Abstract: A method/system/computer program for obtaining the network origin of a downloaded entity of interest (e.g. a threat or malicious software). The method includes recording the network locations of at least some files downloaded to a processing system and recording the physical locations of the at least some files stored in one or more storage devices of the processing system. Then, identifying an entity of interest in the processing system and searching the recorded network locations and the recorded physical locations for the network location and the physical location of the entity of interest. Then, if the network location and the physical location of the entity of interest is identified, transmitting the network location and the physical location of the entity of interest to a remote processing system.

Abstract: An approach is provided for recycling information fragments in information spaces. An information management system detects a plurality of information management processes occurring in an information space. The information management processes retrieve one or more information fragments from the information space. The information management system then determines a sequence of states for each of the plurality of information management processes over a period of time and calculates a state trajectory from each of the sequence of states. The calculated state trajectories are used to predict a finite set of possible future states. The information management system uses the prediction to determine which of the one or more information fragments are recyclable and preserves the recyclable information fragments for responding to a subsequent request directed to the information space.

Abstract: An approach is provided for managing access rights of users to information spaces using signatures stored in a memory tag. A signature manager caused reading of a memory tag to initiate a request, from a device, for an initial access to an information space. The request includes an authorization signature associated with the device. The signature manager determines a level of access to the information space by comparing the authorization signature against a lattice of signature primitives associated with the information space. The signature manager then modifies the authorization signature based on the determination and stores the modified authorization signature for validation of subsequent access to the information space by the device.

Abstract: A method/system for determining a group of related entities of interest in one or more processing systems. The method comprises identifying a starting entity from one or more entities in the one or more processing systems, then obtaining, based on an entity type of the starting entity, a first set of rules for determining at least one other related entity, and then determining, using the first set of rules, the at least one related entity.

Abstract: An approach is provided for efficiently searching information in an information space utilizing information signatures. A signature application receives queries over information sources. The signature application, for each of the queries, generates a polynomial by defining the each query against the information sources as input parameters in polynomial form. The signature application provides irreducible polynomials over a finite field of a degree of orthogonality by factoring polynomials generated from the queries. The signature application adjusts the degree of orthogonality of the irreducible polynomials to provide adjusted irreducible polynomials, each of which is a signature and corresponds to a signature fragment, such that the signature fragments have overlapping portions. The signature application causes at least in part storage of the signatures or the signature fragments in a signature domain over an information space.

Abstract: A method, system, computer program product and/or computer readable medium of instructions for detecting malicious software, comprising intercepting a request to perform an activity in a processing system; determining an entity associated with the activity, wherein the entity comprises at least one of: a requesting entity of the activity; and a target entity of the activity; analysing the entity and the activity to determine if the request is associated with malicious software; and in the event that the request is determined to be associated with malicious software, restricting the request to perform the activity in the processing system.

Abstract: A method, system, computer program product, and/or computer readable medium of instructions for identifying a malicious entity in a processing system, comprising determining an entity threat value for an entity, the entity threat value being indicative of a level of threat that the entity represents to the processing system, wherein the entity threat value is determined based on one or more characteristics of the entity; and compare the entity threat value to an entity threat threshold to identify if the entity is malicious. In another form, there is provided a method, system, computer program product, and/or computer readable medium of instructions for identifying a malicious entity in a processing system, comprising determining one or more input values indicative of an entity; and performing a fuzzy logic analysis in relation to the one or more input values to identify if the entity is malicious.

Abstract: A method and system for controlling an operation of a JVM® component on a per-classloader basis. A manifest of a bundle in an OSGi® compliant framework is parsed and metadata in the manifest is identified. The metadata is stored in a Java® classloader uniquely associated with the bundle. An upcoming performance of an operation which can be affected by a value of the stored metadata is identified by the JVM® component. A value of the stored metadata is read from the classloader. The operation of the JVM® component is controlled based on the value of the stored metadata.

Abstract: The import address table of a software module is verified in order to prevent detouring attacks. A determination is made regarding which entries in the IAT must be verified; all of the entries may be verified or some subset of the entries that are critical may be verified. For each external function, the external module containing the external function is loaded, if it is not already loaded. The function address in the exported function table is found. That address is compared to the address for the function in the IAT. Additionally, the external module, in one embodiment, is verified to ensure that it has not been modified. For a delay load IAT, a similar procedure is followed; however the delay load IAT may be periodically checked to ensure that the delay load IAT entries are either valid (indicating that the external function has been bound) or in their initial state (indicating that no binding has yet occurred).

Abstract: Dynamic run-time verification of a module which is loaded in memory (in whole or in part) for execution is enabled by using pre-computed portion-level verification data for portions of the module smaller than the whole (e.g. at the page-level). A portion of the module as loaded into memory for execution can be verified. Pre-computed portion-level verification data is retrieved from storage and used to verify the loaded portions of the executable. Verification data may be, for example, a digitally signed hash of the portion. Where the operating system loader has modified the portion for execution, the modifications are reversed, removing any changes performed by the operating system. If the portion has not been tampered, this will return the portion to its original pre-loaded state. This version is then used to determine validity using the pre-computed portion-level verification.

Abstract: A method is provided that includes receiving a first triple including a subject, predicate and object, where the object is of a literal-type. For the first triple, then, the method includes identifying a subtype of the object; semantically marking the object with the identified subtype, including generating second and third triples; and storing the second and third triples in a triple store. In this regard, the second triple includes the subject and predicate of the first RDF triple as the subject and predicate thereof, and the third RDF triple includes the object of the first RDF triple or a representation of the object of the first RDF triple as the object thereof.

Abstract: The invention is a method and system for providing trace data in a pipelined data processor. Aspects of the invention include providing a trace pipeline in parallel to the execution pipeline, providing trace information on whether conditional instructions complete or not, providing trace information on the interrupt status of the processor, replacing instructions in the processor with functionally equivalent instructions that also produce trace information and modifying the scheduling of instructions in the processor based on the occupancy of a trace output buffer.

Abstract: A method, apparatus and computer program product are provided for performing a query using a decision diagram. In this regard, in response to receiving a query instruction a compression value for a query result decision diagram can be determined. A compression value for a compressed query result set may also be determined. A compression ratio can be determined between the compression value for the query result decision diagram and the compression value for a compressed query result set. A query result decision diagram may be generated based on the query instruction and a relationship between the compression ratio and a threshold ratio. The query result decision diagram may also be transmitted based upon a relationship between the compression ratio and a threshold ratio.

Abstract: A per-machine based owner compensation advertising delivery systems targets advertising content to individual computer machines. Computer owners are compensated by receiving a portion of the per-machine advertising revenue, obtaining subsidized ad software, or by other financial agreements corresponding to ad delivery to a specific computer. The client software responsible for showing the ad content is also responsible for requesting ads from a server of an ad delivery service provider based on a deterministic combination of sequence and timing information that is also known by the server. The server may detect potential client fraud based on the comparing the pattern, frequency, and content of received ad requests to the expected behavior of the client machine, and then take action to mitigate the fraud through various strategies.

Abstract: In various embodiments, a user may, via a processing device, indicate a desire to purchase a feature of an installed software product. A purchase request may be sent to an e-commerce server, or other server. The purchase request may be validated and information concerning the software product, the feature of the software product, and the processing device may be stored. Enabling information may be sent to the processing device to enable the feature of the software product. In some embodiments, the user may request a trial of a feature of a software product before purchasing the feature. In other embodiments, the user may deactivate a purchased feature of a software product on one processing device and may activate the purchased feature of the software product on a different processing device.

Abstract: A method, system, and computer program product for presenting content indicative of one or more entities which contributed to a window being displayed using a processing system. The method comprises determining one or more properties of the window; identifying, using the one or more properties and a set of rules, one or more entities which contributed to the window being displayed; and providing to a user, using the processing system, content indicative of the one or more entities which contributed to the window being displayed.

Abstract: A method and user interface permits the display of objects in a portion of a display. The objects may initial be a first size, then shrink to a smaller size after a period of time. The objects may stack on top of each other. In addition, the objects may disappear all together after a further amount of time.

Abstract: A method of determining an indication of an invalid request, the method including the steps of, in a processing system: receiving data at step 100, comparing at least a portion of the received data to predetermined criteria at step 110, determining an indication of an invalid request included in the data at step 120, and generating a notification in accordance with the determined invalid request at step 140.

Abstract: A method, system, computer program product and/or a computer readable medium of instructions for detecting one or more entities which are able to reinfect a processing system with malicious software. The method includes: monitoring, in the processing system, activity indicative of the malicious software reinfecting the processing system; in response to detecting the activity, storing a record of the activity and one or more entities associated with the activity; determining if the malicious software has reinfected the processing system; and in response to determining that the malicious software has reinfected the processing system, analysing the record to detect the one or more entities which were associated with the activity that caused and/or assisted in reinfecting the processing system with the malicious software. There is also disclosed a method, system, computer program product and/or a computer readable medium of instructions for detecting a variant of malicious software in a processing system.

Abstract: A method, and associated system and computer program product, of validating site data. The method includes the steps of, in a processing system 200, receiving 100 an indication of site data, performing a comparison 110 of the indication to site data criteria, and validating or invalidating 120 the indication based on a result of the comparison. The indication of site data could be at least part of a webpage, a link to a webpage, a Uniform Resource Locator, an IP address, at least part of an AJAX page, and/or at least part of a document.