A flow processing facility, which uses a set of artificial neurons for pattern recognition, such as a self-organizing map, in order to provide security and protection to a computer or computer system supports unified threat management based at least in part on patterns relevant to a variety of types of threats that relate to computer systems, including computer networks. Flow processing for switching, security, and other network applications, including a facility that processes a data flow to address patterns relevant to a variety of conditions are directed at internal network security, virtualization, and web connection security. A flow processing facility for inspecting payloads of network traffic packets detects security threats and intrusions across accessible layers of the IP-stack by applying content matching and behavioral anomaly detection techniques based on regular expression matching and self-organizing maps. Exposing threats and intrusions within packet payload at or near real-time rates enhances network security from both external and internal sources while ensuring security policy is rigorously applied to data and system resources. Intrusion Detection and Protection (IDP) is provided by a flow processing facility that processes a data flow to address patterns relevant to a variety of types of network and data integrity threats that relate to computer systems, including computer networks.

Systems and methods for processing data flows

An apparatus for transmitting a file with enhanced transmission security through a network includes a file-splitting processor that splits the file into a plurality of message segments and addresses the plurality of message segments to a plurality of addresses assigned to a receiving host. The apparatus includes a message segment transmitter for transmitting the plurality of message segments to the receiving host.

Camouflage of network traffic to resist attack

Applications, systems and methods for permitting simultaneous use of a file by two or more computers over a network may include storing the file locally in a local storage device associated with a local computer; providing access to the file by at least one remote computer which is connectable to the local computer via the network, and wherein at least one of the computers is connectable to the network through a firewall element. The file may be stored in at least one remote storage device associated with the at least one remote computer, respectively, and versions of the file contained on the one or more remote storage devices are synchronized with that on the local device by transmitting over the network connecting the one or more remote storage devices with the local device, at least one of Delta files and Inverse Delta files between the remote storage devices and the local storage device. A method of remotely observing computer activity on a second computer remote with respect to a first computer is also provided. Further, file sharing systems and methods are provided for sharing files among computers.

Managed peer-to-peer applications, systems and methods for distributed data access and storage

A feedback control system for congestion prevention in a cell (packet) switching communication network is described. Congestion control is accomplished by controlling the transmission rate of bursty traffic in the presence of high priority, voice, low speed statistical, high speed deterministic and multicast data. Because bursty traffic is relatively insensitive to delay, adequate buffercapacity can be provided at the network nodes in order to minimize bursty data cell loss. By monitoring the buffer queue lengths at the nodes, a control signal can be generated at each intermediate node indicating the state of congestion. Excess queue length indicates incipient congestion while short queue lengths indicate excess capacity. Queue status is forwarded to the destination node where it is interpreted and sent back to the source node as a feedback rate control signal using a 2-bit code. The source node regulates the rate of bursty data transmission over the cell network in accordance with the feedback control signal thus minimizing congestion and concomitant data loss while efficiently utilizing available network bandwidth.

Congestion control for cell networks

An improved method and apparatus is used for storing and delivering information over the Internet and using Internet technologies. According to one embodiment of the present invention, a method and apparatus for maintaining statistics on a server (204) is disclosed. According to an alternative embodiment, a method and apparatus (204) is disclosed for predicting data that a client device (100) may request from a server on a network. In another embodiment of the present invention, a method and apparatus (204) is disclosed for managing bandwith between a client device (100) and a network. According to yet another embodiment, a method and apparatus (204) is disclosed for validating a collection of data (200). According to yet another embodiment, a method for providing notification to clients (100) from servers (204) is disclosed.

A method and apparatus for storing and delivering documents on the internet

A method and apparatus are used for finding the longest prefix match in a variable length prefix search when searching a direct table within a routing table structure of a network processor. The search through the routing table structure is expedited by hashing a first segment of an internet protocol address with a virtual private network number followed by concatenating the unhashed bits of the IP address to the result of the hash operation to form an input key. Patterns are compared a bit at a time until an exact match or the best match is found. The search is conducted in a search tree that provides that the matching results will be the best possible match.

Longest prefix match lookup using hash function

A method and system for performing a pattern match search for a data string having a plurality of characters separated by delimiters. In accordance with the method of the present invention a search key is constructed by generating a full match search increment comprising the binary representation of a data string element, wherein the data string element comprises all characters between a pair of delimiters. The search key is completed by concatenating a pattern search prefix to the full match search increment, wherein the pattern search prefix is a cumulative pattern search result of each previous full match search increment. A full match search is then performed within a lookup table utilizing the search key. In response to finding a matching pattern within the lookup table, the process returns to constructing a next search key. In response to not finding a matching pattern, the previous full match search result is utilized to process the data string.

Method and system for performing a pattern match search for text strings

A network switch apparatus, components for such an apparatus, and methods of operating such an apparatus in which data flow handling and flexibility is enhanced by the cooperation among a plurality of interface processors and a suite of peripheral elements formed on a semiconductor substrate. The interface processors and peripherals together form a network processor capable of cooperating with other elements including an optional switching fabric device in executing instructions directing the flow of data in a network.

Network switch using network processor and methods

Providing communications between operating system partitions and a computer network. In one aspect, an apparatus for distributing network communications among multiple operating system partitions includes a physical port allowing communications between the network and the computer system, and logical ports associated with the physical port, where each logical port is associated with one of the operating system partitions. Each of the logical ports enables communication between a physical port and the associated operating system partition and allows configurability of network resources of the system. Other aspects include a logical switch for logical and physical ports, and packet queues for each connection and for each logical port.

Network communications for operating system partitions

A system for minimizing congestion in a communication system is disclosed. The system comprises at least one ingress system for providing data. The ingress system includes a first free queue and a first flow queue. The system also includes a first congestion adjustment module for receiving congestion indications from the free queue and the flow queue. The first congestion adjustment module generates end stores transmit probabilities and performs per packet flow control actions. The system further includes a switch fabric for receiving data from the ingress system and for providing a congestion indication to the ingress system. The system further includes at least one egress system for receiving the data from the switch fabric. The egress system includes a second free queue and a second flow queue. The system also includes a second congestion adjustment module for receiving congestion indications from the second free queue and the second flow queue. The second congestion adjustment module generates and stores transmit probabilities and performs per packet flow control actions. Finally, the system includes a scheduler for determining the order and timing of transmission of packets out the egress system and to another node or destination. A method and system in accordance with the present invention provides for a unified method and system for logical connection of congestion with the appropriate flow control responses. The method and system utilizes congestion indicators within the ingress system, egress system, and the switch fabric in conjunction with a coarse adjustment system and fine adjustment system within the ingress device and the egress device to intelligently manage the system.

Jean Calvignac

Papers

Longest prefix match lookup using hash function

Method and system for performing a pattern match search for text strings

Network switch using network processor and methods

Network communications for operating system partitions

Method and system for managing congestion in a network