专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08381295B2 Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems 有权
公开(公告)号：US08381295B2
公开(公告)日：2013-02-19
申请号：US12833743
申请日：2010-07-09
申请人： Salvatore J Stolfo , Tal Malkin , Angelos D Keromytis , Vishal Misra , Michael Locasto , Janak Parekh
发明人： Salvatore J Stolfo , Tal Malkin , Angelos D Keromytis , Vishal Misra , Michael Locasto , Janak Parekh
IPC分类号： H04L29/06
CPC分类号： H04L63/1416 , G06F21/552 , G06F21/554 , H04L63/145 , H04L63/1475 , H04L63/1491
摘要： Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems are provided. These systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed without generating excess traffic loads.

2. 发明授权

US08381299B2 Systems, methods, and media for outputting a dataset based upon anomaly detection 有权
标题翻译：基于异常检测输出数据集的系统，方法和媒体
公开(公告)号：US08381299B2
公开(公告)日：2013-02-19
申请号：US12280969
申请日：2007-02-28
申请人： Salvatore J Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J Stolfo , Ke Wang , Janak Parekh
IPC分类号： H04L29/06
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting a dataset based upon anomaly detection are provided. In some embodiments, methods for outputting a dataset based upon anomaly detection: receive a training dataset having a plurality of n-grams, which plurality includes a first plurality of distinct training n-grams each being a first size; compute a first plurality of appearance frequencies, each for a corresponding one of the first plurality of distinct training n-grams; receive an input dataset including first input n-grams each being the first size; define a first window in the input dataset; identify as being first matching n-grams, the first input n-grams in the first window that correspond to the first plurality of distinct training n-grams; compute a first anomaly detection score for the input dataset using the first matching n-grams and the first plurality of appearance frequencies; and output the input dataset based on the first anomaly detection score.
摘要翻译：提供了基于异常检测输出数据集的系统，方法和媒体。在一些实施例中，用于基于异常检测输出数据集的方法：接收具有多个n克的训练数据集，所述训练数据集多个包括第一组多个不同的训练n克，每个训练数据集是第一大小; 计算第一多个出现频率，每个出现频率分别针对第一组多个不同训练n-gram中的对应的一个; 接收一个输入数据集，其中包括第一个输入的n-gram，每个都是第一个大小; 在输入数据集中定义第一个窗口; 确定为首次匹配n-gram，第一个窗口中的第一个输入n-gram对应于第一个多个不同的训练n-gram; 使用所述第一匹配n克和所述第一多个出现频率来计算所述输入数据集的第一异常检测分数; 并基于第一异常检测分数输出输入数据集。

3. 发明授权

US08448242B2 Systems, methods, and media for outputting data based upon anomaly detection 有权
标题翻译：基于异常检测输出数据的系统，方法和媒体
公开(公告)号：US08448242B2
公开(公告)日：2013-05-21
申请号：US12280970
申请日：2007-02-28
申请人： Salvatore J Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J Stolfo , Ke Wang , Janak Parekh
IPC分类号： G06F21/00
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting data based on anomaly detection are provided. In some embodiments, methods for outputting data based on anomaly detection include: receiving a known-good dataset; storing distinct n-grams from the known-good dataset to form a binary anomaly detection model; receiving known-good new n-grams; computing a rate of receipt of distinct n-grams in the new n-grams; determining whether further training of the anomaly detection model is necessary based on the rate of receipt on distinct n-grams; using the binary anomaly detection model to determine whether an input dataset contains an anomaly; and outputting the input dataset based on whether the input dataset contains an anomaly.
摘要翻译：提供了基于异常检测输出数据的系统，方法和媒体。在一些实施例中，用于基于异常检测输出数据的方法包括：接收已知的数据集; 从已知的数据集中存储不同的n-gram，形成二进制异常检测模型; 接收已知好的新n克; 计算在新的n克中收到不同n克的比率; 根据不同n-gram的收货率确定是否需要进一步训练异常检测模型; 使用二进制异常检测模型来确定输入数据集是否包含异常; 以及基于输入数据集是否包含异常来输出输入数据集。

4. 发明申请

US20100064368A1 Systems, Methods, and Media for Outputting a Dataset Based Upon Anomaly Detection 有权
标题翻译：基于异常检测输出数据集的系统，方法和媒体
公开(公告)号：US20100064368A1
公开(公告)日：2010-03-11
申请号：US12280969
申请日：2007-02-28
申请人： Salvatore J Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J Stolfo , Ke Wang , Janak Parekh
IPC分类号： G06F12/14
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting a dataset based upon anomaly detection are provided. In some embodiments, methods for outputting a dataset based upon anomaly detection: receive a training dataset having a plurality of n-grams, which plurality includes a first plurality of distinct training n-grams each being a first size; compute a first plurality of appearance frequencies, each for a corresponding one of the first plurality of distinct training n-grams; receive an input dataset including first input n-grams each being the first size; define a first window in the input dataset; identify as being first matching n-grams, the first input n-grams in the first window that correspond to the first plurality of distinct training n-grams; compute a first anomaly detection score for the input dataset using the first matching n-grams and the first plurality of appearance frequencies; and output the input dataset based on the first anomaly detection score.
摘要翻译：提供了基于异常检测输出数据集的系统，方法和媒体。在一些实施例中，用于基于异常检测输出数据集的方法：接收具有多个n克的训练数据集，所述训练数据集多个包括第一组多个不同的训练n克，每个训练数据集是第一大小; 计算第一多个出现频率，每个出现频率分别针对第一组多个不同训练n-gram中的对应的一个; 接收一个输入数据集，其中包括第一个输入的n-gram，每个都是第一个大小; 在输入数据集中定义第一个窗口; 确定为首次匹配n-gram，第一个窗口中的第一个输入n-gram对应于第一个多个不同的训练n-gram; 使用所述第一匹配n克和所述第一多个出现频率来计算所述输入数据集的第一异常检测分数; 并基于第一异常检测分数输出输入数据集。

5. 发明授权

US09003523B2 Systems, methods, and media for outputting data based upon anomaly detection 有权
标题翻译：基于异常检测输出数据的系统，方法和媒体
公开(公告)号：US09003523B2
公开(公告)日：2015-04-07
申请号：US13891031
申请日：2013-05-09
申请人： Salvatore J Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J Stolfo , Ke Wang , Janak Parekh
IPC分类号： G06F21/00 , H04L29/06
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting data based on anomaly detection are provided. In some embodiments, a method for outputting data based on anomaly detection is provided, the method comprising: receiving, using a hardware processor, an input dataset; identifying grams in the input dataset that substantially include distinct byte values; creating an input subset by removing the identified grams from the input dataset; determining whether the input dataset is likely to be anomalous based on the identified grams, and determining whether the input dataset is likely to be anomalous by applying the input subset to a binary anomaly detection model to check for an n-gram in the input subset; and outputting the input dataset based on the likelihood that the input dataset is anomalous.
摘要翻译：提供了基于异常检测输出数据的系统，方法和媒体。在一些实施例中，提供了一种用于基于异常检测输出数据的方法，所述方法包括：使用硬件处理器接收输入数据集; 识别基本上包含不同字节值的输入数据集中的克数; 通过从输入数据集中移除所识别的克来创建输入子集; 基于所识别的克确定输入数据集是否可能是异常的，并且通过将输入子集应用于二进制异常检测模型来确定输入数据集是否可能是异常的，以检查输入子集中的n-gram; 并且基于输入数据集是异常的可能性来输出输入数据集。

6. 发明授权

US09372838B2 Systems and methods for content extraction from mark-up language text accessible at an internet domain 有权
标题翻译：用于从互联网域可访问的标记语言文本内容提取的系统和方法
公开(公告)号：US09372838B2
公开(公告)日：2016-06-21
申请号：US13900912
申请日：2013-05-23
申请人： Suhit Gupta , Gail Kaiser , Salvatore J Stolfo
发明人： Suhit Gupta , Gail Kaiser , Salvatore J Stolfo
IPC分类号： G06F17/22 , G06F17/30
CPC分类号： G06F17/2247 , G06F17/30864 , G06F17/30908 , G06F17/30914
摘要： Systems and methods are presented for content extraction from markup language text. The content extraction process may parse markup language text into a hierarchical data model and then apply one or more filters. Output filters may be used to make the process more versatile. The operation of the content extraction process and the one or more filters may be controlled by one or more settings set by a user, or automatically by a classifier. The classifier may automatically enter settings by classifying markup language text and entering settings based on this classification. Automatic classification may be performed by clustering unclassified markup language texts with previously classified markup language texts.
摘要翻译：介绍了从标记语言文本中提取内容的系统和方法。内容提取过程可以将标记语言文本解析成分层数据模型，然后应用一个或多个过滤器。输出滤波器可用于使该过程更加通用。内容提取处理和一个或多个过滤器的操作可以由用户设置的一个或多个设置或由分类器自动地控制。分类器可以通过分类标记语言文本并根据此分类输入设置来自动输入设置。可以通过将未分类的标记语言文本与先前分类的标记语言文本进行聚类来执行自动分类。

7. 发明授权

US10686836B1 Host-based deception security technology 有权
公开(公告)号：US10686836B1
公开(公告)日：2020-06-16
申请号：US16174417
申请日：2018-10-30
申请人： Salvatore J Stolfo
发明人： Salvatore J Stolfo
IPC分类号： H04L29/06
摘要： Systems and methods for generating and deploying decoy files and decoy applications that appear to be authentic files and applications. The content of the decoy files may be configurable, and the decoy files may be beaconized. The extent to which decoy files are and decoy applications are deployed may depend on the authentication level or change in authentication level of a user.

8. 发明授权

US10069854B2 Methods, systems and media for evaluating layered computer security products 有权
公开(公告)号：US10069854B2
公开(公告)日：2018-09-04
申请号：US14083327
申请日：2013-11-18
申请人： Nathaniel Gordon Boggs , Salvatore J Stolfo
发明人： Nathaniel Gordon Boggs , Salvatore J Stolfo
IPC分类号： H04L29/06 , G06F17/30 , H04L9/08 , H04L12/26
摘要： Methods, systems and media for evaluating layered computer security products are provided. In some embodiments, the method comprises: (a) identifying portions of attack data associated with an attack; (b) linking the portions of attack data; (c) testing security products using the linked attack data, at least two of the security products using different portions of the linked attack data; (d) storing the results of the testing; (e) repeating (a)-(d) for multiple attacks; receiving information identifying a subset of the security products from a remote computing device; identifying a first set of detected attacks for each of the plurality of security product using the stored results; determining a number of attacks in a union of each of the first sets of identified attacks; determining a detection rate for the identified security products based on the union and the number of tested attacks; and causing the detection rate to be presented.

9. 发明授权

US08644342B2 Apparatus method and medium for detecting payload anomaly using N-gram distribution of normal data 有权
标题翻译：使用正常数据的N-gram分布来检测有效载荷异常的装置方法和介质
公开(公告)号：US08644342B2
公开(公告)日：2014-02-04
申请号：US12615917
申请日：2009-11-10
申请人： Salvatore J Stolfo , Ke Wang
发明人： Salvatore J Stolfo , Ke Wang
IPC分类号： H04L12/28 , H04J3/16 , H04J3/24 , G06F9/00 , G06F11/00
CPC分类号： H04L63/1425 , G06F21/55 , G06F21/552 , G06F21/554 , G06F21/56 , G06F21/562 , G06F21/563 , G06F21/564 , H04L43/00 , H04L43/0876 , H04L63/0218 , H04L63/0245 , H04L63/0263 , H04L63/029 , H04L63/145
摘要： A method, apparatus and medium are provided for detecting anomalous payloads transmitted through a network. The system receives payloads within the network and determines a length for data contained in each payload. A statistical distribution is generated for data contained in each payload received within the network, and compared to a selected model distribution representative of normal payloads transmitted through the network. The model payload can be selected such that it has a predetermined length range that encompasses the length for data contained in the received payload. Anomalous payloads are then identified based on differences detected between the statistical distribution of received payloads and the model distribution. The system can also provide for automatic training and incremental updating of models.
摘要翻译：提供了一种用于检测通过网络发送的异常有效载荷的方法，装置和介质。系统在网络内接收有效载荷并确定每个载荷中包含的数据的长度。为包含在网络中接收的每个有效载荷中的数据生成统计分布，并与代表通过网络传输的正常有效载荷的所选模型分布进行比较。可以选择模型有效载荷，使得其具有预定的长度范围，其包含包含在接收到的有效载荷中的数据的长度。然后根据接收到的有效载荷的统计分布和模型分布之间检测到的差异来识别异常有效载荷。该系统还可以提供模型的自动训练和增量更新。

10. 发明授权

US10891375B1 Document behavior analytics—abnormal document flows to identify suspicious exfiltration utility patent 有权
公开(公告)号：US10891375B1
公开(公告)日：2021-01-12
申请号：US16144844
申请日：2018-09-27
申请人： Salvatore J Stolfo
发明人： Salvatore J Stolfo
IPC分类号： G06F11/00 , G06F21/56 , G06F21/55 , G06F16/245 , G06F16/248 , G06F12/14
摘要： Systems and methods for efficiently detecting and monitoring transmitted documents. The invention provides efficient, scalable, and accurate means to identify anomalous or suspicious access patterns, and related and similar documents based upon their content and their structural characteristics. Transmitted documents that are encrypted may be monitored without revealing the encrypted information.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式