Abstract: A method for use in controllably concealing an input data that has been entered into a computer system via an input device, from being comprehended by a spying application during transportation of the input data across a communication link of the computer system, the method including the steps of: (i) encrypting the input data when the input data is being processed at a relatively low level within the computer system so as to form an encrypted input data; (ii) thereafter, transporting the encrypted input data across the communication link; (iii) thereafter, providing a device for decrypting the encrypted input data so as to obtain a decrypted input data; (iv) selectively providing access to the decrypted input data by at least one authorised software application operably connected to the computer system.

Abstract: A method is provided for improving computer security. A computer executes instructions for protecting a processing component on itself. Software generates a second processing module attacher responsive to an execution of the processing component. The computer stores data indicative of at least one second processing module thereby to define a processing module library. The attacher is adapted to retrieve a second processing module from the processing module library and to attach the retrieved second processing module to the processing component. This enables a security restriction on data processed by the processing component.

Abstract: An apparatus for protecting against malware comprises a first and a second processing module. The first processing module encrypts an input data generated by an input device. The encryption reduces unauthorized data monitoring by spyware. The second processing module is attached to the front of a protected data destination. The second processing module performs a decryption on any data that originates from the input device and enters the data destination. The encryption and decryption are synchronized. The decryption reduces the risk posed by an unencrypted backdoor command by making it undecipherable.

Abstract: An accelerated network security system includes, in part, a network security engine and a processing module configured to perform network security functions. The network security engine includes an input module configured to receive input data and generate an intermediate data in response, a core engine configured to perform security function operations on the first intermediate data to generate a first output data, and an output module configured to receive the first output data and generate a processed output data in response. The processing module includes a multitude of processing cores configured to operate concurrently, a memory configured to store processing core instructions and processing core data associated with the multitude of processing cores, and a processing controller configured to periodically allocate to each processing core one or more discrete blocks of processing time. The number of processing core data is greater than the number of processing cores.

Abstract: A multicore network security system includes scheduler modules, one or more security modules and post-processing modules. Each security module may be a processing core or itself a network security system. A scheduler module routes input data to the security modules, which perform network security functions, then routes processed data to one or more post-processing modules. The post-processing modules post-process this processed data and route it back to scheduler modules. If further processing is required, the processed data is routed to the security modules; otherwise the processed data is output from the scheduler modules. Each processing core may operate independently from other processing cores, enabling parallel and simultaneous execution of network security functions.

Abstract: A method for upgrading one or more security applications, e.g., anti-spam, anti-virus, intrusion detection/prevention. The method includes deriving a second hardware logic from a security knowledge base. The method includes operating a computing system including a security device. The computer system is coupled to the one or more computer networks, e.g., local area networks, wide area networks, Internet. The security device has one or more security logic processors, which include one or more respective first hardware logic. The method transfers an FPGA image representative of at least the second hardware logic through the computer network to one or more first memory devices. The method includes temporarily halting one or more of the security logic processors at a predetermined portion of the stream of information according to a specific embodiment.

Abstract: A first security processing stage performs a first multitude of tasks and a second security processing stage performs a second multitude of tasks. The first and second multitude of tasks may include common tasks. The first security processing stage is a prefilter to the second security processing stage. The input data received as a data stream is first processed by the first security processing stage, which in response, generates one or more first processed data streams. The first processed data streams may be further processed by the second security processing stage or may bypass the second security processing stage. The first security processing stage operates at a speed greater than the speed of the second security processing stage.

Abstract: A pattern matching system includes, in part, a multitude of databases each configured to store and supply compressed data for matching to the received data. The system divides each data stream into a multitude of segments and optionally computes a data pattern from the data stream prior to the division into a multitude of segments. Segments of the data pattern are used to define an address for one or more memory tables. The memory tables are read such that the outputs of one or more memory tables are used to define the address of another memory table. If during any matching cycle, the data retrieved from any of the successively accessed memory tables include an identifier related to any or all previously accessed memory tables, a matched state is detected. A matched state contains information related to the memory location at which the match occurs as well as information related to the matched pattern, such as the match location in the input data stream.

Abstract: An accelerated network intrusion detection and prevention system includes, in part, first, second and third processing stages. The first processing stage receives incoming packets and generates, in response, first and second processed data streams using a first set of rules. The first processing stage optionally detects whether the received packets are suspected of attacking the network and places the received data packets in the first processed data stream. The second processing stage receives the first processed data stream and generates, in response, a third processed data stream using a second set of rules. The second processing stage optionally classifies the first processed data stream, that is suspected of launching a network attack, as either attacks or benign network traffic. A third processing stage receives and processes the second and third processed data streams.

Abstract: A data compressor performing the compression algorithm compresses an original uncompressed pattern database to form an associated compressed pattern database configured for fast retrieval and verification. For each data pattern, the data compressor stores a data in an address of a first memory table and that is defined by a first segment of a group of bits associated with the data pattern. The data compressor stores a second data in an address of a second memory table and that is defined by a second segment of the group of bits associated with the data pattern and further defined by the first data stored in the first memory.

Abstract: A data classification system identifies and processes malicious data that may be present in a received data stream. The system includes at least two stages, and a data flow module. The data flow module derives, from an input data stream, a first processed data stream that is transmitted to the first processing stage. The first processing stage derives, from the first processed data stream, a second processed data stream that is transmitted to the second processing stage. The first and second processing stages optionally derive meta data from the data they receive.

Abstract: A first security processing stage performs a first multitude of tasks and a second security processing stage performs a second multitude of tasks. The first and second multitude of tasks may include common tasks. The first security processing stage is a prefilter to the second security processing stage. The input data received as a data stream is first processed by the first security processing stage, which in response, generates one or more first processed data streams. The first processed data streams may be further processed by the second security processing stage or may bypass the second security processing stage. The first security processing stage operates at a speed greater than the speed of the second security processing stage.

Abstract: A classifier of electronic messages includes one or more pre-filters and a filter. Messages classified as spam or legitimate by one or more of the pre-filters bypass the filter. Messages classified as suspicious are further classified by the filter as either spam or legitimate. Messages classified as spam are routed to a spam quarantine storage area. Messages classified as legitimate are routed to a spam delivery area.

Abstract: A method and apparatus for transforming regular expressions into a less resource intensive representation is disclosed. The method and apparatus converts a collection of regular expressions into a multi-level representation in which the memory requirements of the lowest level representation is reduced when compared with a conventional finite state automaton representation. The method and apparatus converts a collection of regular expressions into a collection of segments and a higher level representation in a way that retains the semantics of the original set of regular expressions. This transformation is performed through the use of an intermediate form. The resulting representation and collection admit an implementation which avoids the potentially costly memory requirements of a traditional implementation of the original expressions.