专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

71. 发明申请

US20100153785A1 METHODS, MEDIA, AND SYSTEMS FOR DETECTING AN ANOMALOUS SEQUENCE OF FUNCTION CALLS 有权
标题翻译：用于检测功能调用异常序列的方法，媒体和系统
公开(公告)号：US20100153785A1
公开(公告)日：2010-06-17
申请号：US12447946
申请日：2007-10-30
申请人： Angelos D. Keromytis , Salvatore J. Stolfo
发明人： Angelos D. Keromytis , Salvatore J. Stolfo
IPC分类号： G06F11/07 , G06F9/44
CPC分类号： G06F21/566 , G06F11/08 , G06F11/3688 , G06F2221/033 , G06N7/005 , H04L63/1425
摘要： Methods, media, and systems for detecting an anomalous sequence of function calls are provided. The methods can include compressing a sequence of function calls made by the execution of a program using a compression model; and determining the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed. The methods can further include executing at least one known program; observing at least one sequence of function calls made by the execution of the at least one known program; assigning each type of function call in the at least one sequence of function calls made by the at least one known program a unique identifier; and creating at least part of the compression model by recording at least one sequence of unique identifiers.
摘要翻译：提供了用于检测函数调用异常序列的方法，介质和系统。该方法可以包括通过使用压缩模型来压缩由程序执行所产生的函数调用序列; 以及基于函数调用序列被压缩的程度来确定功能调用序列中函数调用的异常序列的存在。所述方法还可以包括执行至少一个已知程序; 观察由所述至少一个已知节目的执行而进行的至少一个函数调用序列; 在由所述至少一个已知程序进行的所述至少一个功能调用序列中分配每种类型的功能调用唯一标识符; 以及通过记录至少一个唯一标识符序列来创建所述压缩模型的至少一部分。

72. 发明授权

US07639714B2 Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data 有权
标题翻译：使用正常数据的n-gram分布检测有效载荷异常的装置方法和介质
公开(公告)号：US07639714B2
公开(公告)日：2009-12-29
申请号：US10986447
申请日：2004-11-12
申请人： Salvatore J. Stolfo , Ke Wang
发明人： Salvatore J. Stolfo , Ke Wang
IPC分类号： H04J3/24 , G06F9/00
CPC分类号： H04L63/1425 , G06F21/55 , G06F21/552 , G06F21/554 , G06F21/56 , G06F21/562 , G06F21/563 , G06F21/564 , H04L43/00 , H04L43/0876 , H04L63/0218 , H04L63/0245 , H04L63/0263 , H04L63/029 , H04L63/145
摘要： A method, apparatus and medium are provided for detecting anomalous payloads transmitted through a network. The system receives payloads within the network and determines a length for data contained in each payload. A statistical distribution is generated for data contained in each payload received within the network, and compared to a selected model distribution representative of normal payloads transmitted through the network. The model payload can be selected such that it has a predetermined length range that encompasses the length for data contained in the received payload. Anomalous payloads are then identified based on differences detected between the statistical distribution of received payloads and the model distribution. The system can also provide for automatic training and incremental updating of models.
摘要翻译：提供了一种用于检测通过网络发送的异常有效载荷的方法，装置和介质。系统在网络内接收有效载荷并确定每个载荷中包含的数据的长度。为包含在网络中接收的每个有效载荷中的数据生成统计分布，并与代表通过网络传输的正常有效载荷的所选模型分布进行比较。可以选择模型有效载荷，使得其具有预定的长度范围，其包含包含在接收到的有效载荷中的数据的长度。然后根据接收到的有效载荷的统计分布和模型分布之间检测到的差异来识别异常有效载荷。该系统还可以提供模型的自动训练和增量更新。

73. 发明申请

US20090222922A1 SYSTEMS, METHODS, AND MEDIA PROTECTING A DIGITAL DATA PROCESSING DEVICE FROM ATTACK 有权
标题翻译：系统，方法和媒体从攻击保护数字数据处理设备
公开(公告)号：US20090222922A1
公开(公告)日：2009-09-03
申请号：US12063733
申请日：2006-08-18
申请人： Stylianos Sidiroglou , Angelos D. Keromytis , Salvatore J. Stolfo
发明人： Stylianos Sidiroglou , Angelos D. Keromytis , Salvatore J. Stolfo
IPC分类号： G06F21/00
CPC分类号： H04L63/1425 , H04L51/08 , H04L51/12 , H04L63/1416 , H04L63/1466
摘要： In accordance with some embodiments of the disclosed subject matter, systems, methods, and media for protecting a digital data processing device from attack are provided. For example, in some embodiments, a method for protecting a digital data processing device from attack is provided, that includes, within a virtual environment: receiving at least one attachment to an electronic mail; and executing the at least one attachment; and based on the execution of the at least one attachment, determining whether anomalous behavior occurs.
摘要翻译：根据所公开的主题的一些实施例，提供了用于保护数字数据处理装置免受攻击的系统，方法和媒体。例如，在一些实施例中，提供了一种用于保护数字数据处理设备免受攻击的方法，其包括在虚拟环境内：接收至少一个附件到电子邮件; 以及执行所述至少一个附件; 并且基于所述至少一个附件的执行，确定是否发生异常行为。

74. 发明授权

US07225343B1 System and methods for adaptive model generation for detecting intrusions in computer systems 有权
标题翻译：用于检测计算机系统入侵的自适应模型生成的系统和方法
公开(公告)号：US07225343B1
公开(公告)日：2007-05-29
申请号：US10352342
申请日：2003-01-27
申请人： Andrew Honig , Andrew Howard , Eleazar Eskin , Salvatore J. Stolfo
发明人： Andrew Honig , Andrew Howard , Eleazar Eskin , Salvatore J. Stolfo
IPC分类号： H04L9/00
CPC分类号： H04L63/14 , G06F17/30091 , G06F17/30294 , G06F17/30477 , G06F21/554 , G06F21/566 , G06N7/005 , G06N99/005 , H04L63/1416 , H04L63/1425 , H04L63/1433
摘要： A system and methods for detecting intrusions in the operation of a computer system comprises a sensor configured to gather information regarding the operation of the computer system, to format the information in a data record having a predetermined format, and to transmit the data in the predetermined data format. A data warehouse is configured to receive the data record from the sensor in the predetermined data format and to store the data in a database. A detection model generator is configured to request data records from the data warehouse in the predetermined data format, to generate an intrusion detection model based on said data records, and to transmit the intrusion detection model to the data warehouse according to the predetermined data format. A detector is configured to receive a data record in the predetermined data format from the sensor and to classify the data record in real-time as one of normal operation and an attack based on said intrusion detection model. A data analysis engine is configured to request data records from the data warehouse according to the predetermined data format and to perform a data processing function on the data records.
摘要翻译：一种用于在计算机系统的操作中检测入侵的系统和方法，包括：传感器，被配置为收集关于计算机系统的操作的信息，将信息格式化成具有预定格式的数据记录，并且以预定的方式发送数据数据格式。数据仓库被配置为以预定数据格式从传感器接收数据记录，并将数据存储在数据库中。检测模型生成器被配置为以预定数据格式从数据仓库请求数据记录，以基于所述数据记录生成入侵检测模型，并根据预定数据格式将入侵检测模型发送到数据仓库。检测器被配置为从传感器接收预定数据格式的数据记录，并且将数据记录实时地分类为正常操作之一和基于所述入侵检测模型的攻击。数据分析引擎被配置为根据预定数据格式从数据仓库请求数据记录，并对数据记录执行数据处理功能。

75. 发明授权

US07162741B2 System and methods for intrusion detection with dynamic window sizes 有权
标题翻译：具有动态窗口大小的入侵检测系统和方法
公开(公告)号：US07162741B2
公开(公告)日：2007-01-09
申请号：US10208402
申请日：2002-07-30
申请人： Eleazar Eskin , Salvatore J. Stolfo
发明人： Eleazar Eskin , Salvatore J. Stolfo
IPC分类号： H04L9/32 , G06F11/00 , G06F11/22 , G06F11/30 , G06F11/32 , G06F11/34 , G06F11/36 , G06F12/14 , G06F12/16 , G06F7/04 , G06F7/58
CPC分类号： H04L63/1416 , Y10S707/99953 , Y10S707/99956
摘要： A system and methods of monitoring sequences of operations in a process running on a computer system. A probabilistic detection model is defined which is configured to determine a predictive probability of an occurrence of a final operation in the sequence of operations that is conditional on a calculated number of previous operations in the sequence of operations. The probabilistic detection model is trained from a plurality of predetermined sequences of operations to calculate the number of previous operations evaluated in the probabilistic detection model. The predictive probability for the final operation in the sequence of operations is determined by using the probabilistic detection model. If the predictive probability is below a predetermined threshold, the sequence of operations is identified as an intrusion. The probabilistic detection model may use sparse distribution trees to generate a model which determines the optimal number of previous operations to be evaluated (i.e., the window size) and position of wildcards. The system and methods may be used to monitor sequences of system calls, application function calls, and machine code instructions, for example.
摘要翻译：在计算机系统上运行的进程中监视操作顺序的系统和方法。定义概率检测模型，其被配置为确定在所述操作序列中出现最终操作的预测概率，其以所计算的操作序列中的先前操作的数量为条件。从多个预定的操作序列训练概率检测模型，以计算在概率检测模型中评估的先前操作的数量。通过使用概率检测模型来确定操作顺序中的最终操作的预测概率。如果预测概率低于预定阈值，则将该操作序列识别为入侵。概率检测模型可以使用稀疏分布树来生成确定要评估的先前操作的最佳数量（即，窗口大小）和通配符的位置的模型。例如，系统和方法可以用于监视系统调用，应用程序函数调用和机器代码指令的顺序。

76. 发明授权

US5748780A Method and apparatus for imaging, image processing and data compression 失效
标题翻译：用于成像，图像处理和数据压缩的方法和装置
公开(公告)号：US5748780A
公开(公告)日：1998-05-05
申请号：US259527
申请日：1994-06-14
申请人： Salvatore J. Stolfo
发明人： Salvatore J. Stolfo
IPC分类号： G06F17/30 , G06K9/00 , G06K9/36
CPC分类号： G06Q20/042 , G06F17/30256 , G06K9/00 , G06K2209/015
摘要： A method for processing an image, consisting of a foreground and a background, to produce a highly compressed and accurate representation of the image, including the steps of scanning the image to create a digital image of the image, comparing the digital image against a codebook of stored digital images; matching the digital image with one of the stored digital images of the codebook; producing an index code identifying the background of the stored digital image as having matched the digital image; subtracting the stored digital image from the digital image to produce a second digital image representing the foreground of the stored digital image; and storing the second digital image with the index code. An apparatus is also provided for compressing images having a foreground and a background, consisting of an image scanner, a template image storage device for storing background templates, a processor system for matching a scanned image of the image with one of the background templates, resulting in a template identifier, a processor system for compensating the scanned image for the matched template to produce a foreground image, and a data compression system for compressing the foreground image.
摘要翻译：一种用于处理由前景和背景组成的图像以产生图像的高度压缩和精确表示的方法，包括扫描图像以创建图像的数字图像的步骤，将数字图像与码本进行比较存储的数字图像; 将数字图像与码本的所存储的数字图像之一进行匹配; 产生将所存储的数字图像的背景识别为与数字图像相匹配的索引码; 从数字图像中减去所存储的数字图像，以产生表示所存储的数字图像的前景的第二数字图像; 并存储具有索引码的第二数字图像。还提供了一种用于压缩具有前景和背景的图像的装置，包括图像扫描器，用于存储背景模板的模板图像存储装置，用于将图像的扫描图像与背景模板之一匹配的处理器系统，产生在模板标识符中，用于补偿用于匹配模板的扫描图像以产生前景图像的处理器系统，以及用于压缩前景图像的数据压缩系统。

77. 发明授权

US5497486A Method of merging large databases in parallel 失效
标题翻译：并行大型数据库的合并方法
公开(公告)号：US5497486A
公开(公告)日：1996-03-05
申请号：US213795
申请日：1994-03-15
申请人： Salvatore J. Stolfo , Mauricio A. Herna/ ndez
发明人： Salvatore J. Stolfo , Mauricio A. Herna/ ndez
IPC分类号： G06F7/14 , G06F7/32 , G06F17/30 , G06F7/06 , G06F7/20
CPC分类号： G06F7/14 , G06F17/30256 , G06F17/30489 , G06F7/32 , Y10S707/99935 , Y10S707/99937
摘要： The semantic integration problem for merging multiple databases of very large size, the merge/purge problem, can be solved by multiple runs of the sorted neighborhood method or the clustering method with small windows followed by the computation of the transitive closure over the results of each run. The sorted neighborhood method works well under this scheme but is computationally expensive due to the sorting phase. An alternative method based on data clustering that reduces the complexity to linear time making multiple runs followed by transitive closure feasible and efficient. A method is provided for identifying duplicate records in a database, each record having at least one field and a plurality of keys, including the steps of sorting the records according to a criteria applied to a first key; comparing a number of consecutive sorted records to each other, wherein the number is less than a number of records in said database and identifying a first group of duplicate records; storing the identity of the first group; sorting the records according to a criteria applied to a second key; comparing a number of consecutive sorted records to each other, wherein the number is less than a number of records in said database and identifying a second group of duplicate records; storing the identity of the second group; and subjecting the union of the first and second groups to transitive closure.
摘要翻译：合并/清除问题的多个数据库的语义集成问题可以通过多次运行的排序邻域方法或使用小窗口的聚类方法来解决，然后计算每个结果的传递闭包跑。排序的邻域方法在该方案下工作良好，但是由于分类阶段，计算费用很高。一种基于数据聚类的替代方法，可以将复杂度降低到线性时间，从而实现多次运行，然后传递闭包可行且高效。提供了一种用于识别数据库中的重复记录的方法，每个记录具有至少一个字段和多个密钥，包括根据应用于第一密钥的准则对记录进行排序的步骤; 将多个连续排序的记录彼此进行比较，其中所述数目小于所述数据库中的记录数量，并且识别第一组重复记录; 存储第一组的身份; 根据应用于第二个键的标准对记录进行排序; 将多个连续排序的记录彼此进行比较，其中所述数量小于所述数据库中的记录数量，并且识别第二组重复记录; 存储第二组的身份; 并使第一组和第二组的联合进行传递闭合。

78. 发明授权

US4843540A Parallel processing method 失效
标题翻译：并行处理方法
公开(公告)号：US4843540A
公开(公告)日：1989-06-27
申请号：US903031
申请日：1986-09-02
申请人： Salvatore J. Stolfo
发明人： Salvatore J. Stolfo
IPC分类号： G06F15/173 , G06F15/80
CPC分类号： G06F15/17343 , G06F15/8023
摘要： A parallel data processing system is formed as a binary tree of data processing elements. Each of the elements includes an interface unit having registers coupled to registers in the interface unit of adjacent higher and lower order elements in the binary tree. Signals comprising instructions and data for processing in the elements are broadcast to the elements via the coupled registers for simultaneous processing in the elements. Processing results are compared and reported via the registers in a resolve/report operation.
摘要翻译：并行数据处理系统形成为数据处理元件的二叉树。每个元件包括具有耦合到二叉树中的相邻较高和较低阶元件的接口单元中的寄存器的寄存器的接口单元。包括用于在元件中处理的指令和数据的信号通过耦合寄存器广播到元件，用于在元件中进行同时处理。处理结果通过解析/报告操作中的寄存器进行比较和报告。

79. 发明授权

US11288090B1 Methods, systems, and media for injecting code into embedded devices 有权
公开(公告)号：US11288090B1
公开(公告)日：2022-03-29
申请号：US16105557
申请日：2018-08-20
申请人： Ang Cui , Salvatore J. Stolfo
发明人： Ang Cui , Salvatore J. Stolfo
IPC分类号： G06F9/46 , G06F21/52 , G06F21/57 , G06F8/656 , G06F9/48 , G06F21/50 , G06F21/51 , G06F21/64 , G06F21/00 , G06F9/445
摘要： Methods, systems, and media for injecting code into embedded devices are provided. In accordance with some embodiments, methods for injecting code into embedded devices are provided, the methods comprising: embedding payload execution code into an embedded device; identifying program instructions in code of the embedded device into which jump instructions can be placed; inserting at least one jump instruction at an identified program instruction; allocating memory for storing an execution context of an injected payload; saving a context of the code of the embedded device to memory; loading and executing a payload context into a processor of the embedded device; determining when execution of the payload context is to be interrupted; and in response to determining that the execution of the payload context is to be interrupted, saving the payload context, restoring the context of the code of the embedded device, and continuing execution of the code of the embedded device.

80. 发明申请

US20220070215A1 Method and Apparatus for Evaluating Phishing Sites to Determine Their Level of Danger and Profile Phisher Behavior 有权
公开(公告)号：US20220070215A1
公开(公告)日：2022-03-03
申请号：US17462585
申请日：2021-08-31
申请人： Salvatore J. Stolfo , Shlomo Hershkop
发明人： Salvatore J. Stolfo , Shlomo Hershkop
IPC分类号： H04L29/06
摘要： Enhanced attribution of phishers and assessment of the danger level posed by phishing campaigns by applying machine learning techniques to analyze the contents of phishing websites. The danger level may be determined as a function of the amount and kind of sensitive personal information the site attempts to steal. Profiling phisher behavior may be used as advanced threat intelligence to help predict targeted website for spoofing and/or phishing campaigns. Profiling phisher behavior may be accomplished by a focused analysis of the displayed items or words generated by the code with which the phisher labels webform input fields across different websites. The model of phisher behavior may reveal a phisher's motive and intent and may be used to investigate organized phishing teams. Rating phishing sites may inform response strategies and provide more informed critical browser messaging to the user.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式