Abstract: An endpoint device monitors loading of dynamically loaded libraries (DLLs) by a process, such as during execution of the process on the endpoint device. The endpoint device can generate an endpoint-independent representation of the DLLs upon exiting of the process. The endpoint device may generate a hash, such as a one-way hash, of the endpoint-independent representation. The endpoint device may transmits the process and the hash to a management device to detect in a machine learning manner whether loading of the DLLs during the execution of the process was anomalous.

Abstract: File access in a network environment by detecting when files have been accessed at a computers in the network environment, and then generating unique content identifiers of the file content. The content identifier along with access metadata can be transmitted to and stored at a central location. The stored information can be used to track file content movement in the network environment.

Abstract: A file fingerprint may be provided as a composite of multiple hashes of different portions of the file. The composite hash allows the fingerprinting process to be interrupted while still providing information about a likely hood of two files being identical.

Abstract: An endpoint device monitors loading of dynamically loaded libraries (DLLs) by a process, such as during execution of the process on the endpoint device. The endpoint device can generate an endpoint-independent representation of the DLLs upon exiting of the process. The endpoint device may generate a hash, such as a one-way hash, of the endpoint-independent representation. The endpoint device may transmits the process and the hash to a management device to detect in a machine learning manner whether loading of the DLLs during the execution of the process was anomalous.

Abstract: A file fingerprint may be provided as a composite of multiple hashes of different portions of the file. The composite hash allows the fingerprinting process to be interrupted while still providing information about a likely hood of two files being identical.

Abstract: Host end points of a network connection can generate unique connection identifiers that are the same for both ends of the network connection. Both end points of the connection can send the connection identifiers in association with host end point metadata about the connection to a central location, where the metadata of both end points of a connection can be identified by the unique connection identifier.

Abstract: File access in a network environment by detecting when files have been accessed at a computers in the network environment, and then generating unique content identifiers of the file content. The content identifier along with access metadata can be transmitted to and stored at a central location. The stored information can be used to track file content movement in the network environment.