Abstract: A network analyzer gets configuration information, usually in the form of a configuration packet sent from a network monitor. The configuration information comprises a second device network address and a third device network address. The second device network address is that of the network monitor and the third device network address is that of a communication device that is to be monitored. When the network analyzer sees packets from the monitored communication device, it can send the results to the network monitor for analysis without having to be configured with a unique network address. The network analyzer sends an original packet using the network address of the communication device as the source address and using the network address of the network monitor as the destination address.

Abstract: A method includes receiving a policy via a network connection, wherein the policy includes at least one signature. Receiving a data communication message from a processor of a computing device via a system bus. Identifying a class, and selectively forwarding the data communication message based in part on the received policy and the identified class.

Abstract: Methods and systems for an intelligent network protection gateway (NPG) and network architecture are provided. According to one embodiment, a firewall provides network-layer protection to internal hosts against unauthorized access by hosts of an external network by performing network address translation (NAT) processing of Internet Protocol (IP) addresses. The firewall changes data in headers of VoIP packets and corresponding data contents of the VoIP packets, to enable bi-directional VoIP communications. An external VoIP interface of the firewall receives incoming VoIP packets having a user alias (e.g., an email address) and an indication regarding a VoIP port of external interface. The packets are directed to an appropriate internal host by the firewall performing port address forwarding based on the port indication to an appropriate media gateway within the internal network that maintains a mapping of user aliases to private addresses of the internal hosts.

Abstract: Architecture that provides additional data that can be obtained and employed in security models in order to provide security to services over the service lifecycle. The architecture automatically propagates security classifications throughout the lifecycle of the service, which can include initial deployment, expansion, moving servers, monitoring, and reporting, for example, and further include classification propagation from the workload (computer), classification propagation in the model, classification propagation according to the lineage of the storage location (e.g., virtual hard drive), status propagation in the model and classification based on data stored in the machine.

Abstract: A computer-implemented method for prioritizing the monitoring of malicious uniform resource locators for new malware variants may comprise: 1) identifying at least one malicious uniform resource locator, 2) collecting priority information relating to the malicious uniform resource locator, wherein the priority information comprises information relevant to prioritizing monitoring of the malicious uniform resource locator for new malware variants, 3) determining, based on the priority information, a monitoring-priority level for the malicious uniform resource locator, and then 4) allocating, based on the monitoring-priority level, a monitoring resource for monitoring the malicious uniform resource locator. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method is provided in one example embodiment that includes intercepting a network flow to a destination node having a network address and sending a discovery query based on a discovery action associated with the network address in a firewall cache. A discovery result may be received and metadata associated with the flow may be sent to a firewall before releasing the network flow. In other embodiments, a discovery query may be received from a source node and a discovery result sent to the source node, wherein the discovery result identifies a firewall for managing a route to a destination node. Metadata may be received from the source node over a metadata channel. A network flow from the source node to the destination node may be intercepted, and the metadata may be correlated with the network flow to apply a network policy to the network flow.

Abstract: An integrated virtual desktop and security management system provides the virtual desktop server functionality and, more importantly, security management for computing devices and servers in the corporate data network. The computing devices include computers running virtual desktop client software and computers running a complete operating system and applications. The system in this invention can intercept data packets exchanged among the computing devices and servers and also can scrutinize virtual machine computing and networking activities, and therefore, possess the capability of analyzing, logging, reporting, and permitting or denying computing and networking activities of devices in the corporate data network.

Abstract: A firewall device may include a forwarding component that includes a filter block. The filter block may obtain a first hardware-implemented filter, where a hardware implementation limits the first hardware-implemented filter to a maximum quantity of rules; determine whether a last rule associated with the accessed hardware-implemented filter includes a split-filter action, where the split-filter action identifies a second hardware-implemented filter; and link the second hardware-implemented filter to the first hardware-implemented filter to make the second hardware-implemented filter a logical continuation of the first hardware-implemented filter, in response to determining that the last rule includes the split-filter action.

Abstract: System(s) and method(s) that employ deep packet inspection (DPI) of data flow relating to a requested service associated with a communication device to facilitate customizing the service or results provided by the service are presented. A service request can be received by a gateway identification of the service is attempted. If the service is identified, a privacy rule(s), which is contained in a user privacy profile of a user associated with the communication device, is analyzed to determine whether the privacy rule(s) applies to the service. If the privacy rule(s) is applicable, a DPI engine performs DPI on the data flow, in accordance with the privacy rule(s), to obtain information that can be used to customize the service or results provided by the service. The user can specify the level of DPI to be applied. A default rule can specify that no DPI is performed on the data flow.

Abstract: Methods and apparatus for transferring packets in a packet switched communication system. A system is provided that includes an L2 device including a controller determining for each packet received whether the received packet is to be inspected, an inspection device operable to inspect and filter packets identified by the controller including using a zone specific policy and an L2 controller for transferring inspected packets in accordance with L2 header information using L2 protocols.

Abstract: Methods and apparatus, including computer program products, implementing and using techniques for processing a data packet. An input port receives a data packet, a switching board classifies the data packet, determines whether the data packet should be accepted, and switches the data packet to a management board if the data packet is a first data packet in a session, and to a processing board if the data packet is not a first data packet in a session. A management board receives a data packet from the switching board, examines the data packet and forwards the data packet to one of the processing boards. One or more processing boards receives non-first data packets from the switching board and data packets from the management board and processes the data packets. A firewall and a secure gateway with firewall and virtual private network functionality for processing a data packet are also described.

Abstract: Software, systems and methods for defeating DoS and DDoS attacks according to certain embodiments include detecting a DoS/DDoS attack, connecting to attacking node(s) by allowing a network handshake to complete between a network connected device and the attacking nodes. Then the network connected device under attack drops the traffic from the attacking node(s) rather that rejecting it. The acceptance and dropping is repeated until the attack is defeated.

Abstract: A method for injecting a security token into an authentication protocol response is disclosed. An authentication protocol response from a node requesting access to a network is intercepted. It is determined if the node complies with a health policy of the network. A security token is inserted into the authentication protocol response based on the compliance node.

Abstract: A logically centralized controller provides a stateful firewall service provider on a network. The logically centralized controller routes a plurality of packets associated with a traffic flow to a firewall, and blocks, allows, or further monitors the traffic flow based on the inspection of the plurality of packets by the firewall. The logically centralized controller thereby prevents unauthorized network activity while allowing network traffic to bypass the bottleneck created by the firewall.

Abstract: A method and apparatus for automatically obtaining web page content in the presence of redirects whereby an incoming message is received and analyzed to determine if the message contains any URLs. Any detected URLs are then extracted and activated to analyze the contents of the web page linked to by the URL. The HTTP response headers and content sent from a web page server in response to the browser HTTP requests to activate the URL link are analyzed to determine if the response includes a redirect to a new, or destination, URL, and associated web page, i.e., to determine if the detected URLs result in redirects. If the HTTP response indicates a redirect, a URL redirect analysis process is initiated that includes a set of redirect processing procedures that are selectively applied depending on the type of redirect encountered, and each redirect is automatically followed. For chains of redirects, the process is recursive, i.e.

Abstract: A device for detecting network traffic content is provided. The device includes a memory configured for storing one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates. The device also includes a processor configured to receive data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, and determine whether the network traffic content matches the content desired to be detected.

Abstract: An anti-malware (AM) apparatus includes: a hardware-based firewall (FW) engine, including a packet matching engine configured to perform matching of a packet with a plurality of FW rules, and to generate a matching results; and an FW function module configured to determine an action for filtering the packet on the basis of the matching result.

Abstract: There are provided a system and method for detecting Address Resolution Protocol (ARP) attacks. The ARP spoofing attack detection system includes: a reception module which receives an ARP packet, and which determines whether the received ARP packet is an unsolicited ARP packet; a transmission module which creates, if the ARP packet is an unsolicited ARP packet, an ARP request packet corresponding to the unsolicited ARP packet, and which broadcasts the ARP request packet; and a detection module which determines, if an ARP response packet corresponding to the ARP request packet is received, whether an input port of the ARP response packet is identical to an input port of the unsolicited ARP packet, and which determines that an ARP spoofing attack has occurred if the input port of the ARP response packet is not identical to the input port of the unsolicited ARP packet.

Abstract: Providing for employing a real time firewall to secure components of an automation control network from unauthorized communication to or from such components is disclosed herein. A monitoring component can inspect at least a portion of an instance of communication directed toward or originating from a component of the automation control network. Such inspection can, e.g., be a deep packet inspection based on information received from a communication request and/or response protocol. A filtering component can selectively admit or deny propagation of the instance of communication based on the inspection and a predetermined security criterion. In such a manner, the subject innovation can provide for limited access to network components from office network machines and for securing components of an automation control network from influence by unauthorized entities.

Abstract: Distribution of network processing load among a set of packet processing devices is improved by employing means for eliminating, controlling, or otherwise affecting redundant packet processing operations. In one embodiment, at least two packet processing devices are present, both capable of processing data packets flowing therethrough, such as, inspecting, detecting, and filtering data packets pursuant to one or more filters from a filter set. Redundancy is controlled by providing or enabling either or both of the packet processing devices with capability for detecting during its said inspection of said data packets that, for example, one or more filters had been previously executed on said data packets by the other packet processing device, and then not executing the previously-executed filters on said data packets.

Abstract: A method, system and computer program for providing multilevel security to a computer network. The method comprises the step of receiving a first communication packet on at least one network interface port from an outside network. The method further includes the steps of filtering the first packet in one of at least two levels of security comprising a first level of security which examines the content information of the packet and a second level of security which examines the first packet excluding the content information of the packet. The system includes a first packet filter configured to filter its input packets by examining content information of its packets and a second packet filter configured to filter its input packets by examining the header information without examining the content information of its packets. The system further includes a third filter which is configured to forward a number of packets to one of the first and second filters, thereby providing security to the computer network.

Abstract: A method, system, and apparatus are directed towards enabling access to payload by a third-party sent over an SSL session. The third-party may be a proxy situated between a client and a server. SSL handshake messages are sent between the client and the server to establish the SSL connection. As the SSL handshake messages are routed through the proxy, the proxy may extract data. In addition, one of the client or the server may send another message within, or out-of-band to, the series of SSL handshake message directly to the proxy. The other SSL message may include secret data that the proxy may use to generate a session key for the SSL connection. With the session key, the proxy may receive SSL messages over the SSL connection, modify and/or transpose the payload within the received SSL messages, and/or terminate the SSL connection at the proxy.

Abstract: Embodiments of the present invention are directed to establishing and/or implementing firewall rules that may employ parameters based on connection security levels for a connection between devices. A firewall may thus provide greater granularity of security and integrate more closely with other security methods to provide better overall security with fewer conflicts.

Abstract: A method for reducing the size of the AV database on a user computer by dynamically generating an AV database according to user parameters is provided. Critical user parameters that affect the content of the AV database required for this user are determined. The AV database for the single user is generated based on the user parameters. When the parameters of the user computer change or when new malware threats are detected, the user AV database is dynamically updated according to the new parameters and the new malware threats. The update procedure becomes more efficient since a need of updating large volumes of data is eliminated. The AV system, working with a small AV database, finds malware objects more efficiently and uses less of computer system resources.

Abstract: A system and method are disclosed for improving a statistical message classifier. A message may be tested with a machine classifier, wherein the machine classifier is capable of making a classification on the message. In the event the message is classifiable by the machine classifier, the statistical message classifier is updated according to the reliable classification made by the machine classifier. The message may also be tested with a first classifier. In the event that the message is not classifiable by the first classifier, it is tested with a second classifier, wherein the second classifier is capable of making a second classification. In the event that the message is classifiable by the second classifier, the statistical message classifier is updated according to the second classification.

Abstract: Methods, systems, and apparatuses are described for implementations of an Internet protocol (IP) communication device (e.g., an IP phone) that contains a firewall. The IP communication device is coupled between a computer system and a network. A data packet is received at a first port of the IP communication device. The data packet is filtered with the firewall included in the IP communication device. The filtered data packet may be transmitted from a second port of the IP communication device (in modified or unmodified form), or may be canceled based on the filtering. In one implementation, the first port is coupled to the network and the second port is coupled to the computer system. In another implementation, the first port is coupled to the computer system and the second port is coupled to the network.

Abstract: A method of detecting a content desired to be detected includes receiving electronic data at a first host, determining a checksum value using the received electronic data, sending the checksum value to a processing station, the processing station being a second host that is different from the first host, and receiving a result from the processing station, the result indicating whether the electronic data is associated with a content desired to be detected. A method of detecting a content desired to be detected includes receiving electronic data at a receiving station, and determining whether the received electronic data is associated with a content desired to be detected, wherein the receiving station does not include content detection data for identifying the content desired to be detected.

Abstract: A method for generating e-mail messages with increased security includes receiving an e-mail message at a control system. The e-mail message has recipients, a security level, control attributes, and e-mail message contents. Moreover, the method includes verifying the recipients at the control system, and storing the recipients, security level, control attributes, and e-mail message contents in the control system when each of the recipients is verified. Furthermore, the method includes generating modified e-mail messages from the e-mail message, transmitting each of the modified e-mail messages to a respective recipient, and capturing authentication data from one of the recipients when the one recipient indicates a desire to view the e-mail message contents with a communications device operated by the one recipient. When the one recipient is successfully authenticated, the method includes permitting the one recipient to view the e-mail message contents in accordance with the control attributes.

Abstract: Methods, systems, and apparatus, including computer program products, featuring receiving at a first security device a packet. The first security device determines that the packet is associated with a flow assigned to a distinct second security device. The first security device sends the packet to the second security device. After the second security device performs security processing using the packet, the first security device receives from the second security device a message regarding the packet. The first security device transmits the packet.

Abstract: According to one aspect, the subject matter described herein includes a system for Diameter routing and firewall filtering. The system includes a Diameter signaling router comprising a network interface for receiving, from a first Diameter node, a first Diameter message having Diameter information. The Diameter signaling router also includes a firewall module for determining whether the first Diameter message satisfies a firewall policy. The firewall policy is based on at least a portion of the Diameter information in the first Diameter message. The Diameter signaling router further includes a routing module for forwarding at least a portion of the first Diameter message towards a second Diameter node in response to the first Diameter message satisfying the firewall policy.

Abstract: A method and system for best effort propagation of security group information is disclosed. The method includes determining if a reserved group identifier is associated with a destination and, if the reserved group identifier is associated with the destination, indicating that a packet received at a network node can be sent to another network node. The packet includes destination information that identifies the destination as a destination of the packet.

Abstract: A method, Super Node-Core (SN-C) node and Distributed Service Network (DSN) authentication system for requesting and storing DSN authentication information are provided, wherein the method for requesting the DSN authentication information includes: according to a user access request, judging whether a local SN-C node stores the authentication information of the user; when the local SN-C node stores the authentication information, initiating an authentication process directly; when the local SN-C node does not store the authentication information, requesting the authentication information from other SN-C nodes which store the authentication information of the user.

Abstract: Methods and systems for solving the problem of special processing required by various communication network subsystems (e.g., QOS, security, tunneling, etc). In some cases the processing by one communication subsystem may result in modified IP data packets which may affect the application of additional processing of such packets. The methods and systems solve problem by translating filters and setting up additional tunnels or other procedures based on the use case so that all the end and intermediate nodes can do the required processing on modified packets. The methods and systems may take into consideration an overlap or intersection of two or more different types of packet filters. A first set of packet filters is translated to provide the desired packet classification for modified packets. The second set of packet filters may be translated based upon the translation applied to the first set of packet filters.

Abstract: Apparatus, methods and software that implement cross-connected, server-based, IP-connected, point-to-point connectivity between remotely located firewall-protected devices. The apparatus, methods, and software allow user computers to communicate with remotely located firewall-protected devices that without the necessity to configure the firewalls. The apparatus methods, and software are implemented using a relay server that runs software that implements communication between an arbitrary number of firewall-protected devices and an arbitrary number of firewall-protected user computers that are remotely-located from the devices.

Abstract: Deep packet inspection is performed on packets in a network intrusion prevention system. A processing priority may be assigned to a packet based on characteristics such as the protocol type of the packet. Higher-priority packets may be processed before lower-priority packets or otherwise given preferential processing treatment. Deep packet inspection may be performed on the packet, and the processing priority of the packet may be changed based on the amount of time required to complete inspection of the packet. For example, the processing priority of the packet may be lowered if inspection of the packet takes longer than a predetermined time threshold. Furthermore, inspection of such packets may be suspended and either terminated or resumed at a subsequent time.

Abstract: According to some embodiments of the invention, a method for network protection is provided. The method includes receiving with a network security software a request from an entity to stop at least a portion of unauthorized network traffic from being transmitted through a firewall. The entity lacks control over the firewall and the network security software is operable to control the firewall. The method also includes using the network security software to automatically determine that the entity is an authorized entity authorized to make the request. The method also includes initiating a block of the unauthorized network traffic at the firewall in response to the automatic determination.

Abstract: A system and a method for operating a plurality of information handling systems forming a network are provided. The system includes a host computer processing unit (CPU); a band management controller (BMC); and a switch having a first port coupled to the host CPU, a second port coupled to the BMC, and an external port coupled to a network; wherein the switch is configured to perform lookups and send an ingress traffic including an internet content to the host CPU, and to send the ingress traffic including a management content to the BMC accordingly. A computer program product including a non-transitory computer readable medium having computer readable and executable code for instructing a processor in a management unit for a plurality of information handling systems forming a network to perform a method using a system as above is also provided.

Abstract: Systems and methods for stateless system management are described. Examples include a method wherein a user sends the management system a request to act upon a managed system. The management system determines whether the user is authorized for the requested action. Upon authorization, the management system looks up an automation principal, which is a security principal native to the managed system. The management system retrieves connecting credentials for the automation principal, and connects to the managed system using the retrieved credentials. Once the managed system is connected, the management system performs the requested action on the managed system, and sends the result back to the user.

Abstract: Disclosed herein are systems, methods, and computer-readable storage media for a honeypot addressing cyber threats enabled by convergence of data and communication services in an enterprise network. Suspicious incoming VoIP calls from the Internet to the enterprise network are intercepted and directed to a VoIP honeypot that acts as a network decoy and responds automatically during call sessions for the suspicious incoming VOIP calls while tracing the suspicious incoming VOIP calls. Suspicious outgoing VoIP calls from the enterprise network to the Internet are also intercepted and directed to the VoIP honeypot. Moreover, an unsolicited VoIP call is redirected to the VoIP honeypot when the unsolicited VoIP call has been received by a user agent in the enterprise network and a human user of the user agent confirms that the unsolicited VoIP call was unsolicited.

Abstract: A packet handling system is disclosed that can include at least one main processor, a plurality of offload processors connected to a memory bus and configured to provide security related services on packets prior to redirection to the main processor; an arbiter connected to each of the plurality of offload processors, the arbiter capable of scheduling resource priority for instructions or data received from the memory bus; and a virtual switch respectively connected to the main processor and the plurality of offload processors using the memory bus, with the virtual switch capable of receiving memory read/write data over the memory bus, and further directing at least some memory read/write data to the arbiter.

Abstract: A method for handling packets is disclosed. The method can include providing at least one main processor connected to a plurality of offload processors by a memory bus; configuring the offload processors to provide security related services on packets prior to redirection to the main processor; and operating a virtual switch respectively connected to the main processor and the plurality of offload processors using the memory bus, with the virtual switch capable of receiving memory read/write data over the memory bus.

Abstract: The system and method described herein may provide unified transport and security protocols. In particular, the unified transport and security protocols may include a Secure Frame Layer transport and security protocol that includes stages for initially configuring a requester device and a responder device, identifying the requester device and the responder device to one another, and authenticating message frames communicated between the requester device and the responder device. Additionally, the unified transport and security protocols may further include a Secure Persistent User Datagram Protocol that includes modes for processing message frames received at the requester device and the responder device, recovering the requester device in response to packet loss, retransmitting lost packets sent between the requester device and the responder device, and updating location information for the requester device to restore a communications session between the requester device and the responder device.

Abstract: A method and an apparatus for providing security in an intranet network are disclosed. For example, the method receives a packet at a customer edge router, and applies an inbound access control list by the customer edge router to the packet if the packet is destined to a server in a protected server group, wherein said protected server group identifies one or more servers within the intranet network to be protected. The method applies an outbound access control list by the customer edge router to the packet if the packet is from a server in the protected server group.

Abstract: An approach is provided for collecting and controlling access to network information. A network information anonymizer receives network information associated with a device, separates the network information into anonymized network information and user identifiable information, and enables access to the anonymized network information independently of the user identifiable information based on a privacy setting.

Abstract: Systems, methods, and other embodiments associated with flexible supplicant access control are described. One example method includes collecting a network information associated with a network to which an endpoint is to be communicatively coupled. The network information comprises a network identification and information to facilitate the evaluation of network threats. The example method may also include classifying the network based, at least in part, on the network information, to assign a variable level access parameter (VLAP) to the network based on the policy locally configured on the endpoint or centrally managed by the administrator. The VLAP may establish three or more access levels for the network at the endpoint. The example method may also include communicating the network identification and the network VLAP to a second endpoint, a security agent, a security application, and so on.

Abstract: The methods and systems of the present disclosure provide a high assurance means for multiple legacy communication (e.g., Mil-Std-1553 communications protocol) system users and/or devices and multiple IP based network users and/or devices to seamlessly, and in real time, share information across various security domains. Specifically, the system enables multiple legacy communication system protocols and interfaces to communicate with existing IP interfaces and protocols with a high degree of trust. The system includes a configurable filtering capability to allow for the data to be inspected prior to being passed from one security domain to another security domain.

Abstract: A program for causing an information processing device to execute a process is recorded on a computer-readable storage medium. The process includes: obtaining an identification of a logged-in account; referencing information that associates an identification of an account with a virtual machine to be permitted to make a communication; recognizing a first virtual machine corresponding to the obtained identification by using the referenced information; executing one or a plurality of virtual machines on the information processing device that is a physical machine; determining whether or not a second virtual machine from which data is transmitted toward a network is the first virtual machine; allowing the data to pass through and transmitting the data toward the network if the second virtual machine is determined to be the first virtual machine; and discarding the data if the second virtual machine is determined not to be the first virtual machine.

Abstract: A system and method can provide subnet management packet (SMP) firewall restrictions in a middleware machine environment. A secure firmware implementation can be provided on a host channel adaptor (HCA), wherein the HCA is associated with a host in the middleware machine environment. The secure firmware implementation operates to receive at least one SMP from the host or destined to the host, and prevent the host from sending or receiving the at least one SMP. Furthermore, the secure firmware implementation can include a proxy function that can communicate with external management components on behalf of the host.

Abstract: A method is described in example embodiments below that include receiving a content tag associated with transferring a file over a network connection. A session descriptor may also be received. The session descriptor and the content tag may be correlated with a network policy, which may be applied to the network connection. In some embodiments, the content tag may be received with the session descriptor. The file may be tainted by another file in some embodiments, and the content tag may be associated with other file.

Abstract: A method for use in providing content that is made up of data includes providing a first portion of the data making up the content to a user, and making available for a limited amount of time an ability to stream a second portion of the data making up the content to a device having the first portion of the data. The second portion of the data includes essential information for reconstructing the content from the first portion of the data. Also disclosed are a storage medium storing a computer program for causing a processor based system to assist with providing content, and a system for use in providing content.