John R Flowers

US Patent:

6957348, Oct 18, 2005

Filed:

Jan 10, 2001

Appl. No.:

09/757963

Inventors:

John S. Flowers - Emeryville CA, US
Thomas C. Stracener - Emeryville CA, US

Assignee:

nCircle Network Security, Inc. - San Francisco CA

International Classification:

G06F011/30

US Classification:

713201, 713200, 713202, 709223, 709224, 370229, 370230, 370241, 370254, 370255

Abstract:

A system in accordance with an embodiment of the invention includes a vulnerability detection system (VDS) and an intrusion detection system (IDS). The intrusion detection system leverages off of information gathered about a network, such as vulnerabilities, so that it only examines and alerts the user to potential intrusions that could actually affect the particular network. In addition both the VDS and IDS use rules in performing their respective analyses that are query-based and that are easy to construct. In particular these rules are based on a set of templates, which represent various entities or processes on the network.

US Patent:

7073198, Jul 4, 2006

Filed:

Aug 25, 2000

Appl. No.:

09/648211

Inventors:

John S. Flowers - Berkeley CA, US
Thomas C. Stracener - Berkeley CA, US

Assignee:

nCircle Network Security, Inc. - San Francisco CA

International Classification:

G06F 11/30

US Classification:

726 25, 726 23, 726 34, 713151

Abstract:

A system and method in accordance with the invention reliably and non-intrusively identifies various conditions of a network. In particular, an embodiment of the invention can identify an operating system, including version and patch level, and a service, including version and patch level, of a remote host on the network. Using this information, an embodiment of the invention can then reliably identify a vulnerability condition of the network. In some embodiments, the operating system and service information can be used to identify a trojan application, unlicensed software use, security policy violations, or even infer vulnerabilities that are yet unknown.

US Patent:

7162742, Jan 9, 2007

Filed:

Nov 12, 2004

Appl. No.:

10/987988

Inventors:

John S. Flowers - Emeryville CA, US
Thomas C. Stracener - Emeryville CA, US

Assignee:

nCircle Network Security, Inc. - San Francisco CA

International Classification:

G06F 15/18

US Classification:

726 25, 726 23

Abstract:

A system in accordance with an embodiment of the invention includes a vulnerability detection system (VDS) and an intrusion detection system (IDS). The intrusion detection system leverages off of information gathered about a network, such as vulnerabilities, so that it only examines and alerts the user to potential intrusions that could actually affect the particular network. In addition both the VDS and IDS use rules in performing their respective analyses that are query-based and that are easy to construct. In particular these rules are based on a set of templates, which represent various entities or processes on the network.

US Patent:

7181769, Feb 20, 2007

Filed:

Jun 6, 2003

Appl. No.:

10/456837

Inventors:

Timothy D. Keanini - Novato CA, US
Martin A. Quiroga - San Francisco CA, US
Brian W. Buchanan - San Leandro CA, US
John S. Flowers - Mission KS, US

Assignee:

nCircle Network Security, Inc. - San Francisco CA

International Classification:

G06F 12/14
H04L 9/00

US Classification:

726 23, 726 25, 713166

Abstract:

A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attach signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.

US Patent:

7509681, Mar 24, 2009

Filed:

Jan 8, 2007

Appl. No.:

11/621027

Inventors:

John S. Flowers - Emeryville CA, US
Thomas C. Stracener - Emeryville CA, US

Assignee:

nCircle Network Security, Inc. - San Francisco CA

International Classification:

G06F 12/14
G06F 15/16
G06F 7/04
H04L 9/00

US Classification:

726 25, 726 3, 726 14, 726 23, 726 27, 713151, 713166, 713168, 713189

Abstract:

A system in accordance with an embodiment of the invention includes a vulnerability detection system (VDS) and an intrusion detection system (IDS). The intrusion detection system leverages off of information gathered about a network, such as vulnerabilities, so that it only examines and alerts the user to potential intrusions that could actually affect the particular network. In addition, both the VDS and IDS may use rules in performing their respective analyses that are query-based and that are easy to construct. In particular, these rules may be based on a set of templates, which represent various entities or processes on the network.

US Patent:

7594273, Sep 22, 2009

Filed:

Feb 16, 2007

Appl. No.:

11/676051

Inventors:

Timothy D. Keanini - Novato CA, US
Martin A. Quiroga - San Francisco CA, US
Brian W. Buchanan - San Leandro CA, US
John S. Flowers - Mission KS, US

Assignee:

nCircle Network Security, Inc. - San Francisco CA

International Classification:

G06F 15/18
G08B 23/00
G06F 15/16
H04L 29/06
H04L 9/32
G06F 11/30
G06F 15/173
G06F 11/00

US Classification:

726 25, 726 3, 726 23, 713151, 713153, 713166, 713177, 713188, 709224, 714 4, 714 47, 714 48

Abstract:

A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attack signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.

US Patent:

8020211, Sep 13, 2011

Filed:

Sep 1, 2009

Appl. No.:

12/552264

Inventors:

Timothy D. Keanini - Novato CA, US
Martin A. Quiroga - San Francisco CA, US
Brian W. Buchanan - San Leandro CA, US
John S. Flowers - Mission KS, US

Assignee:

nCircle Network Security, Inc. - San Francisco CA

International Classification:

G08B 23/00
G06F 15/16
G06F 12/14
G06F 11/30
G06F 15/173
G06F 11/00
H04L 29/06
H04L 9/32

US Classification:

726 25, 726 3, 726 23, 713151, 713153, 713166, 713177, 713188, 709224, 714 41, 714 471, 714 48

Abstract:

A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attack signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.

US Patent:

8347391, Jan 1, 2013

Filed:

May 23, 2012

Appl. No.:

13/479222

Inventors:

John S. Flowers - San Francisco CA, US

Assignee:

TrustPipe LLC - Healdsburg CA

International Classification:

G06F 12/14

US Classification:

726 24

Abstract:

A network activity detection system is trained to detect network activities of interest such as threats by malicious computer data. The training involves distilling the characteristics of known network activities of interest (e. g. , intrusion by computer viruses, exploits, worms, or the like) into a minimal set of meta-expressions. At run-time, the network activity detection system combines the minimal set of meta-expressions with efficient computer algorithms for evaluating meta-expressions to detect known network activities of interest, as well as their unknown variants, among an unknown set of network activity. The network activity detection system may produce appropriate responses upon the detection of network activities of interest.