专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

51. 发明申请

US20170237709A1 UNOBTRUSIVE PROTECTION FOR LARGE-SCALE DATA BREACHES UTILIZING USER-SPECIFIC DATA OBJECT ACCESS BUDGETS 审中-公开
公开(公告)号：US20170237709A1
公开(公告)日：2017-08-17
申请号：US15582388
申请日：2017-04-28
申请人： Imperva, Inc.
发明人： Shiri MARGEL , Itsik MANTIN , Amichai SHULMAN
IPC分类号： H04L29/06
CPC分类号： H04L63/102 , G06F21/62 , H04L63/0209 , H04L63/08 , H04L63/1416 , H04L63/1441 , H04L63/20 , H04W12/08
摘要： Techniques for unobtrusively protecting against large-scale data breaches over time are described. A security gateway coupled between clients and servers receives data object (DO) access requests from the clients on behalf of users of an enterprise. Each of the users is allocated a budget for each of one or more time periods. The security gateway determines an access cost for each DO access request based on characteristics of the DO request, where lower access costs are indicative expected DO access consumption for users of the enterprise, and charges the determined access cost against the budget for that user corresponding to the time period when the DO access request was received. Alert messages are transmitted based on different ones of the users exceeding their budget(s), and the transmission of the DO access requests to the data object servers is not prevented.

52. 发明申请

US20170187718A1 UNOBTRUSIVE PROTECTION FOR LARGE-SCALE DATA BREACHES UTILIZING USER-SPECIFIC DATA OBJECT ACCESS BUDGETS 有权
公开(公告)号：US20170187718A1
公开(公告)日：2017-06-29
申请号：US14983423
申请日：2015-12-29
申请人： Imperva, Inc.
发明人： Shiri MARGEL , Itsik MANTIN , Amichai SHULMAN
IPC分类号： H04L29/06
CPC分类号： H04L63/0209 , G06F21/62 , H04L63/08 , H04L63/102 , H04L63/1416 , H04L63/1441 , H04L63/20 , H04W12/08
摘要： Techniques for unobtrusively protecting against large-scale data breaches over time are described. A security gateway coupled between clients and servers receives data object (DO) access requests from the clients on behalf of users of an enterprise. Each of the users is allocated a budget for each of one or more time periods. The security gateway determines an access cost for each DO access request based on characteristics of the DO request, where lower access costs are indicative expected DO access consumption for users of the enterprise, and charges the determined access cost against the budget for that user corresponding to the time period when the DO access request was received. Alert messages are transmitted based on different ones of the users exceeding their budget(s), and the transmission of the DO access requests to the data object servers is not prevented.

53. 发明授权

US09667651B2 Compromised insider honey pots using reverse honey tokens 有权
公开(公告)号：US09667651B2
公开(公告)日：2017-05-30
申请号：US15184982
申请日：2016-06-16
申请人： Imperva, Inc.
发明人： Amichai Shulman , Michael Cherny , Sagie Dulce
IPC分类号： H04L29/06
CPC分类号： H04L63/1491 , H04L63/0263 , H04L63/1416 , H04L63/20
摘要： According to one embodiment, a method for setting a trap to detect that an intruder has compromised a client end station (CES) in an attempt to gain unauthorized access to enterprise data provided by a server is described. The method includes causing a honey token to be placed on the CES secluded within a configuration repository, wherein the honey token is metadata and/or instructions indicating how applications can seemingly access the enterprise data but that is actually invalid, and the honey token is placed on the CES and not on the server. The method also includes causing attribute values to be installed on a security gateway for a security rule causing the security gateway to monitor network traffic for attempted use of the honey token, and to generate an alert when a set of one or more packets that include the honey token are received.

54. 发明授权

US09591008B2 Data access verification for enterprise resources 有权
标题翻译：企业资源的数据访问验证
公开(公告)号：US09591008B2
公开(公告)日：2017-03-07
申请号：US14688914
申请日：2015-04-16
申请人： Imperva, Inc.
发明人： Amichai Shulman , Sagie Dulce
IPC分类号： G06F21/30 , H04L29/06 , G06F21/55
CPC分类号： H04L63/1425 , G06F21/554 , G06F2221/034 , H04L63/0272 , H04L63/0281 , H04L63/10 , H04L63/1416 , H04L63/1441 , H04L63/18
摘要： According to one embodiment, a method in a computing device for responding to a determination that a verification with a user is desired responsive to detection of activity indicative of a possible insider threat is described. The method includes selecting a target role and a target user for the verification based on an activity context and an enterprise context repository, the selecting including selecting the target role from a plurality of target roles based on the activity context and optionally the enterprise context repository and selecting a target user in the selected target role based on the enterprise context repository. The method further includes causing a verification request to be sent to the selected target user; and generating an alert when a verification result indicates that the activity is indicative of the possible insider threat.
摘要翻译：根据一个实施例，描述了一种计算设备中的方法，用于响应于响应于指示可能的内部威胁的活动的检测而响应于用户的验证的确定。该方法包括基于活动上下文和企业上下文存储库来选择用于验证的目标角色和目标用户，该选择包括基于活动上下文以及可选的企业上下文库从多个目标角色中选择目标角色;以及基于企业上下文信息库选择所选目标角色中的目标用户。该方法还包括使验证请求被发送到所选择的目标用户; 并且当验证结果指示该活动指示可能的内部威胁时，产生警报。

55. 发明授权

US09456002B2 Selective modification of encrypted application layer data in a transparent security gateway 有权
公开(公告)号：US09456002B2
公开(公告)日：2016-09-27
申请号：US14833012
申请日：2015-08-21
申请人： Imperva, Inc.
发明人： Ido Kelson , Dmitry Babich
IPC分类号： H04L29/06 , H04L29/08
CPC分类号： H04L63/168 , H04L63/0281 , H04L63/0428 , H04L63/0435 , H04L63/0471 , H04L63/166 , H04L63/20 , H04L67/02
摘要： According to one embodiment, a transparent security gateway is coupled between a client end station (CES) and a web application server (WAS). The security gateway monitors an encryption protocol handshake between the CES and the WAS to capture, using a provided private key of the WAS, a generated symmetric key to be used for an encryption layer connection. Using the captured symmetric key, the security gateway receives an encrypted connection record of the encryption layer connection, decrypts the encrypted connection record to yield a plaintext connection record, modifies the plaintext connection record, encrypts the modified plaintext connection record using the symmetric key, and transmits one or more packets carrying the encrypted modification plaintext connection record instead of the received encrypted connection record such that neither the CES or WAS is aware of the modification of the encrypted data.

56. 发明申请

US20150207806A1 AUTOMATIC GENERATION OF ATTRIBUTE VALUES FOR RULES OF A WEB APPLICATION LAYER ATTACK DETECTOR 有权
标题翻译：自动生成WEB应用层攻击检测器规则的属性值
公开(公告)号：US20150207806A1
公开(公告)日：2015-07-23
申请号：US14676772
申请日：2015-04-01
申请人： Imperva, Inc.
发明人： Tal Arieh BE'ERY , Shelly HERSHKOVITZ , Nitzan NIV , Amichai SHULMAN
IPC分类号： H04L29/06
CPC分类号： H04L63/14 , H04L63/1408 , H04L63/16 , H04L63/168 , H04L63/20 , H04L63/30 , H04L67/02
摘要： According to one embodiment, a web application layer attack detector (AD) is coupled between an HTTP client and a web application server. Responsive to receipt of a set of packets from the HTTP client carrying a web application layer message that violates a condition of a security rule, the AD transmits an alert package to an automatic attribute value generation and rule feedback module (AVGRFM). The AVGRFM uses the alert package, and optionally other alert packages from the same AD or other ADs, to automatically generate a new set of attribute values for each of a set of attribute identifiers for use, by the AD or other ADs, in a different security rule than the violated security rule. The new set of attribute values may be used in an attack specific rule to detect a previously unknown web application layer attack.
摘要翻译：根据一个实施例，Web应用层攻击检测器（AD）耦合在HTTP客户端和web应用服务器之间。响应于从承载违反安全规则条件的Web应用层消息的HTTP客户端接收到一组分组，AD向自动属性值生成和规则反馈模块（AVGRFM）发送警报包。 AVGRFM使用警报包以及来自同一AD或其他AD的可选的其他警报包自动生成一组属性标识符的一组属性值，用于由AD或其他AD在不同的属性标识符中使用安全规则比违反的安全规则。可以在攻击特定规则中使用新的一组属性值来检测先前未知的Web应用程序层攻击。

57. 发明授权

US09009832B2 Community-based defense through automatic generation of attribute values for rules of web application layer attack detectors 有权
标题翻译：基于社区的防御，通过自动生成Web应用层攻击检测器规则的属性值
公开(公告)号：US09009832B2
公开(公告)日：2015-04-14
申请号：US13948153
申请日：2013-07-22
申请人： Imperva, Inc.
发明人： Tal Arieh Be'ery , Shelly Hershkovitz , Nitzan Niv , Amichai Shulman
IPC分类号： H04L29/06 , H04L29/08
CPC分类号： H04L63/14 , H04L63/1408 , H04L63/16 , H04L63/168 , H04L63/20 , H04L63/30 , H04L67/02
摘要： According to one embodiment, a computing device is coupled to a set of web application layer attack detectors (ADs), which are coupled between HTTP clients and web application servers. The computing device automatically learns a new condition shared by a plurality of alert packages reported by the set of ADs due to a triggering of one or more rules that is indicative of a web application layer attack. The computing device automatically generates a new set of attribute values by analyzing the plurality of alert packages to identify the condition shared by the plurality of alert packages, and transmits the new set of attribute values for delivery to the set of ADs for a different rule to be used to protect against the web application layer attack from the HTTP clients or any other HTTP client.
摘要翻译：根据一个实施例，计算设备耦合到一组web应用层攻击检测器（AD），其耦合在HTTP客户端和web应用服务器之间。由于触发一个或多个指示web应用层攻击的规则，计算设备自动学习由该组AD报告的多个警报包共享的新条件。计算设备通过分析多个警报包来自动生成一组新的属性值，以识别由多个警报包共享的条件，并且将新的属性值集合发送给用于不同规则的AD集合用于防止HTTP客户端或任何其他HTTP客户端的Web应用程序层攻击。

58. 发明授权

US08973142B2 Compromised insider honey pots using reverse honey tokens 有权
标题翻译：使用反向蜂蜜令牌的内疚蜜罐
公开(公告)号：US08973142B2
公开(公告)日：2015-03-03
申请号：US13934099
申请日：2013-07-02
申请人： Imperva Inc.
发明人： Amichai Shulman , Michael Cherny , Sagie Dulce
IPC分类号： G06F12/14 , H04L29/06
CPC分类号： H04L63/1491 , H04L63/0263 , H04L63/1416 , H04L63/20
摘要： According to one embodiment, a method for setting a trap to detect that an intruder has compromised a client end station (CES) in an attempt to gain unauthorized access to enterprise data provided by a server is described. The method includes causing a honey token to be placed on the CES secluded within a configuration repository, wherein the honey token is metadata and/or instructions indicating how applications can seemingly access the enterprise data but that is actually invalid, and the honey token is placed on the CES and not on the server. The method also includes causing attribute values to be installed on a security gateway for a security rule causing the security gateway to monitor network traffic for attempted use of the honey token, and to generate an alert when a set of one or more packets that include the honey token are received.
摘要翻译：根据一个实施例，描述了一种用于设置陷阱以检测入侵者已经破坏了客户端站（CES）以尝试获得未经授权的访问由服务器提供的企业数据的方法。该方法包括使蜂蜜令牌放置在配置库内隐藏的CES上，其中蜂蜜令牌是元数据和/或指示应用程序如何看起来访问企业数据但实际上无效的指令，并且蜂蜜令牌被放置在CES上，而不是在服务器上。该方法还包括使属性值安装在用于安全规则的安全网关上的安全规则，导致安全网关监视网络流量以尝试使用蜂蜜令牌，并且当包括一个或多个分组的一个或多个分组的集合时生成警报收到蜂蜜令牌。

59. 发明申请

US20140317738A1 AUTOMATIC GENERATION OF ATTRIBUTE VALUES FOR RULES OF A WEB APPLICATION LAYER ATTACK DETECTOR 有权
标题翻译：自动生成WEB应用层攻击检测器规则的属性值
公开(公告)号：US20140317738A1
公开(公告)日：2014-10-23
申请号：US13948145
申请日：2013-07-22
申请人： IMPERVA, INC.
发明人： Tal Arieh Be'ery , Shelly Hershkovitz , Nitzan Niv , Amichai Shulman
IPC分类号： H04L29/06
CPC分类号： H04L63/14 , H04L63/1408 , H04L63/16 , H04L63/168 , H04L63/20 , H04L63/30 , H04L67/02
摘要： According to one embodiment, a web application layer attack detector (AD) is coupled between an HTTP client and a web application server. Responsive to receipt of a set of packets from the HTTP client carrying a web application layer message that violates a condition of a security rule, the AD transmits an alert package to an automatic attribute value generation and rule feedback module (AVGRFM). The AVGRFM uses the alert package, and optionally other alert packages from the same AD or other ADs, to automatically generate a new set of attribute values for each of a set of attribute identifiers for use, by the AD or other ADs, in a different security rule than the violated security rule. The new set of attribute values may be used in an attack specific rule to detect a previously unknown web application layer attack.
摘要翻译：根据一个实施例，Web应用层攻击检测器（AD）耦合在HTTP客户端和web应用服务器之间。响应于从承载违反安全规则条件的Web应用层消息的HTTP客户端接收到一组分组，AD向自动属性值生成和规则反馈模块（AVGRFM）发送警报包。 AVGRFM使用警报包以及来自同一AD或其他AD的可选的其他警报包来自动生成一组属性标识符的一组属性值，用于由AD或其他AD在不同的属性标识符中使用安全规则比违反的安全规则。可以在攻击特定规则中使用新的一组属性值来检测先前未知的Web应用程序层攻击。

60. 发明申请

US20140258294A1 ON-DEMAND CONTENT CLASSIFICATION USING AN OUT-OF-BAND COMMUNICATIONS CHANNEL FOR FACILITATING FILE ACTIVITY MONITORING AND CONTROL 有权
标题翻译：使用带外通信信道进行需求内容分类，促进文件活动监控和控制
公开(公告)号：US20140258294A1
公开(公告)日：2014-09-11
申请号：US13787536
申请日：2013-03-06
申请人： Imperva, Inc.
发明人： Amichai Shulman , Rotem Naar , Moshe Einhorn
IPC分类号： G06F17/30
CPC分类号： G06F17/30082 , G06F17/2785 , H04L47/2441
摘要： Communications to a server over an in-band communications channel are monitored for requests to access a file. Based on the communications, a request to access a particular file stored by the server is identified. Security and/or audit rules are identified based on the request. A determination is thereafter made that the security and/or audit rules require evaluation of classification information for contents of the requested file. Thus, a determination is made as to whether classification information for the contents of the particular file is available, such as determining whether the classification information is stored in a local classification cache. Responsive to a determination that the classification information is not available, classification information is obtained for the contents of the particular file using an out-of-band communications channel. Thereafter, processing with respect to the request to access the particular file is performed based on the obtained classification information and the one or more security and/or audit rules.
摘要翻译：监视通过带内通信信道到服务器的通信，以访问文件的请求。基于通信，识别访问由服务器存储的特定文件的请求。根据请求确定安全和/或审核规则。此后，确定安全和/或审核规则要求评估所请求文件内容的分类信息。因此，确定特定文件的内容的分类信息是否可用，诸如确定分类信息是否存储在本地分类高速缓存中。响应于分类信息不可用的确定，使用带外通信信道获得特定文件的内容的分类信息。此后，基于获得的分类信息和一个或多个安全和/或审核规则来执行关于访问特定文件的请求的处理。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式