会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 21. 发明申请
    • SYSTEM AND METHOD FOR MODELING ACTIVITY PATTERNS OF NETWORK TRAFFIC TO DETECT BOTNETS
    • 用于建模网络交通活动模式以检测网络的系统和方法
    • US20110153811A1
    • 2011-06-23
    • US12821510
    • 2010-06-23
    • Hyun Cheol JeongChae Tae IMSeung Gao JiJoo Hyung OhDong Wan KangTae Jin LeeYong Geun Won
    • Hyun Cheol JeongChae Tae IMSeung Gao JiJoo Hyung OhDong Wan KangTae Jin LeeYong Geun Won
    • G06F15/173
    • H04L63/14H04L2463/144
    • The invention relates to a system and method that can detect botnets by classifying the communication activities for each client according to destination or based on similarity between the groups of collected traffic. According to certain aspects of the invention, the communication activities for each client can be classified to model network activity by differentiating the protocols of the collected network traffic based on destination and patterning the subgroups for the respective protocols. Those servers that are estimated to be C&C servers can be classified into download and upload, spam servers and command control servers, within a botnet group detected by modeling network activity, i.e. analyzing network-based activity patterns. Also, botnet groups can be detected by way of a group information management function, for generating an activity pattern-based group matrix based on group data, and a mutual similarity analysis, performed on groups suspected to be botnets from the group information.
    • 本发明涉及一种系统和方法,可以通过根据目的地对每个客户端的通信活动进行分类,或者根据收集的业务组之间的相似性来检测僵尸网络。 根据本发明的某些方面,每个客户端的通信活动可以通过基于目的地区分所收集的网络业务的协议并对各个协议的子组进行构图来分类为对网络活动的建模。 估计为C&C服务器的那些服务器可以分类为下载和上传,垃圾邮件服务器和命令控制服务器,通过建模网络活动检测到的僵尸网络组,即分析基于网络的活动模式。 此外,可以通过组信息管理功能来检测僵尸网络组,用于基于组数据生成基于活动模式的组矩阵,以及对从组信息中怀疑为僵尸网络的组执行相互相似性分析。
    • 23. 发明申请
    • MALICIOUS TRAFFIC ISOLATION SYSTEM AND METHOD USING BOTNET INFORMATION
    • 恶性交通隔离系统和使用BOTNET信息的方法
    • US20110154492A1
    • 2011-06-23
    • US12821549
    • 2010-06-23
    • Hyun Cheol JeongChae Tae ImSeung Goo JiJoo Hyung OhDong Wan KangTae Jin LeeYong Geun Won
    • Hyun Cheol JeongChae Tae ImSeung Goo JiJoo Hyung OhDong Wan KangTae Jin LeeYong Geun Won
    • G06F21/00
    • H04L63/1416H04L63/0236H04L63/1441H04L2463/144
    • The present invention relates to a malicious traffic isolation system and method using botnet information, and more particularly, to a malicious traffic isolation system and method using botnet information, in which traffics for a set of clients having the same destination are routed to the isolation system based on a destination IP/Port, and botnet traffics are isolated using botnet information based on similarity among groups of the routed and flowed in traffics. The present invention may provide a malicious traffic isolation method using botnet information, which can accommodate traffics received from a PC or a C&C server infected with a bot into a quarantine area, isolate traffics generated by normal users from traffics transmitted from malicious bots, and block the malicious traffics. In addition, the present invention may provide a malicious traffic isolation method using botnet information, which can provide a function of mitigating DDoS attacks of a botnet.
    • 本发明涉及使用僵尸网络信息的恶意流量隔离系统和方法,更具体地,涉及使用僵尸网络信息的恶意流量隔离系统和方法,其中具有相同目的地的一组客户端的流量被路由到隔离系统 基于目的地IP /端口,并且使用基于路由和流量在业务中的组之间的相似性的僵尸网络信息来分离僵尸网络流量。 本发明可以提供一种使用僵尸网络信息的恶意流量隔离方法,其可以将从被感染机器人的PC或C&C服务器接收到的流量容纳到隔离区域,从而将普通用户生成的流量与恶意机器人传输的流量隔离,并阻止 恶意的流量。 另外,本发明可以提供使用僵尸网络信息的恶意流量隔离方法,其可以提供减轻僵尸网络的DDoS攻击的功能。
    • 28. 发明申请
    • SYSTEM FOR ANALYZING MALICIOUS BOTNET ACTIVITY IN REAL TIME
    • 用于实时分析恶意网络活动的系统
    • US20110154489A1
    • 2011-06-23
    • US12821576
    • 2010-06-23
    • Hyun Cheol JeongChae Tae ImSeung Goo JiJoo Hyung OhDong Wan Kang
    • Hyun Cheol JeongChae Tae ImSeung Goo JiJoo Hyung OhDong Wan Kang
    • G06F21/00
    • H04L63/1416H04L2463/144
    • A system for analyzing malicious botnet activity in real time is disclosed. This system may include: a control server configured to generate botnet activity information relating to a type of malicious botnet activity, and transmit the botnet activity information to the outside, after receiving bot occurrence information from the outside;and a bot executing server configured to execute a malicious bot corresponding to the bot occurrence information received from the outside in a virtual environment operating system and transmit a real-time botnet detection result to the control server for generating the botnet activity information, according to a control of the control server, wherein the real-time botnet detection result includes information on whether or not the malicious bot performs malicious activity based on a command from a remote command/control server existing independently outside.
    • 披露了实时分析恶意僵尸网络活动的系统。 该系统可以包括:控制服务器,被配置为在从外部接收到bot发生信息之后,生成与一种恶意僵尸网络活动有关的僵尸网络活动信息,并将僵尸网络活动信息发送到外部; 以及机器人执行服务器,被配置为执行与在虚拟环境操作系统中从外部接收到的机器人发生信息相对应的恶意机器人,并且根据一个实施例,将实时僵尸网络检测结果发送到控制服务器以产生僵尸网络活动信息 控制服务器的控制,其中实时僵尸网络检测结果包括关于恶意bot是否基于来自独立外部存在的远程命令/控制服务器的命令执行恶意活动的信息。