REAL-TIME PREVENTION OF MALICIOUS CONTENT VIA DYNAMIC ANALYSIS

    公开(公告)号:US20250030708A1

    公开(公告)日:2025-01-23

    申请号:US18795848

    申请日:2024-08-06

    Applicant: SONICWALL INC.

    Abstract: This disclosure is related to methods and apparatus used to for preventing malicious content from reaching a destination via a dynamic analysis engine may operate in real-time when packetized data is received. Data packets sent from a source computer may be received and be forwarded to an analysis computer that may monitor actions performed by executable program code included within the set of data packets when making determinations regarding whether the data packet set should be classified as malware. In certain instances all but a last data packet of the data packet set may also be sent to the destination computer while the analysis computer executes and monitors the program code included in the data packet set. In instances when the analysis computer identifies that the data packet set does include malware, the malware may be blocked from reaching the destination computer by not sending the last data packet to the destination computer.

    DYNAMIC BYPASS
    2.
    发明申请

    公开(公告)号:US20240422149A1

    公开(公告)日:2024-12-19

    申请号:US18816546

    申请日:2024-08-27

    Applicant: SonicWALL Inc.

    Abstract: Methods and apparatus consistent with the present disclosure may prevent a computer process from failing when a firewall located between a client device and a server identifies that a process at the firewall should be bypassed using fingerprint information associated with a connection attempt. When fingerprint information stored at a firewall matches previously received fingerprint information, the firewall may allow processes typically performed at the firewall to be bypassed, thereby, allowing communications to pass between the client device and the server without inspection. When that fingerprint information does not match previously received fingerprint information, the firewall may perform a process that causes the client device to fail the first connection attempt. Because of this, methods consistent with the present disclosure may allow communications from an application program to be passed through a firewall without relying on an ever growing list of trusted application programs.

    Method for providing an elastic content filtering security service in a mesh network

    公开(公告)号:US12170900B2

    公开(公告)日:2024-12-17

    申请号:US18384103

    申请日:2023-10-26

    Applicant: SONICWALL INC.

    Inventor: Zhuangzhi Duo

    Abstract: The present disclosure is directed to distributing processing capabilities throughout different nodes in a wireless mesh network. Methods and apparatus consistent with the present disclosure increase the efficiency of communications in a wireless mesh network because they help minimize the need to forward communications to other nodes in the wireless mesh network such that an evaluation can be performed. Apparatus and methods consistent with the present disclosure may distribute ratings or verdicts associated with previous requests to access data to different nodes in a wireless mesh network without generating additional wireless communications through the wireless mesh network. Apparatus and methods consistent with the present disclosure distribute content ratings to different nodes in a wireless network such that different wireless nodes may block redundant requests to undesired content without increasing messaging traffic.

    Real-time prevention of malicious content via dynamic analysis

    公开(公告)号:US12058154B2

    公开(公告)日:2024-08-06

    申请号:US17949796

    申请日:2022-09-21

    Applicant: SONICWALL INC.

    Abstract: This disclosure is related to methods and apparatus used to for preventing malicious content from reaching a destination via a dynamic analysis engine may operate in real-time when packetized data is received. Data packets sent from a source computer may be received and be forwarded to an analysis computer that may monitor actions performed by executable program code included within the set of data packets when making determinations regarding whether the data packet set should be classified as malware. In certain instances all but a last data packet of the data packet set may also be sent to the destination computer while the analysis computer executes and monitors the program code included in the data packet set. In instances when the analysis computer identifies that the data packet set does include malware, the malware may be blocked from reaching the destination computer by not sending the last data packet to the destination computer.

    CLOUD BASED JUST IN TIME MEMORY ANALYSIS FOR MALWARE DETECTION

    公开(公告)号:US20240012907A1

    公开(公告)日:2024-01-11

    申请号:US18369926

    申请日:2023-09-19

    Applicant: SONICWALL INC.

    CPC classification number: G06F21/566 G06F21/53 G06F21/561

    Abstract: Methods and apparatus consistent with the present disclosure may be performed by a Cloud computing device may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into, may perform deep packet inspection (DPI) on computer data, or identify a content rating associated with computer data. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows one or more processors executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware can be detected using exception handling to track memory allocations of the program code included in the received data set. Furthermore, access to content associated with malware, potential malware, or with inappropriate content ratings may be blocked.

    Detection of exploitative program code

    公开(公告)号:US11550912B2

    公开(公告)日:2023-01-10

    申请号:US16903060

    申请日:2020-06-16

    Applicant: SONICWALL INC.

    Abstract: The present disclosure is directed to monitoring internal process memory of a computer at a time with program code executes. Methods and apparatus consistent with the present disclosure monitor the operation of program code with the intent of detecting whether received program inputs may exploit vulnerabilities that may exist in the program code at runtime. By detecting suspicious activity or malicious code that may affect internal process memory at run-time, methods and apparatus described herein identify suspected malware based on suspicious actions performed as program code executes. Runtime exploit detection may detect certain anomalous activities or chain of events in a potentially vulnerable application during execution. These events may be detected using instrumentation code when a regular code execution path of an application is deviated from.

    METHOD OF CREATING HIGH AVAILABILITY FOR SINGLE POINT NETWORK GATEWAY USING CONTAINERS

    公开(公告)号:US20210397473A1

    公开(公告)日:2021-12-23

    申请号:US17350243

    申请日:2021-06-17

    Applicant: SONICWALL INC.

    Abstract: Methods and apparatus consistent with the present disclosure may be used in environments where multiple different virtual sets of program instructions are executed by shared computing resources when different processes are performed in a virtual computing environment. Methods consistent with the present disclosure may be used to provide a form of redundancy that does not require two physically distinct computers. Such methods may use a set of physical hardware components and two or more sets of synchronized virtual gateway software. Architectural features of physical hardware components included in an apparatus consistent with the present disclosure may be abstracted from sets of virtual program code when one virtual software process backs up another virtual software process at the apparatus.

    Just in time memory analysis for malware detection

    公开(公告)号:US10902122B2

    公开(公告)日:2021-01-26

    申请号:US15890192

    申请日:2018-02-06

    Applicant: SonicWALL Inc.

    Abstract: Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows one or more processors executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware can be detected using exception handling to track memory allocations of the program code included in the received data set.

    Reducing transmission pathway lengths within a distributed network

    公开(公告)号:US10681188B2

    公开(公告)日:2020-06-09

    申请号:US15690642

    申请日:2017-08-30

    Inventor: Samuel Liddicott

    Abstract: A solution for reducing transmission pathway lengths within a distributed network, as embodied in various systems, methods, and non-transitory computer-readable storage media, may include migrating a TCP socket from a request server to a data server. The solution may further include reprogramming one or more routers to recognize a new packet route based on the migrated socket. The solution may include the one or more routers subsequently communicating directly with the data server while bypassing the request server.

Patent Agency Ranking