专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20090094699A1 APPARATUS AND METHOD OF DETECTING NETWORK ATTACK SITUATION 审中-公开
标题翻译：检测网络攻击状况的装置和方法
公开(公告)号：US20090094699A1
公开(公告)日：2009-04-09
申请号：US12275906
申请日：2008-11-21
申请人： Jin Oh KIM , Seon Gyoung Sohn , Hyochan Bang , Soo Hyung Lee , Dongyoung Kim , Beom Hwan Chang , Geon Lyang Kim , Hyun Joo Kim , Jung Chan Na , Jong Soo Jang , Sung Won Sohn
发明人： Jin Oh KIM , Seon Gyoung Sohn , Hyochan Bang , Soo Hyung Lee , Dongyoung Kim , Beom Hwan Chang , Geon Lyang Kim , Hyun Joo Kim , Jung Chan Na , Jong Soo Jang , Sung Won Sohn
IPC分类号： G06F15/18 , G08B23/00
CPC分类号： H04L63/1416 , G06F21/552 , G06F21/85 , H04L63/1441
摘要： Provided is an apparatus for detecting a network attack situation. The apparatus includes an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data; an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated; a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory. Equal numbers of hash engines and detection engines for processing the alarms in the network to the number of data groups classified as network attack situations are formed in a line. Therefore, a network attack situation can be detected in real time based on a great number of alarms indicating intrusion detection.
摘要翻译：提供了一种用于检测网络攻击情况的装置。该装置包括接收在连接有报警接收器的网络中升起的多个报警的报警接收机，将报警转换成预定报警数据，并输出报警数据; 报警处理器根据报警数据的属性和产生报警数据的次数分析网络中的攻击情况; 存储器，用于存储分析网络状态并将基本数据提供给报警处理器所需的基本数据; 以及将所述报警处理器的分析结果发送到外部设备的接口，从外部设备接收预定的临界值，所述临时值是用于确定所述攻击情况的发生的基础，并且将所述临界值输出到所述报警处理器使得报警处理器可以将临界值存储在存储器中。在网络中形成等同数量的散列引擎和检测引擎，用于将网络中的警报处理为分类为网络攻击情况的数据组的数量。因此，可以基于大量表示入侵检测的告警来实时检测网络攻击情况。

IPRDB

热门服务

关于我们

友情链接

联系方式