Abstract: A method of configuring a filter to perform pattern matching against input data is provided. The method includes receiving one or more rules, each rule including one or more field specifiers, each field specifier including a value specifier that specifies a value to be matched and a location specifier that specifies a location in the input data. For each rule of the one or more rules an empty buffer is initialized. For each field specifier the value specified by the field specifier is appended to the buffer, and the buffer contents are inserted into contents of a probabilistic data structure representing all of the field specifiers of the rule. The probabilistic data structure is configured to receive a query that includes query buffer contents determined from the input data and respond with a match status of probably present based on a predetermined probability, or definitely not present.

Abstract: A logical expression engine and computer-implemented method for optimizing evaluation of a logical expression is provided. The method includes receiving an original logical expression to be applied by a computer program for processing input information, the original logical expression having at least one operator and a subexpression disposed on each side of a related operator of the at least one related operator. The method further includes receiving statistics accumulated about how the computer program applies the subexpressions of the original logical expression for processing the input information received by the computer program, using the accumulated statistics to optimize the order in which the subexpressions would be applied by the computer program, and outputting for application by the computer program an optimized logical expression having the subexpressions ordered in accordance with the optimized order.

Abstract: A logical expression engine and computer-implemented method for optimizing evaluation of a logical expression is provided. The method includes receiving an original logical expression to be applied by a computer program for processing input information, the original logical expression having at least one operator and a subexpression disposed on each side of a related operator of the at least one related operator. The method further includes receiving statistics accumulated about how the computer program applies the subexpressions of the original logical expression for processing the input information received by the computer program, using the accumulated statistics to optimize the order in which the subexpressions would be applied by the computer program, and outputting for application by the computer program an optimized logical expression having the subexpressions ordered in accordance with the optimized order.

Abstract: A computer implemented method, apparatus, and computer usable program code for executing a process within a virtual machine. A module is injected into an operating system for the virtual machine to form an injected module. The injected module is executed to load an agent process within an application space within the virtual machine. Execution of the agent process is initiated by the injected module.

Abstract: Managing the selection and scheduling of security audits run on a computing network. The computer network is surveyed by a security audit system to determine the function and relative importance of the elements in the network. Based on function and priority, a more thorough type of security audit is selected to run against each of the network elements by the security audit system. The security audit can also be automatically scheduled based on the information gathered from the survey. Once the system runs the security audit, a vulnerability assessment can be calculated for each element in the network. The vulnerability assessment can be presented in a format that facilitates interpretation and response by someone operating the system. The vulnerability assessment can also be used to configure and schedule future security audits.

Abstract: A computer implemented method, apparatus, and computer usable program code for executing a process within a virtual machine. A module is injected into an operating system for the virtual machine to form an injected module. The injected module is executed to load an agent process within an application space within the virtual machine. Execution of the agent process is initiated by the injected module.

Abstract: Managing the selection and scheduling of security audits run on a computing network. The computer network is surveyed by a security audit system to determine the function and relative importance of the elements in the network. Based on function and priority, a more thorough type of security audit is selected to run against each of the network elements by the security audit system. The security audit can also be automatically scheduled based on the information gathered from the survey. Once the system runs the security audit, a vulnerability assessment can be calculated for each element in the network. The vulnerability assessment can be presented in a format that facilitates interpretation and response by someone operating the system. The vulnerability assessment can also be used to configure and schedule future security audits.

Abstract: Calculating risk based on information collected during a security audit of a computing network. The computer network is surveyed to determine the significance of elements in the network and to identify vulnerabilities associated with the elements. Using this information, the security audit system calculates a risk value for each vulnerability. The risk value is a function of the asset value, the probability that the vulnerability will be exploited, and the potential severity of damage to the network if the vulnerability is exploited. The risk value can be adjusted based on the ease with which the vulnerability can be fixed. A network element may have one or more risk values associated with it based on one or more vulnerabilities. The security audit system employs a band calculation method for summing risk values and computing a single security score for the element. The band calculation method can also be used to produce a security score for a group of elements.

Abstract: Managing the selection and scheduling of security audits run on a computing network. The computer network is surveyed by a security audit system to determine the function and relative importance of the elements in the network. Based on function and priority, a more thorough type of security audit is selected to run against each of the network elements by the security audit system. The security audit can also be automatically scheduled based on the information gathered from the survey. Once the system runs the security audit, a vulnerability assessment can be calculated for each element in the network. The vulnerability assessment can be presented in a format that facilitates interpretation and response by someone operating the system. The vulnerability assessment can also be used to configure and schedule future security audits.