Systems, software, and methods for managing networks of connected electronic devices are described. In one example, network management policy and network management applications are downloaded automatically upon detection and identification of a new device on the network. In another example, information related to at least one aspect of the network is obtained by a network management device, and at least one applicable management policy is identified by the device; and the identified policy is used to manage at least one aspect of the network's operation.

Self configuring network management system

A network security device which acts as an “airlock” for traffic between a communications device and a network. Data is screened using rules based analysis by the security device to counter various threats, including viruses, phishing, attempts to “hijack” communications, communications with known malicious addresses or unknown addresses, and transmission of sensitive information. Data packets can be reassembled into files for screening, and decoded or expanded as necessary, but is never executed. The data path for the data being screened is kept separate from the operations of the network security device itself, so that the device is incorruptible—its programming cannot be compromised from outside sources. Updates for rules and entry of sensitive data for screening, etc., must be done through a physical interface, not via the normal data communications channel. The device is invisible—it cannot be “seen” by the network, and thus cannot be attacked.

Network Security Device

An electronic message is analyzed for malware contained in the message. Text of an electronic message may be analyzed to detect and process malware content in the electronic message itself. The present technology may analyze an electronic message and attachments to electronic messages to detect a uniform resource location (URL), identify whether the URL is suspicious, and analyze all suspicious URLs to determine if they are malware. The analysis may include re-playing the suspicious URL in a virtual environment which simulates the intended computing device to receive the electronic message. If the re-played URL is determined to be malicious, the malicious URL is added to a black list which is updated throughout the computer system.

Electronic message analysis for malware detection

A dynamic signature creation and enforcement system can comprise a tap configured to copy network data from a communication network, and a controller coupled to the tap. The controller is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if the network data is suspicious, flag the network data as suspicious based on the heuristic determination, simulate transmission of the network data to a destination device to identify unauthorized activity, generate an unauthorized activity signature based on the identification, and transmit the unauthorized activity signature to a digital device configured to enforce the unauthorized activity signature.

Dynamic signature creation and enforcement

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller coupled to the tap. The controller is coupled to the tap and is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to flag the network data as suspicious, and simulate transmission of the network data to a destination device.

Heuristic based capture with replay to virtual machine

A system for malicious code detection includes a front-end processor, multiple scanning computer systems, and a detection management system. During operation, the multiple scanning computer systems scan content for malicious code and generate an alarm when the content contains malicious code. The front-end processor receives a flow of content from an external network and distributes copies of the flow to each of the multiple scanning computer systems in parallel for scanning. The detection management system employs a countermeasure on the flow if at least one of the scanning computer systems generates the alarm.

System and method for malicious code detection

A network device used to provide network security includes an interface configured to receive data transmitted over a network. The network device also includes a firewall, intrusion detection logic and forwarding logic. The firewall, intrusion detection logic and forwarding logic process the received data to determine whether the data contains malicious content. When the data contains malicious content, the data may be dropped before it reaches a user device to which the received data was sent. Optionally, the network device may interact with an external device in order to make the forwarding decision. In addition, the network device may subscribe to services offered by the external device to receive updated security information.

Integrated security system

An approach for providing managed security services is disclosed. A database, within a server or a pre-existing anomalous event detection system, stores a rule set specifying a security policy for a network associated with a customer. An anomalous detection event module is deployed within a premise of the customer and retrieves rule sets from the database. The anomalous detection event module monitors a sub-network of the network based on the rule sets. The anomalous event detection module is further configured to self-organize by examining components of the network and to monitor for anomalous events according to the examined components, and to self-provision by selectively creating another instance of the anomalous detection event module to monitor another sub-network of the network.

Theresa E. Phillips

Papers

System and method for malicious code detection

Integrated security system

Secure self-organizing and self-provisioning anomalous event detection systems

Malicious Code: The Threat, Detection, And Protection