version. In addition, the public version can include a digital watermark used to access the private version.

Abstract: A method, system, and computer program product for detecting a kernel-mode rootkit that hooks the System Service Dispatch Table (SSDT) is secure, avoids false positives, and does not disable security applications. A method for detecting a rootkit comprises the steps of calling a function that accesses a system service directly, receiving results from calling the function that accesses the system service directly, calling a function that accesses the system service indirectly, receiving results from calling the function that accesses the system service indirectly, and comparing the received results from calling the function that accesses the system service directly and the received results from calling the function that accesses the system service indirectly to determine presence of a rootkit.

Abstract: A method, system, and computer program product for detecting hidden files and folders that may be installed by or as part of a rootkit provides the capability to identify the method that is used to hide the files and folders, will continue working even if the operating system is modified, and is suitable for real-time detection of hidden files and folders. A method for detecting a rootkit comprises the steps of generating a plurality of query input/output request packets, each query input/output request packet requesting information relating to a file system directory folder, transmitting a generated query input/output request packet to each file system driver object, receiving a result including the requested information relating to a file system directory folder from each file system driver object, and determining differences among each result, to determine information relating to a file system directory folder that is removed by at least one file system driver object.

Abstract: One or more mobility token managers (101) track movement of files (105) within a network. A mobility token manager (101) on a source computer (113) detects an attempt to write a file (105) to a target computer (117). Responsive to the detection, the mobility token manager (101) writes a mobility token (103) containing data concerning at least the file (105) and the write operation to the target computer (117). A mobility token manager (101) on the target computer (117) detects that the mobility token (103) is being written to the target computer (117). The mobility token manager (101) on the target computer (117) reads the mobility token (103), and determines relevant information concerning the file (105) associated with the mobility token (103).

Abstract: One or more mobility token managers (101) track movement of files (105) within a network. A mobility token manager (101) on a source computer (113) detects an attempt to write a file (105) to a target computer (117). Responsive to the detection, the mobility token manager (101) writes a mobility token (103) containing data concerning at least the file (105) and the write operation to the target computer (117). A mobility token manager (101) on the target computer (117) detects that the mobility token (103) is being written to the target computer (117). The mobility token manager (101) on the target computer (117) reads the mobility token (103), and determines relevant information concerning the file (105) associated with the mobility token (103).

Abstract: A source process duplicates handles owned by a target process, without the source process having debug privileges. A handle duplication manager running in kernel space receives requests from source processes for duplicates of handles owned by remote target processes. In response to a request, the handle duplication manager accesses address space of a target process, and calls a system object duplication function with a request to duplicate the requested handle(s) of the target process. The handle duplication manager running in kernel space calls the system function so as to simulate the origin of the call as being the target process running in user space. The duplication manager receives the requested duplicate handle(s) from the system function, and returns them to the requesting source process.

Abstract: A digital rights management system employs digital watermarks to enable users to sample public versions of music, movies and other content, and access private versions of that content whose use is controlled through encryption and associated content usage rules. In a system designed for personal computers, the system includes a digital watermark detector that operates within the operating system to intercept content signals from a device driver. The detector extracts the digital watermarks from the content signals to identify them as public or private content. The public content enables a user to sample the content. The watermark in the public content provides a mechanism for locating the private content and associated decryption key and usage rules governing playback of the private content.