Abstract: A hostname based access configuration system (HNACS) is provided for configuring a host-based firewall to implement firewall policies referencing hostnames. The HNACS defines a hostname based firewall policy (HNFP) referencing a host server using a corresponding hostname instead of an internet protocol (IP) address. The HNACS incorporates the HNFP onto the host-based firewall but renders the HNFP non-implementable on the computing device until a domain name system (DNS) query is generated. If the DNS query includes the hostname in the HNFP, the HNACS determines a mapping between the hostname specified in the DNS query and an IP address corresponding to the hostname (obtained via a DNS response corresponding to the DNS query). Based on the mapping, the HNFP is transformed via an implicit replacement of the hostname in the HNFP with the IP address of the host server, thereby rendering the HNFP executable on the host-based firewall.

Abstract: A hostname based access configuration system (HNACS) is provided for configuring a host-based firewall to implement firewall policies referencing hostnames. The HNACS defines a hostname based firewall policy (HNFP) referencing a host server using a corresponding hostname instead of an internet protocol (IP) address. The HNACS incorporates the HNFP onto the host-based firewall but renders the HNFP non-implementable on the computing device until a domain name system (DNS) query is generated. If the DNS query includes the hostname in the HNFP, the HNACS determines a mapping between the hostname specified in the DNS query and an IP address corresponding to the hostname (obtained via a DNS response corresponding to the DNS query). Based on the mapping, the HNFP is transformed via an implicit replacement of the hostname in the HNFP with the IP address of the host server, thereby rendering the HNFP executable on the host-based firewall.

Abstract: Disclosed herein are a method, a view generating computing device, and a non-transitory computer readable medium for generating plurality of views on a user interface in a big data environment, the views corresponding to data flows from a plurality of source devices to the plurality of destination devices and vice-versa, The method includes receiving data flows from each of the plurality of source devices and each of the plurality of destination devices, the data flows indicative of the flow of data between a source device and corresponding destination device; receiving a request from a user interface associated with a user device; generating, a source view, a destination view, and a differential view; rendering the source view, the destination view, and the differential view on the user interface, wherein the source view, the destination view, and the differential view are viewed concurrently in real time m response to the generating.

Abstract: The disclosed apparatus may include a physical processing that (1) receives, at a network device, a packet that is destined for a computing device within a network, (2) performs pattern matching on the packet by (A) comparing at least a portion of the packet with a set of signatures that facilitate pattern matching in connection with network traffic and (B) determining, based at least in part on the comparison, that the portion of the packet matches at least one of the signatures, (3) parses, after performing the pattern matching, at least the portion of the packet to determine whether the packet is malicious based at least in part on the portion of the packet, and then (4) upon determining that the portion of the packet is malicious, performs at least one security action in connection with the packet. Various other apparatuses, systems, and methods are also disclosed.

Abstract: The disclosed computer-implemented method may include (1) detecting a request from a computing device of a member of an organization in connection with a communication session between the computing device and at least one additional computing device, (2) identifying, within the request, a URL that the computing device is attempting to access, (3) computing a unique identifier that represents the URL, (4) comparing the unique identifier against a database that includes unique identifiers that represent URLs embedded in emails received by members of the organization, (5) determining, based at least in part on the comparison, that the URL was included in an email received by the member of the organization, and then in response, (6) elevating a threat level of the communication session between the computing device and the additional computing device. Various other methods, systems, and apparatuses are also disclosed.

Abstract: The disclosed apparatus may include a physical processing that (1) receives, at a network device, a packet that is destined for a computing device within a network, (2) performs pattern matching on the packet by (A) comparing at least a portion of the packet with a set of signatures that facilitate pattern matching in connection with network traffic and (B) determining, based at least in part on the comparison, that the portion of the packet matches at least one of the signatures, (3) parses, after performing the pattern matching, at least the portion of the packet to determine whether the packet is malicious based at least in part on the portion of the packet, and then (4) upon determining that the portion of the packet is malicious, performs at least one security action in connection with the packet. Various other apparatuses, systems, and methods are also disclosed.

Abstract: An integrated policy enforcement system for a computer network implements several policies on the network traffic. A rule compiler compiles these policies and converts them into a rule tree-graph, which is then used to provide desired behavior to the network traffic comprising data packets. The rule compiler comprises three sub-modules namely—a rule input module, a rule tree generator module and a rule output module. The rule input module receives the input for the rule compiler and prepares the input for the rule tree generator module. The rule tree generator module generates the rule tree-graph. The rule tree-graph is a data structure comprising tree data structure and graph data structure.