会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 81. 发明授权
    • Optimized field unpacking for a data stream management system
    • 针对数据流管理系统优化现场拆包
    • US08112415B1
    • 2012-02-07
    • US12132690
    • 2008-06-04
    • Theodore JohnsonLukasz GolabOliver Spatscheck
    • Theodore JohnsonLukasz GolabOliver Spatscheck
    • G06F17/30G06F7/00
    • G06F17/30516
    • Two methods and computer-readable medium for obtaining information using field group unpacking functions. The first method obtains information using field group unpacking functions by identifying an optimized unpacking function from field group unpacking functions, and an optimized unpacking function is used to unpack a field associated with the data stream. The second method obtains information using field group unpacking functions by identifying an optimized unpacking function from the field group unpacking functions. Then, a prefilter is applied and associated with the optimized unpacking functions and used to unpack a field associated with the data stream. The computer-readable medium obtains field group unpacking functions for execution by a computing device using field group unpacking functions that identify an optimized unpacking function from the field group unpacking functions, and use an optimized unpacking function to unpack a field associated with the data stream.
    • 两种方法和计算机可读介质,用于使用现场组解包功能获取信息。 第一种方法通过使用现场组解包功能来识别优化的拆包功能,通过字段组解包功能获得信息,并且使用优化的解包功能来解压缩与数据流相关联的字段。 第二种方法是通过使用现场组解包功能来识别来自现场组解包功能的优化解包功能来获取信息。 然后,应用预过滤器并将其与优化的拆包功能相关联,并用于解包与数据流相关联的字段。 计算机可读介质获得用于由计算设备执行的字段组解包功能,使用从字段组解包功能识别优化的解包功能的字段组解包功能,并使用优化的解包功能来解包与数据流相关联的字段。
    • 83. 发明授权
    • Statistical, signature-based approach to IP traffic classification
    • 统计,基于签名的IP流量分类方法
    • US08031599B2
    • 2011-10-04
    • US12635127
    • 2009-12-10
    • Nicholas G. DuffieldMatthew RoughanSubhabrata SenOliver Spatscheck
    • Nicholas G. DuffieldMatthew RoughanSubhabrata SenOliver Spatscheck
    • H04L12/28
    • H04L41/5022H04L41/142
    • A signature-based traffic classification method maps traffic into preselected classes of service (CoS). By analyzing a known corpus of data that clearly belongs to identified ones of the preselected classes of service, in a training session the method develops statistics about a chosen set of traffic features. In an analysis session, relative to traffic of the network where QoS treatments are desired (target network), the method obtains statistical information relative to the same chosen set of features for values of one or more predetermined traffic attributes that are associated with connections that are analyzed in the analysis session, yielding a statistical features signature of each of the values of the one or more attributes. A classification process then establishes a mapping between values of the one or more predetermined traffic attributes and the preselected classes of service, leading to the establishment of QoS treatment rules.
    • 基于签名的流量分类方法将流量映射到预选的服务等级(CoS)。 通过分析明确属于所选择的服务类别的已知数据库,在训练课程中,该方法开发关于所选择的一组交通特征的统计。 在分析会话中,相对于期望QoS处理的网络的业务量(目标网络),该方法获得相对于与所连接的连接相关联的一个或多个预定业务属性的值的相同所选择的特征集的统计信息 在分析会话中分析,产生一个或多个属性的每个值的统计特征签名。 然后,分类过程建立一个或多个预定业务属性的值与预选的业务类别之间的映射,导致建立QoS处理规则。
    • 84. 发明授权
    • Method and apparatus for large-scale automated distributed denial of service attack detection
    • 用于大规模自动分布式拒绝服务攻击检测的方法和装置
    • US08001601B2
    • 2011-08-16
    • US11452623
    • 2006-06-14
    • Nicholas DuffieldJacobus Van Der MerweVyas SekarOliver Spatscheck
    • Nicholas DuffieldJacobus Van Der MerweVyas SekarOliver Spatscheck
    • G06F11/00G06F12/14G06F12/16G08B23/00
    • H04L63/1425H04L63/1458
    • A multi-staged framework for detecting and diagnosing Denial of Service attacks is disclosed in which a low-cost anomaly detection mechanism is first used to collect coarse data, such as may be obtained from Simple Network Management Protocol (SNMP) data flows. Such data is analyzed to detect volume anomalies that could possibly be indicative of a DDoS attack. If such an anomaly is suspected, incident reports are then generated and used to trigger the collection and analysis of fine grained data, such as that available in Netflow data flows. Both types of collection and analysis are illustratively conducted at edge routers within the service provider network that interface customers and customer networks to the service provider. Once records of the more detailed information have been retrieved, they are examined to determine whether the anomaly represents a distributed denial of service attack, at which point an alarm is generated.
    • 公开了一种用于检测和诊断拒绝服务攻击的多阶段框架,其中首先使用低成本异常检测机制来收集粗略数据,例如可以从简单网络管理协议(SNMP)数据流中获得。 分析这些数据以检测可能表示DDoS攻击的体积异常。 如果怀疑出现这种异常,则会生成事件报告,并用于触发对Netflow数据流中可用的细粒度数据的收集和分析。 这两种类型的收集和分析在服务提供商网络中的边缘路由器上进行说明性地进行,其将客户和客户网络接入服务提供商。 一旦检索到更详细信息的记录,就检查它们以确定异常是否表示分布式拒绝服务攻击,此时产生警报。
    • 85. 发明授权
    • System and method for real-time diagnosis of routing problems
    • 用于路由问题实时诊断的系统和方法
    • US07898955B1
    • 2011-03-01
    • US11451261
    • 2006-06-12
    • Jia WangOliver SpatscheckLixin GaoFeng Wang
    • Jia WangOliver SpatscheckLixin GaoFeng Wang
    • G06F11/00H04L12/28H04L12/56
    • H04L43/16H04L43/18H04L45/70
    • A system and method for detecting and diagnosing routing problems in a network in real-time by recording TCP flow information from at least one server to at least one prefix, and observing retransmission packets communicated from the at least one server to the at least one prefix. When a predetermined threshold for TCP flows to a prefix is reached, traceroutes may be triggered to a destination in the prefix, and the traceroutes analyzed to determine whether to issue an alarm for a routing failure. The system includes a real-time data collection engine for recording unidirectional TCP flow information, a real-time detection engine for observing the retransmission packets and issuing a warning upon a retransmission counter exceeding a predetermined threshold, and a real-time diagnosis engine for triggering at least one traceroute to a destination in the prefix that is randomly selected from TCP flows in retransmission states.
    • 一种用于通过将来自至少一个服务器的TCP流信息记录到至少一个前缀来实时检测和诊断网络中的路由问题的系统和方法,以及观察从所述至少一个服务器传送到所述至少一个前缀的重传分组 。 当达到TCP的预定阈值到达前缀时,可以将跟踪路由触发到前缀中的目的地,并且分析的跟踪路由以确定是否发布用于路由失败的报警。 该系统包括用于记录单向TCP流信息的实时数据收集引擎,用于观察重传分组并在超过预定阈值的重传计数器上发出警告的实时检测引擎,以及用于触发的实时诊断引擎 至少一个到重传状态中从TCP流中随机选择的前缀中的目的地的跟踪路由。
    • 90. 发明授权
    • Statistical, signature-based approach to IP traffic classification
    • 统计,基于签名的IP流量分类方法
    • US07660248B1
    • 2010-02-09
    • US10764001
    • 2004-01-23
    • Nicholas G. DuffieldMatthew RoughanSubhabrata SenOliver Spatscheck
    • Nicholas G. DuffieldMatthew RoughanSubhabrata SenOliver Spatscheck
    • H04L12/26
    • H04L41/5022H04L41/142
    • A signature-based traffic classification method maps traffic into preselected classes of service (CoS). By analyzing a known corpus of data that clearly belongs to identified ones of the preselected classes of service, in a training session the method develops statistics about a chosen set of traffic features. In an analysis session, relative to traffic of the network where QoS treatments are desired (target network), the method obtains statistical information relative to the same chosen set of features for values of one or more predetermined traffic attributes that are associated with connections that are analyzed in the analysis session, yielding a statistical features signature of each of the values of the one or more attributes. A classification process then establishes a mapping between values of the one or more predetermined traffic attributes and the preselected classes of service, leading to the establishment of QoS treatment rules.
    • 基于签名的流量分类方法将流量映射到预选的服务等级(CoS)。 通过分析明确属于所选择的服务类别的已知数据库,在训练课程中,该方法开发关于所选择的一组交通特征的统计。 在分析会话中,相对于期望QoS处理的网络的业务量(目标网络),该方法获得相对于与所连接的连接相关联的一个或多个预定业务属性的值的相同所选择的特征集的统计信息 在分析会话中分析,产生一个或多个属性的每个值的统计特征签名。 然后,分类过程建立一个或多个预定业务属性的值与预选的业务类别之间的映射,导致建立QoS处理规则。