In one embodiment a method for probabilistically quantifying a degree of relevance between two or more citationally or contextually related data objects, such as patent documents, non-patent documents, web pages, personal and corporate contacts information, product information, consumer to behavior, technical or scientific information, address information, and the like is provided. In another embodiment a method for visualizing and displaying relevance between two or more citationally or contextually related data objects is provided. In another embodiment a search input/output interface that utilizes an iterative self-organizing mapping technique to automatically generate a visual map of relevant patents and/or other related documents desired to be explored, searched or analyzed is provided. In another embodiment, a search input/output interface that displays and/or communicates search input criteria and corresponding search results in a way that facilitates intuitive understanding and visualization of the logical relationships between two or more related concepts being searched is provided.

Method and system for probabilistically quantifying and visualizing relevance between two or more citationally or contextually related data objects

In embodiments of the present invention improved capabilities are described for the steps of identifying a functional code block that performs a particular function within executable code; transforming the functional code block into a generic code representation of its functionality by tokenizing, refactoring, or the like, the functional code block; comparing the generic code representation with a previously characterized malicious code representation; and in response to a positive correlation from the comparison, identifying the executable code as containing malicious code.

Method and system for classification of software using characteristics and combinations of such characteristics

A system and method for smart, persistent cache management of received content within a terminal. Received content is tagged with cache directive allowing cache control to determine which of cache storage locations to use for storage of content. Cache control detects the number of instances that received content correlates to a newer version of purged content and provides the ability to re-classify cache persistence directive based upon the number of instances.

System and method for smart persistent cache

A system and method for facilitating the invalidation of cached data, in which the data to be invalidated are identified using information other than a primary key. The primary key for a cached data object, such as a web page, may be a Uniform Resource Locator (URL). Instead of using an object's URL to identify to a cache the data to be invalidated, a secondary key is used, such as the object's data source or a template from which the object was created. An application communicates the secondary key to a cache, and the cache identifies cached objects that match the secondary key. Those data objects are then invalidated without having to issue multiple invalidation messages from the application.

Invalidating cached data using secondary keys

Under the present invention, a request for a Uniform Resource Locator (URL) is received from a client on a server. Upon receipt, a corresponding session object is obtained, and a response identifier is generated. Based on the response identifier, it is determined whether the URL was previously requested by the client. If not, generation of a final response begins. As the response is being generated, a response refresh header is generated and returned to the client with a temporary response. The response refresh header contains a time value for causing the client to automatically send a subsequent request for the URL. After generation of the final response is complete, it is stored in a cache according to the response identifier. Then, when the subsequent request is received from the client, the final response is retrieved from the cache and served to the client.

Method, system and program product for asynchronously processing requests

A streaming media caching mechanism and cache manager efficiently establish and maintain the contents of a streaming media cache for use in serving streaming media requests from cache rather than from an original data source when appropriate. The cost of caching is incurred only when the benefits of caching are likely to be experienced. The caching mechanism and cache manager evaluate the request count for each requested URL to determine whether the URL represents a cache candidate, and further analyze the URL request rate to determine whether the content associated with the URL will be cached. In an embodiment, the streaming media cache is maintained with a predetermined amount of reserve capacity rather than being filled to capacity whenever possible.

Caching techniques for streaming media

A security flag stored in a trusted store is utilized to determine if the trusted store has been subjected to tampering The security flag is indicative of a globally unique identifier (GUID), the version of the trusted store, and a counter The security flag is created when the trusted store is created Each time a critical event occurs, the security flag is updated to indicate the occurrence thereof The security flag also is stored in a write-once portion of the system registry At appropriate times, the security flag stored in the trusted store is compared with the corresponding security flag stored in the write-once registry If the security flags match within a predetermined tolerance, it is determined that the trusted store has not been subjected to tampering If the security flags do not match, or if a security flag is missing, it is determined that the trusted store has been subjected to tampering

Trusted store tamper detection

Described is a technology by which a signature used by network traffic intrusion prevention/detection systems includes logic that helps a prevention/detection engine detect that signature. A signature to detect is compiled into executable logic that is executed to communicate with an engine that evaluates network traffic. The signature logic provides an expression set (such as group of regular expressions) for the engine to match against a token corresponding to the network traffic. When matched, the engine notifies the logic and receives a further expression set to match, or a communication indicative that that the signature was detected. The signature thus directs the analysis, facilitating a lightweight, generic engine. Safety of the signature logic is described as being accomplished through layers, including by publisher signing, and by compilation and execution (e.g., interpretation) in safe environments.

Yifat Sagiv

Papers

Caching techniques for streaming media

Trusted store tamper detection

Safe code for signature updates in an intrusion prevention system