Randy Keith Jennings Deceased21336 Kings Guild Ln, Humble, TX 77339

8468602, Jun 18, 2013

Mar 8, 2010

12/719614

Monty D. McDougal - Plano TX, US
Brian N. Smith - Richardson TX, US
Keven K. Kalkbrenner - Dallas TX, US
Bradley T. Ford - Wylie TX, US
Randy S. Jennings - Plano TX, US
William E. Sterns - Wylie TX, US

Raytheon Company - Waltham MA

G06F 21/06
H04L 29/06

726 23, 726 22, 726 24, 726 25

According to one embodiment, a computer-implemented method includes: accessing a set of configuration parameters, accessing a set of identifiers of files known not to be malware, and accessing a set of identifiers of files known to be malware. Further, the method includes: comparing a first file to the set of configuration parameters, determining that a first hash of the first file is not in the set of identifiers of files known not to be malware and that the first hash is not in the set of identifiers of files known to be malware, and sending the at least one file and information related to the at least one file to be analyzed for malware. The method includes deleting the set of configuration parameters, the set of identifiers of files known not to be malware, and the set of identifiers of files known to be malware after sending the first file.

8635079, Jan 21, 2014

Jun 27, 2011

13/169503

Monty D. McDougal - St. Paul TX, US
William E. Sterns - Dallas TX, US
Randy S. Jennings - Plano TX, US

Raytheon Company - Waltham MA

G06Q 10/00
G06F 17/00
G06G 7/00

705 11, 705 711, 705400

In certain embodiments, a computer-implemented method includes accessing information related to a first file determined to satisfy at least one of a plurality of suspected malware conditions. A first of a number of manager consoles may access the information, each manager console being communicatively coupled to a respective network of a number of networks. A request may be generated for a determination of whether the first file comprises malware. The determination may be conducted at a master manager console. Data may be accessed indicating a result, outputted by the master manager console, of the determination of whether the first file comprises malware. A sharing policy may be accessed and used to determine whether the result is sharable with a second one of the manager consoles. If the result is sharable, a message comprising the result may be generated to be sent to the second manager console.

8635700, Jan 21, 2014

Dec 6, 2011

13/312716

Matthew Richard - Holden MA, US
Jesse J. Lee - Allen TX, US
Monty D. McDougal - St. Paul TX, US
Randy S. Jennings - Plano TX, US
William E. Sterns - Dallas TX, US

Raytheon Company - Waltham MA

G06F 15/18
G06F 11/00

726 24, 726 22, 726 23, 726 25, 726 26, 726 1, 713187, 713188, 713191, 707690, 709203, 709225, 709226, 717168, 370474

In one embodiment, a method includes identifying a plurality of portions of a file and comparing the plurality of portions of the file to a plurality of stored patterns. The plurality of stored patterns include portions of known malware. The method also includes determining, from the plurality of portions of the file and based on the comparing of the plurality of portions of the file to the plurality of stored patterns, a set of matching portions. The set of matching portions include one or more of the plurality of portions of the file. In addition, the method includes determining a score for each portion in the set of matching portions and providing information regarding the set of matching portions. The information includes the scores determined for each portion of the set of matching portions.

8640246, Jan 28, 2014

Jun 27, 2011

13/169574

Monty D. McDougal - St. Paul TX, US
William E. Sterns - Dallas TX, US
Randy S. Jennings - Plano TX, US

Raytheon Company - Waltham MA

G06F 21/00
G06F 11/00
G06F 21/57
G06F 21/56

726 25, 726 24

According to one embodiment, a computer-implemented method includes accessing, using one or more processing units, a first file of a plurality of files requested to be analyzed for malware. Each of the plurality of files corresponds to a respective remote client of a plurality of remote clients. Further, the method includes: processing, using the one or more processing units, an analysis of the first file for malware; and generating an output comprising an indication of whether the first file comprises malware. The method also includes accessing, using the one or more processing units, an address for a first remote client of the plurality of remote clients. The first remote client is the respective remote client corresponding to the first file. In addition, the method includes: sending, using the one or more processing units, the output in a communication addressed to the first remote client corresponding to the first file.

2011021, Sep 8, 2011

Mar 8, 2010

12/719535

Monty D. McDougal - Plano TX, US
Randy S. Jennings - Plano TX, US
Jeffrey C. Brown - Carlisle MA, US
Jesse J. Lee - Allen TX, US
Brian N. Smith - Richardson TX, US
Darin J. De Rita - Coppell TX, US
Kevin L. Cariker - Rockwall TX, US
William E. Sterns - Wylie TX, US
Michael K. Daly - Sharon MA, US

Raytheon Company - Waltham MA

G06F 11/00
G06F 21/00

726 23

According to one embodiment, a computer-implemented method for execution on one or more processors includes receiving a first file and determining a file type of the first file. The method also includes determining, according to a first policy, a plurality of malware detection schemes to apply to the first file based on the determined file type of the first file. In addition, the method includes scheduling the application of the determined plurality of malware detection schemes to the first file amongst a plurality of detection nodes according to a second policy. Further, the method includes determining, in response to determining the results of applying the plurality of malware detection schemes, that the first file is malware or determining that the first file is suspected malware according to a third policy.

2012021, Aug 23, 2012

Feb 22, 2011

13/031948

Monty D. McDougal - St. Paul TX, US
Randy S. Jennings - Plano TX, US
William E. Sterns - Wylie TX, US

Raytheon Company - Waltham MA

G06F 21/00

713183

In accordance with particular embodiments, a computer-implemented method for execution by one or more processors includes intercepting a communication comprising a message. The method also includes identifying words from within the message. The method further includes storing in a dictionary words from within the message of the communication and one or more parameters of the communication for each of the words. The dictionary comprises a plurality of words from a plurality of intercepted text-based communications. The method also includes receiving an encrypted file that is configured to be decrypted using a password. The method additionally includes identifying words from the dictionary to be used to attempt to decrypt the encrypted file. The identified words are identified based on at least one parameter associated with the encrypted file and the one or more parameters stored in the dictionary. The method further includes attempting to decrypt the encrypted file using at least a portion of the identified words from the dictionary as the password for decrypting the encrypted attachment.

2012026, Oct 18, 2012

Apr 15, 2011

13/087447

Monty D. McDougal - St. Paul TX, US
William E. Sterns - Wylie TX, US
Randy S. Jennings - Plano TX, US
Jesse J. Lee - Allen TX, US
Darin J. DeRita - Coppell TX, US

Raytheon Company - Waltham MA

G06F 21/00

726 24

A computer-implemented method includes accessing, by an analysis console, information related to a first file received at a first host of a plurality of hosts. Each host is capable of running a corresponding set of malware detection processes. The information includes: an identifier of the first file; and data indicating a first result of the first host applying the set of malware detection processes to the first file. The identifier is generated by the first host and is usable by each of the hosts to determine whether a second file comprises content substantially equivalent to content of the first file. The analysis console generates a first output including: the identifier of the first file; and a second result indicating whether the first file comprises malware. The second result is usable by each of the hosts to determine whether the second file comprises malware. The first output is propagated to the hosts.

2013008, Mar 28, 2013

Sep 22, 2011

13/240567

Monty D. McDougal - St. Paul TX, US
William E. Sterns - Dallas TX, US
Randy S. Jennings - Plano TX, US

Raytheon Company - Waltham MA

G06F 21/00

726 24

In accordance with particular embodiments, a method includes intercepting a communication and extracting metadata associated with the communication. The extracted metadata comprises a plurality of different fields from communication metadata and file metadata. The method further includes determining a score, based on previous communications, for each field of the extracted metadata. The score is indicative of a likelihood that the communication is a malicious communication. The method additionally includes combining the scores to generate a combined score for the communication based on an algorithm developed from the previous communications. The method also includes generating, based on the combined score at a first time, a predicted classification as to whether the communication is a malicious communication. The method further includes receiving, at a second time subsequent to the first time, an indication of whether the communication is a malicious communication and updating the algorithm based on the indication.