发明申请
WO2017048340A1 METHOD AND APPARATUS FOR DETECTING SECURITY ANOMALIES IN A PUBLIC CLOUD ENVIRONMENT USING NETWORK ACTIVITY MONITORING, APPLICATION PROFILING, AND SELF-BUILDING HOST MAPPING
审中-公开
基本信息:
- 专利标题： METHOD AND APPARATUS FOR DETECTING SECURITY ANOMALIES IN A PUBLIC CLOUD ENVIRONMENT USING NETWORK ACTIVITY MONITORING, APPLICATION PROFILING, AND SELF-BUILDING HOST MAPPING
- 专利标题（中）：使用网络活动监控，应用程序配置和自建主机映射来检测公共云环境中的安全异常的方法和装置
- 申请号：PCT/US2016/038301 申请日：2016-06-20
- 公开(公告)号：WO2017048340A1 公开(公告)日：2017-03-23
- 发明人： MOHANTY, Shubhabrata , IYER, Sudha
- 申请人： SYMANTEC CORPORATION
- 申请人地址： 350 Ellis Street Mountain View, California 94043 US
- 专利权人： SYMANTEC CORPORATION
- 当前专利权人： SYMANTEC CORPORATION
- 当前专利权人地址： 350 Ellis Street Mountain View, California 94043 US
- 代理机构： LEE, Jonathan
- 优先权： US14/854,658 20150915
- 主分类号： H04L29/06
- IPC分类号： H04L29/06 ; G06F21/55
摘要：
The disclosed computer-implemented method for detecting security anomalies in a public cloud environment using network activity monitoring, application profiling, and self-building host mapping may include (1) collecting host information that identifies (A) at least one communication channel that has previously facilitated communication between at least one host computing platform within a cloud computing environment and at least one additional computing platform and/or (B) at least one application that has previously run on the host computing platform, (2) monitoring network traffic involving the host computing platform, (3) detecting, while monitoring the network traffic, network activity that is inconsistent with the collected host information, and then (4) determining that the detected network activity represents a potential security threat within the cloud computing environment due at least in part to the detected network activity being inconsistent with the collected host information. Various other methods, systems, and computer-readable media are also disclosed.
摘要（中）：
用于使用网络活动监视，应用程序分析和自建主机映射来检测公共云环境中的安全异常的公开的计算机实现的方法可以包括（1）收集标识（A）先前具有至少一个通信信道的主机信息 促进云计算环境中的至少一个主机计算平台与至少一个附加计算平台之间的通信和/或（B）先前在主机计算平台上运行的至少一个应用程序，（2）监视涉及主机的网络流量 （3）在监测网络流量的同时，检测与收集到的主机信息不一致的网络活动，然后（4）确定检测到的网络活动代表云计算环境中的潜在安全威胁，至少在 检测到的网络活动的一部分与收集的主机信息不一致 灰。 还公开了各种其它方法，系统和计算机可读介质。