JEFFREY WILLIAMS
Architects at 52 Ave, Seattle, WA

2008020, Aug 28, 2008

Feb 28, 2007

11/680324

Jeffrey S. Williams - Seattle WA, US
Ronald A. Franczyk - Kirkland WA, US
Tony Lee - Sammamish WA, US

MICROSOFT CORPORATION - Redmond WA

G06F 11/00

726 22

Methods for identifying potentially harmful, malicious, or unwanted content based upon associations with known offenders are provided. Executable content associated with a domain is identified. The executable content URL and the domain are compared to URLs/domains known to be associated with malicious content. If the URL and/or the domain has been identified as associated with offending code, the remaining domain contents and any available associated information are examined to identify any referencing domains, referenced domains, linking domains, affiliated entities, etc. Each identified domain, affiliate, etc. is subsequently examined in a similar manner to identify any domain, entity, etc. having an association with malicious content. Each identified domain, entity, etc. is assigned a suspicion level based upon proximity to the source of the offending code. If desired, relationships among the domains, entities, and the like may be relationally mapped to render associations easier to identify.

8024482, Sep 20, 2011

Feb 16, 2009

12/371638

Scott Hoogerwerf - Seattle WA, US
John E. Araya - Bellevue WA, US
Jeffrey S. Williams - Seattle WA, US

Microsoft Corporation - Redmond WA

G06F 15/16

709246, 709223, 726 11, 726 12

A method is disclosed that includes detecting a network entity and determining a type of the detected network entity. The method includes retrieving firewall configuration information based on at least the type of the network entity. Based on the firewall configuration information, a configuration of a firewall at a host is automatically and dynamically modified.

2008020, Aug 28, 2008

Feb 28, 2007

11/680136

Cormac E. Herley - Bellevue WA, US
Brian W. Keogh - Bellevue WA, US
Aaron Michael Hulett - Redmond WA, US
Adrian M. Marinescu - Sammamish WA, US
Stanislav Nurilov - Ft. Monmouth NJ, US
Jeffrey S. Williams - Seattle WA, US

MICROSOFT CORPORATION - Redmond WA

G06F 7/04

726 23

A system and method that facilitates and effectuates detection of malware secreted and/or hidden in plain sight on a machine. The system and method in order to achieve its aims generates a list of all loaded modules, identifies from the list a set of modules common to more than a threshold number of processes, and eliminates from the list those modules included in an authentication list. The resultant list is prioritized based, in one instance, on the number of occurrences a particular module makes in the resultant list, and thereafter the list is distributed analyst workstations.

2013030, Nov 14, 2013

Jul 12, 2013

13/941067

Arthur Zavalkovsky - Netanya, IL
Lior Arzi - Atlit, IL
Efim Hudis - Bellevue WA, US
Jennifer R. Lemond - Kirkland WA, US
Robert Eric Fitzgerald - Bellevue WA, US
Khaja E. Ahmed - Bellevue WA, US
Jeffrey S. Williams - Seattle WA, US
Edward W. Hardy - Seattle WA, US

MICROSOFT CORPORATION - Redmond WA

H04L 29/06

726 23

A network security system employing multiple levels of processing to identify security threats. Multiple host machines may each contain an agent that detects possibilities of security threats based on raw data sensed locally at that host. The hosts may share information obtained from local analysis and each host may use information generated at one or more other hosts, in combination with information generated locally, to identify a security concern, indicating with greater certainty that a security threat exists. Based on security concerns generated by multiple hosts, a security threat may be to indicated and protective action may be taken.