An electronic message is analyzed for malware contained in the message. Text of an electronic message may be analyzed to detect and process malware content in the electronic message itself. The present technology may analyze an electronic message and attachments to electronic messages to detect a uniform resource location (URL), identify whether the URL is suspicious, and analyze all suspicious URLs to determine if they are malware. The analysis may include re-playing the suspicious URL in a virtual environment which simulates the intended computing device to receive the electronic message. If the re-played URL is determined to be malicious, the malicious URL is added to a black list which is updated throughout the computer system.

Electronic message analysis for malware detection

A dynamic signature creation and enforcement system can comprise a tap configured to copy network data from a communication network, and a controller coupled to the tap. The controller is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if the network data is suspicious, flag the network data as suspicious based on the heuristic determination, simulate transmission of the network data to a destination device to identify unauthorized activity, generate an unauthorized activity signature based on the identification, and transmit the unauthorized activity signature to a digital device configured to enforce the unauthorized activity signature.

Dynamic signature creation and enforcement

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller coupled to the tap. The controller is coupled to the tap and is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to flag the network data as suspicious, and simulate transmission of the network data to a destination device.

Heuristic based capture with replay to virtual machine

A system and method are disclosed for network-based file analysis for malware detection. Network content is received from a network tap. A binary packet is identified in the network content. A binary file, including the binary packet, is extracted from the network content. It is determined whether the extracted binary file is detected to be malware.

Network-Based Binary File Extraction and Analysis for Malware Detection

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller coupled to the tap. The controller is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if the network data is suspicious, flag the network data as suspicious based on the heuristic determination, and concurrently simulate transmission of the network data to a plurality of destination devices.

Virtual machine with dynamic data flow analysis

Secure point to point network communications. Secure point to point network communications are accomplished by sending data across a secure link. Trusted partners at the link are matched to each other. To ensure that no un-trusted partners are on the link, authentication is performed. One of the points may be a secure tap. The secure tap authenticates a trusted partner by receiving a hardware embedded encryption key or value derived from the hardware embedded encryption key from the trusted partner. Data sent on the trusted link is encrypted to prevent interception of the data. The secure tap polices the link to ensure that no un-trusted are attached to the link and that the trusted partner is not removed from the link. If un-trusted partners are added to the link or trusted partners removed from the link, the secure tap ceases sending data.

Secure network access devices with data encryption

A bit error rate tester (100) for use in connection with a high speed networks. The bit error rate tester (100) includes transmit and receive ports (102, 104, 106 and 108), as well as a sequence generator (302), memory (112), synchronizer (322), sequence start detect module (326), and comparator (338). The sequence generator (302) generates a bit sequence for transmission through a network path. The bit sequence returns to the bit error rate tester (100) by way of the receive port (102, 104, 106 or 108). The synchronizer (322) then bit-aligns the received bit sequence to compensate for idles/fill words added/dropped as the bit sequence transited the network. The synchronized bit sequence is passed to the start word detector (326) which detects start and end words in the bit sequence and instructs the comparator (338) to compare only data between the start and end words. The comparator (338) compares the received bit sequence with a copy of the transmitted bit sequence regenerated from the memory (112), and calculates a bit error rate.

System and method for network error rate testing

A network tap device that is configured for operation in a copper Gigabit Ethernet communications network using a power-over-Ethernet (“POE”) electrical supply is disclosed. In one embodiment, a network tap device powered by a POE supply is disclosed, comprising first and second network ports that are configured with receptacles for receiving communication cables. The communication cables are configured to carry both data signals and the POE supply to and from the network tap device. The network tap device further includes first and second tap ports that connect with additional communication cables to a monitoring device. The network tap device also includes control and regulation circuitry that is configured to receive the POE supply from the communication cables via the network ports and to enable components of the network tap device to be operated by the POE supply.

Network tap device powered by power over ethernet

A synchronous network traffic processor that synchronously processes, analyzes and generates data for high-speed network protocols, on a wire-speed, word-by-word basis. The synchronous network processor is protocol independent and may be programmed to convert protocols on the fly. The synchronous network traffic processor includes a data compare unit (110) a data modify unit (120) an execution control unit (130) a peripheral unit (140), an input pipeline unit (150), an instruction memory (160) and a bank of general purpose registers (170). An embodiment of the synchronous network processor described has a low gate count and can be easily implemented using programmable logic. An appropriately programmed synchronous network traffic processor may replace modules traditionally implemented with hard-wired logic or ASIC.

Synchronous network traffic processor

A network tap device array capable of being powered by a power-over Ethernet (“POE”) supply is disclosed. The array enables data from multiple nodes in a communications network to be tapped and forwarded to a plurality of monitoring devices. In one embodiment the network tap device array includes a chassis that is configured to receive a plurality of network tap devices that are each powered by a POE supply. Each network tap device includes network ports for receiving and transmitting network data via communication cables and tap ports for forwarding the tapped network data to the monitoring device. In another embodiment, a sub-chassis includes a plurality of network tap devices and an aggregator that aggregates tapped data from each of the tap devices. The aggregator then forwards the aggregated data to the monitoring device. The sub-chassis can be included in a chassis that is configured to receive multiple populated chassis.

Paul R. Gentieu

Papers

Secure network access devices with data encryption

System and method for network error rate testing

Network tap device powered by power over ethernet

Synchronous network traffic processor

Network tap/aggregator configured for power over ethernet operation