专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

101. 发明申请

US20110214161A1 METHODS, MEDIA, AND SYSTEMS FOR SECURING COMMUNICATIONS BETWEEN A FIRST NODE AND A SECOND NODE 有权
标题翻译：用于保护第一个节点和第二个节点之间的通信的方法，媒体和系统
公开(公告)号：US20110214161A1
公开(公告)日：2011-09-01
申请号：US12092224
申请日：2006-10-31
申请人： Salvatore J. Stolfo , Gabriela F. Ciocarlie , Vanessa Frias-Martinez , Janak Parekh , Angelos D. Keromytis , Joseph Sherrick
发明人： Salvatore J. Stolfo , Gabriela F. Ciocarlie , Vanessa Frias-Martinez , Janak Parekh , Angelos D. Keromytis , Joseph Sherrick
IPC分类号： G06F21/20
CPC分类号： H04L63/102 , H04L63/145
摘要： Methods, media, and systems for securing communications between a first node and a second node are provided. In some embodiments, methods for securing communication between a first node and a second node are provided. The methods comprising: receiving at least one model of behavior of the second node at the first node; and authorizing the first node to receive traffic from the second node based on the difference between the at least one model of behavior of the second node and at least one model of behavior of the first node.
摘要翻译：提供了用于保护第一节点和第二节点之间的通信的方法，媒体和系统。在一些实施例中，提供了用于确保第一节点和第二节点之间的通信的方法。所述方法包括：在所述第一节点处接收所述第二节点的至少一个行为模型; 并且基于所述第二节点的所述至少一个行为模型与所述第一节点的行为的至少一个模型之间的差异，授权所述第一节点从所述第二节点接收流量。

102. 发明申请

US20100281542A1 Systems and Methods for Correlating and Distributing Intrusion Alert Information Among Collaborating Computer Systems 有权
标题翻译：在协作计算机系统中关联和分发入侵警报信息的系统和方法
公开(公告)号：US20100281542A1
公开(公告)日：2010-11-04
申请号：US12837302
申请日：2010-07-15
申请人： Salvatore J. Stolfo , Angelos D. Keromytis , Vishal Misra , Michael E. Locasto , Janak Parekh
发明人： Salvatore J. Stolfo , Angelos D. Keromytis , Vishal Misra , Michael E. Locasto , Janak Parekh
IPC分类号： G06F11/00 , G06F15/16
CPC分类号： H04L63/1408
摘要： Systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed without generating excess traffic loads.
摘要翻译：系统和方法提供警报相关器和警报分发器，其能够检测到攻击的早期迹象并且迅速地传播到协作系统。警报相关器利用数据结构来关联警报检测，并提供可以向其他协作系统透露威胁信息的机制。警报分配器使用有效的技术来对协作系统进行分组，然后根据时间表在某些成员之间传递数据。以这种方式，数据可以定期分布，而不会产生过多的流量负载。

103. 发明授权

US07784097B1 Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems 有权
标题翻译：在协作计算机系统之间关联和分发入侵警报信息的系统和方法
公开(公告)号：US07784097B1
公开(公告)日：2010-08-24
申请号：US10996574
申请日：2004-11-24
申请人： Salvatore J. Stolfo , Angelos D. Keromytis , Vishal Misra , Michael E. Locasto , Janak Parekh
发明人： Salvatore J. Stolfo , Angelos D. Keromytis , Vishal Misra , Michael E. Locasto , Janak Parekh
IPC分类号： G06F11/00 , G06F12/14 , G06F12/16 , G06F11/30 , G06F15/16 , G06F15/177 , G08B23/00 , B41K3/38
CPC分类号： H04L63/1408
摘要： Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems are provided. These systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed without generating excess traffic loads.
摘要翻译：提供了在协作计算机系统之间关联和分发入侵警报信息的系统和方法。这些系统和方法提供警报相关器和警报分发器，其使得能够检测到攻击的早期迹象并且迅速地传播到协作系统。警报相关器利用数据结构来关联警报检测，并提供可以向其他协作系统透露威胁信息的机制。警报分配器使用有效的技术来对协作系统进行分组，然后根据时间表在某些成员之间传递数据。以这种方式，数据可以定期分布，而不会产生过多的流量负载。

104. 发明申请

US20100153785A1 METHODS, MEDIA, AND SYSTEMS FOR DETECTING AN ANOMALOUS SEQUENCE OF FUNCTION CALLS 有权
标题翻译：用于检测功能调用异常序列的方法，媒体和系统
公开(公告)号：US20100153785A1
公开(公告)日：2010-06-17
申请号：US12447946
申请日：2007-10-30
申请人： Angelos D. Keromytis , Salvatore J. Stolfo
发明人： Angelos D. Keromytis , Salvatore J. Stolfo
IPC分类号： G06F11/07 , G06F9/44
CPC分类号： G06F21/566 , G06F11/08 , G06F11/3688 , G06F2221/033 , G06N7/005 , H04L63/1425
摘要： Methods, media, and systems for detecting an anomalous sequence of function calls are provided. The methods can include compressing a sequence of function calls made by the execution of a program using a compression model; and determining the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed. The methods can further include executing at least one known program; observing at least one sequence of function calls made by the execution of the at least one known program; assigning each type of function call in the at least one sequence of function calls made by the at least one known program a unique identifier; and creating at least part of the compression model by recording at least one sequence of unique identifiers.
摘要翻译：提供了用于检测函数调用异常序列的方法，介质和系统。该方法可以包括通过使用压缩模型来压缩由程序执行所产生的函数调用序列; 以及基于函数调用序列被压缩的程度来确定功能调用序列中函数调用的异常序列的存在。所述方法还可以包括执行至少一个已知程序; 观察由所述至少一个已知节目的执行而进行的至少一个函数调用序列; 在由所述至少一个已知程序进行的所述至少一个功能调用序列中分配每种类型的功能调用唯一标识符; 以及通过记录至少一个唯一标识符序列来创建所述压缩模型的至少一部分。

105. 发明授权

US07639714B2 Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data 有权
标题翻译：使用正常数据的n-gram分布检测有效载荷异常的装置方法和介质
公开(公告)号：US07639714B2
公开(公告)日：2009-12-29
申请号：US10986447
申请日：2004-11-12
申请人： Salvatore J. Stolfo , Ke Wang
发明人： Salvatore J. Stolfo , Ke Wang
IPC分类号： H04J3/24 , G06F9/00
CPC分类号： H04L63/1425 , G06F21/55 , G06F21/552 , G06F21/554 , G06F21/56 , G06F21/562 , G06F21/563 , G06F21/564 , H04L43/00 , H04L43/0876 , H04L63/0218 , H04L63/0245 , H04L63/0263 , H04L63/029 , H04L63/145
摘要： A method, apparatus and medium are provided for detecting anomalous payloads transmitted through a network. The system receives payloads within the network and determines a length for data contained in each payload. A statistical distribution is generated for data contained in each payload received within the network, and compared to a selected model distribution representative of normal payloads transmitted through the network. The model payload can be selected such that it has a predetermined length range that encompasses the length for data contained in the received payload. Anomalous payloads are then identified based on differences detected between the statistical distribution of received payloads and the model distribution. The system can also provide for automatic training and incremental updating of models.
摘要翻译：提供了一种用于检测通过网络发送的异常有效载荷的方法，装置和介质。系统在网络内接收有效载荷并确定每个载荷中包含的数据的长度。为包含在网络中接收的每个有效载荷中的数据生成统计分布，并与代表通过网络传输的正常有效载荷的所选模型分布进行比较。可以选择模型有效载荷，使得其具有预定的长度范围，其包含包含在接收到的有效载荷中的数据的长度。然后根据接收到的有效载荷的统计分布和模型分布之间检测到的差异来识别异常有效载荷。该系统还可以提供模型的自动训练和增量更新。

106. 发明申请

US20090222922A1 SYSTEMS, METHODS, AND MEDIA PROTECTING A DIGITAL DATA PROCESSING DEVICE FROM ATTACK 有权
标题翻译：系统，方法和媒体从攻击保护数字数据处理设备
公开(公告)号：US20090222922A1
公开(公告)日：2009-09-03
申请号：US12063733
申请日：2006-08-18
申请人： Stylianos Sidiroglou , Angelos D. Keromytis , Salvatore J. Stolfo
发明人： Stylianos Sidiroglou , Angelos D. Keromytis , Salvatore J. Stolfo
IPC分类号： G06F21/00
CPC分类号： H04L63/1425 , H04L51/08 , H04L51/12 , H04L63/1416 , H04L63/1466
摘要： In accordance with some embodiments of the disclosed subject matter, systems, methods, and media for protecting a digital data processing device from attack are provided. For example, in some embodiments, a method for protecting a digital data processing device from attack is provided, that includes, within a virtual environment: receiving at least one attachment to an electronic mail; and executing the at least one attachment; and based on the execution of the at least one attachment, determining whether anomalous behavior occurs.
摘要翻译：根据所公开的主题的一些实施例，提供了用于保护数字数据处理装置免受攻击的系统，方法和媒体。例如，在一些实施例中，提供了一种用于保护数字数据处理设备免受攻击的方法，其包括在虚拟环境内：接收至少一个附件到电子邮件; 以及执行所述至少一个附件; 并且基于所述至少一个附件的执行，确定是否发生异常行为。

107. 发明授权

US07225343B1 System and methods for adaptive model generation for detecting intrusions in computer systems 有权
标题翻译：用于检测计算机系统入侵的自适应模型生成的系统和方法
公开(公告)号：US07225343B1
公开(公告)日：2007-05-29
申请号：US10352342
申请日：2003-01-27
申请人： Andrew Honig , Andrew Howard , Eleazar Eskin , Salvatore J. Stolfo
发明人： Andrew Honig , Andrew Howard , Eleazar Eskin , Salvatore J. Stolfo
IPC分类号： H04L9/00
CPC分类号： H04L63/14 , G06F17/30091 , G06F17/30294 , G06F17/30477 , G06F21/554 , G06F21/566 , G06N7/005 , G06N99/005 , H04L63/1416 , H04L63/1425 , H04L63/1433
摘要： A system and methods for detecting intrusions in the operation of a computer system comprises a sensor configured to gather information regarding the operation of the computer system, to format the information in a data record having a predetermined format, and to transmit the data in the predetermined data format. A data warehouse is configured to receive the data record from the sensor in the predetermined data format and to store the data in a database. A detection model generator is configured to request data records from the data warehouse in the predetermined data format, to generate an intrusion detection model based on said data records, and to transmit the intrusion detection model to the data warehouse according to the predetermined data format. A detector is configured to receive a data record in the predetermined data format from the sensor and to classify the data record in real-time as one of normal operation and an attack based on said intrusion detection model. A data analysis engine is configured to request data records from the data warehouse according to the predetermined data format and to perform a data processing function on the data records.
摘要翻译：一种用于在计算机系统的操作中检测入侵的系统和方法，包括：传感器，被配置为收集关于计算机系统的操作的信息，将信息格式化成具有预定格式的数据记录，并且以预定的方式发送数据数据格式。数据仓库被配置为以预定数据格式从传感器接收数据记录，并将数据存储在数据库中。检测模型生成器被配置为以预定数据格式从数据仓库请求数据记录，以基于所述数据记录生成入侵检测模型，并根据预定数据格式将入侵检测模型发送到数据仓库。检测器被配置为从传感器接收预定数据格式的数据记录，并且将数据记录实时地分类为正常操作之一和基于所述入侵检测模型的攻击。数据分析引擎被配置为根据预定数据格式从数据仓库请求数据记录，并对数据记录执行数据处理功能。

108. 发明授权

US07162741B2 System and methods for intrusion detection with dynamic window sizes 有权
标题翻译：具有动态窗口大小的入侵检测系统和方法
公开(公告)号：US07162741B2
公开(公告)日：2007-01-09
申请号：US10208402
申请日：2002-07-30
申请人： Eleazar Eskin , Salvatore J. Stolfo
发明人： Eleazar Eskin , Salvatore J. Stolfo
IPC分类号： H04L9/32 , G06F11/00 , G06F11/22 , G06F11/30 , G06F11/32 , G06F11/34 , G06F11/36 , G06F12/14 , G06F12/16 , G06F7/04 , G06F7/58
CPC分类号： H04L63/1416 , Y10S707/99953 , Y10S707/99956
摘要： A system and methods of monitoring sequences of operations in a process running on a computer system. A probabilistic detection model is defined which is configured to determine a predictive probability of an occurrence of a final operation in the sequence of operations that is conditional on a calculated number of previous operations in the sequence of operations. The probabilistic detection model is trained from a plurality of predetermined sequences of operations to calculate the number of previous operations evaluated in the probabilistic detection model. The predictive probability for the final operation in the sequence of operations is determined by using the probabilistic detection model. If the predictive probability is below a predetermined threshold, the sequence of operations is identified as an intrusion. The probabilistic detection model may use sparse distribution trees to generate a model which determines the optimal number of previous operations to be evaluated (i.e., the window size) and position of wildcards. The system and methods may be used to monitor sequences of system calls, application function calls, and machine code instructions, for example.
摘要翻译：在计算机系统上运行的进程中监视操作顺序的系统和方法。定义概率检测模型，其被配置为确定在所述操作序列中出现最终操作的预测概率，其以所计算的操作序列中的先前操作的数量为条件。从多个预定的操作序列训练概率检测模型，以计算在概率检测模型中评估的先前操作的数量。通过使用概率检测模型来确定操作顺序中的最终操作的预测概率。如果预测概率低于预定阈值，则将该操作序列识别为入侵。概率检测模型可以使用稀疏分布树来生成确定要评估的先前操作的最佳数量（即，窗口大小）和通配符的位置的模型。例如，系统和方法可以用于监视系统调用，应用程序函数调用和机器代码指令的顺序。

109. 发明授权

US5748780A Method and apparatus for imaging, image processing and data compression 失效
标题翻译：用于成像，图像处理和数据压缩的方法和装置
公开(公告)号：US5748780A
公开(公告)日：1998-05-05
申请号：US259527
申请日：1994-06-14
申请人： Salvatore J. Stolfo
发明人： Salvatore J. Stolfo
IPC分类号： G06F17/30 , G06K9/00 , G06K9/36
CPC分类号： G06Q20/042 , G06F17/30256 , G06K9/00 , G06K2209/015
摘要： A method for processing an image, consisting of a foreground and a background, to produce a highly compressed and accurate representation of the image, including the steps of scanning the image to create a digital image of the image, comparing the digital image against a codebook of stored digital images; matching the digital image with one of the stored digital images of the codebook; producing an index code identifying the background of the stored digital image as having matched the digital image; subtracting the stored digital image from the digital image to produce a second digital image representing the foreground of the stored digital image; and storing the second digital image with the index code. An apparatus is also provided for compressing images having a foreground and a background, consisting of an image scanner, a template image storage device for storing background templates, a processor system for matching a scanned image of the image with one of the background templates, resulting in a template identifier, a processor system for compensating the scanned image for the matched template to produce a foreground image, and a data compression system for compressing the foreground image.
摘要翻译：一种用于处理由前景和背景组成的图像以产生图像的高度压缩和精确表示的方法，包括扫描图像以创建图像的数字图像的步骤，将数字图像与码本进行比较存储的数字图像; 将数字图像与码本的所存储的数字图像之一进行匹配; 产生将所存储的数字图像的背景识别为与数字图像相匹配的索引码; 从数字图像中减去所存储的数字图像，以产生表示所存储的数字图像的前景的第二数字图像; 并存储具有索引码的第二数字图像。还提供了一种用于压缩具有前景和背景的图像的装置，包括图像扫描器，用于存储背景模板的模板图像存储装置，用于将图像的扫描图像与背景模板之一匹配的处理器系统，产生在模板标识符中，用于补偿用于匹配模板的扫描图像以产生前景图像的处理器系统，以及用于压缩前景图像的数据压缩系统。

110. 发明授权

US5497486A Method of merging large databases in parallel 失效
标题翻译：并行大型数据库的合并方法
公开(公告)号：US5497486A
公开(公告)日：1996-03-05
申请号：US213795
申请日：1994-03-15
申请人： Salvatore J. Stolfo , Mauricio A. Herna/ ndez
发明人： Salvatore J. Stolfo , Mauricio A. Herna/ ndez
IPC分类号： G06F7/14 , G06F7/32 , G06F17/30 , G06F7/06 , G06F7/20
CPC分类号： G06F7/14 , G06F17/30256 , G06F17/30489 , G06F7/32 , Y10S707/99935 , Y10S707/99937
摘要： The semantic integration problem for merging multiple databases of very large size, the merge/purge problem, can be solved by multiple runs of the sorted neighborhood method or the clustering method with small windows followed by the computation of the transitive closure over the results of each run. The sorted neighborhood method works well under this scheme but is computationally expensive due to the sorting phase. An alternative method based on data clustering that reduces the complexity to linear time making multiple runs followed by transitive closure feasible and efficient. A method is provided for identifying duplicate records in a database, each record having at least one field and a plurality of keys, including the steps of sorting the records according to a criteria applied to a first key; comparing a number of consecutive sorted records to each other, wherein the number is less than a number of records in said database and identifying a first group of duplicate records; storing the identity of the first group; sorting the records according to a criteria applied to a second key; comparing a number of consecutive sorted records to each other, wherein the number is less than a number of records in said database and identifying a second group of duplicate records; storing the identity of the second group; and subjecting the union of the first and second groups to transitive closure.
摘要翻译：合并/清除问题的多个数据库的语义集成问题可以通过多次运行的排序邻域方法或使用小窗口的聚类方法来解决，然后计算每个结果的传递闭包跑。排序的邻域方法在该方案下工作良好，但是由于分类阶段，计算费用很高。一种基于数据聚类的替代方法，可以将复杂度降低到线性时间，从而实现多次运行，然后传递闭包可行且高效。提供了一种用于识别数据库中的重复记录的方法，每个记录具有至少一个字段和多个密钥，包括根据应用于第一密钥的准则对记录进行排序的步骤; 将多个连续排序的记录彼此进行比较，其中所述数目小于所述数据库中的记录数量，并且识别第一组重复记录; 存储第一组的身份; 根据应用于第二个键的标准对记录进行排序; 将多个连续排序的记录彼此进行比较，其中所述数量小于所述数据库中的记录数量，并且识别第二组重复记录; 存储第二组的身份; 并使第一组和第二组的联合进行传递闭合。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式