Adam Todd Bromwich

US Patent:

7774361, Aug 10, 2010

Filed:

Jul 8, 2005

Appl. No.:

11/177775

Inventors:

Carey Nachenberg - Northridge CA, US
Abu Wawda - Los Angeles CA, US
Adam Bromwich - Santa Monica CA, US
On Lee - Redmond WA, US
Darren Sanders - Santa Clarita CA, US

Assignee:

Symantec Corporation - Cupertino CA

International Classification:

G06F 7/00

US Classification:

707779, 707952, 726 23

Abstract:

An incident managing module aggregates related database intrusion incidents and presents them in a manageable manner. A receiving module receives an anomalous query requesting data from a database and a type-identification module identifies anomaly type for the query received. A conversion module converts the anomalous query into a characteristic representation. In some embodiments, this is done by replacing literal field values in the query with representative values. In other embodiments, this is done by creating a tuple describing anomaly parameters for the anomalous query. In still other embodiments, the query is converted into a characteristic representation that distinguishes between injected and non-injected portions of the query. An aggregation module then aggregates into a group the anomalous queries with substantially similar characteristic representations according to anomaly type and a generation module generates a database intrusion incident report describing the group of anomalous queries.

US Patent:

8190611, May 29, 2012

Filed:

Sep 28, 2007

Appl. No.:

11/864307

Inventors:

Carey S. Nachenberg - Northridge CA, US
Adam Bromwich - Santa Monica CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 7/00
G06F 17/30

US Classification:

707737

Abstract:

A categorization server is coupled to multiple clients via a network. Each client has a security module that monitors web browsing performed on the client and reports a web site browsing stream to the categorization server. The categorization server identifies a site from the browsing stream of a client that is of a known category. The categorization server uses content-temporal locality to determine whether other sites in the browsing stream belong to the same category as the site having the known category. This determination can be performed by assigning probabilities to other sites in the browsing stream, and by considering probabilities assigned to sites in browsing streams of other clients. The categorization server provides categories of sites to the clients, and the client security modules can implement category-based security policies.

US Patent:

8356352, Jan 15, 2013

Filed:

Jun 16, 2008

Appl. No.:

12/140137

Inventors:

Abubakar Wawda - Los Angeles CA, US
Gerry A. Egan - Santa Monica CA, US
Adam Bromwich - Santa Monica CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 11/00

US Classification:

726 22, 726 23, 726 24

Abstract:

User-generated web content is received prior to posting by a client system, such as a web content hosting system. The user-generated web content is executed in a virtual environment and monitored for malicious behavior. Execution of the web content in the virtual environment forces code in the web content to run such that the actions the code takes, especially malicious behavior, are not obfuscated. If malicious behavior is detected, the user-generated web content is blocked from posting to the web content hosting system. Alternatively, when malicious behavior is not detected, the user-generated web content is permitted to be posted to the web content hosting system.

US Patent:

8046374, Oct 25, 2011

Filed:

May 6, 2005

Appl. No.:

11/124461

Inventors:

Adam Bromwich - Santa Monica CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 17/30
G06F 15/16

US Classification:

707759, 707781, 707952, 726 23

Abstract:

A database intrusion detection system (DIDS) automatically trains itself to account for changes to the database. The DIDS monitors upstream queries sent to the database and downstream data provided in response to the queries. The DIDS classifies an upstream query as legitimate or anomalous. If the query is anomalous, the DIDS determines whether the anomaly resulted from a change in the database by performing one or more tests. One test determines whether the query references new fields or tables. Another test determines the frequency at which the query is received, and/or whether the query is received from multiple sources. A third test determines whether the query accesses sensitive information. Together, the results of these tests describe whether the query should be classified as anomalous or legitimate.

US Patent:

7558796, Jul 7, 2009

Filed:

May 19, 2005

Appl. No.:

11/133498

Inventors:

Adam Bromwich - Santa Monica CA, US
Jeffrey Wilhelm - Los Angeles CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 17/30

US Classification:

707 10, 707 6, 726 12, 726 23

Abstract:

A database intrusion detection system (DIDS) monitors database queries to detect anomalous queries that might by symptomatic of a code injection attack on the database. A proxy server intercepts HTTP messages from clients that contain query data used to generate database queries. The proxy server extracts the query data from a message and determines origin data describing the origin of the message, such as the IP address of the client that sent the message. The proxy server stores the query and origin data in a cache. Upon detecting an anomalous query, the DIDS extracts a portion of the query, such as the literals. The DIDS searches the cache to identify entries having query data that match the extracted portions of the query. The DIDS reports the origin data of the matching cache entries.