专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08965823B2 Insider threat detection device and method 有权
标题翻译：内部威胁检测装置及方法
公开(公告)号：US08965823B2
公开(公告)日：2015-02-24
申请号：US13475880
申请日：2012-05-18
申请人： Seon Gyoung Sohn , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
发明人： Seon Gyoung Sohn , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
IPC分类号： G06F17/00 , G06N5/02 , G08B31/00
CPC分类号： G08B31/00
摘要： The present invention relates to an insider threat detection device and method which collects and analyzes a variety of information generated by insiders working for an organization, such as behaviors, events, and states of the insider, and detects an abnormal insider who may become a potential threat. According to the present invention, the insider threat detection method and apparatus analyzes information related to insiders using the correlation analysis method, and previously detects an abnormal sign of an insider who may become a potential threat to an organization, which makes it possible to protect the organization from attacks on systems inside the organization or seizure of important information inside the organization.
摘要翻译：本发明涉及一种内部威胁检测装置和方法，其收集和分析由内部人员为内部人员行为，事件和状态等内部人员所产生的各种信息，并检测可能成为潜在的异常内部人员威胁。根据本发明，内部威胁检测方法和装置使用相关分析方法分析与内部人相关的信息，并且先前检测到可能成为对组织的潜在威胁的内部人员的异常标志，这使得可以保护组织对组织内的系统的攻击或组织内重要信息的检取。

2. 发明授权

US08775613B2 Method and system for providing network monitoring, security event collection apparatus and service abnormality detection apparatus for network monitoring 有权
标题翻译：用于网络监控的方法和系统，用于网络监控的安全事件收集装置和业务异常检测装置
公开(公告)号：US08775613B2
公开(公告)日：2014-07-08
申请号：US13272687
申请日：2011-10-13
申请人： Beom Hwan Chang , Chi Yoon Jeong , Seon-Gyoung Sohn
发明人： Beom Hwan Chang , Chi Yoon Jeong , Seon-Gyoung Sohn
IPC分类号： G06F15/173
CPC分类号： H04L63/1425 , H04L43/00 , H04L43/045
摘要： A network monitoring system includes: a traffic information generating apparatus for generating traffic information. Further, the network monitoring system includes a security event collecting apparatus for collecting the traffic information generated by the traffic information generating apparatus by referring to pre-stored traffic information, grouping the collected traffic information, and then extracting service information. Furthermore, the network monitoring system includes a service abnormal condition detecting apparatus for detecting a port number of a transport layer of service information extracted from the security event collecting apparatus and the occurrence frequency of the transport layer, determining the continuity of the port number and the uniformity of the occurrence frequency, and displaying a service abnormal condition.
摘要翻译：网络监控系统包括：交通信息生成装置，用于产生交通信息。此外，网络监视系统包括：安全事件收集装置，用于通过参考预先存储的交通信息，分组所收集的交通信息，然后提取服务信息来收集由交通信息产生装置产生的交通信息。此外，网络监视系统包括：服务异常状况检测装置，用于检测从安全事件收集装置提取的服务信息的传输层的端口号和传输层的出现频率，确定端口号的连续性和发生频率的均匀性，并显示服务异常状况。

3. 发明申请

US20130091085A1 INSIDER THREAT DETECTION DEVICE AND METHOD 有权
标题翻译：内部检测装置及方法
公开(公告)号：US20130091085A1
公开(公告)日：2013-04-11
申请号：US13475880
申请日：2012-05-18
申请人： Seon Gyoung SOHN , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
发明人： Seon Gyoung SOHN , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
IPC分类号： G06N5/02
CPC分类号： G08B31/00
摘要： The present invention relates to an insider threat detection device and method which collects and analyzes a variety of information generated by insiders working for an organization, such as behaviors, events, and states of the insider, and detects an abnormal insider who may become a potential threat. According to the present invention, the insider threat detection method and apparatus analyzes information related to insiders using the correlation analysis method, and previously detects an abnormal sign of an insider who may become a potential threat to an organization, which makes it possible to protect the organization from attacks on systems inside the organization or seizure of important information inside the organization.
摘要翻译：本发明涉及一种内部威胁检测装置和方法，其收集和分析由内部人员为内部人员行为，事件和状态等内部人员所产生的各种信息，并检测可能成为潜在的异常内部人员威胁。根据本发明，内部威胁检测方法和装置使用相关分析方法分析与内部人相关的信息，并且先前检测到可能成为对组织的潜在威胁的内部人员的异常标志，这使得可以保护组织对组织内的系统的攻击或组织内重要信息的检取。

4. 发明授权

US08307441B2 Log-based traceback system and method using centroid decomposition technique 有权
标题翻译：基于Log的追溯系统和使用重心分解技术的方法
公开(公告)号：US08307441B2
公开(公告)日：2012-11-06
申请号：US12669633
申请日：2007-11-21
申请人： Jong Hyun Kim , Geon Lyang Kim , Seon Gyoung Sohn , Beom Hwan Chang , Chi Yoon Jeong , Jong Ho Ryu , Jung Chan Na , Jong Soo Jang , Sung Won Sohn
发明人： Jong Hyun Kim , Geon Lyang Kim , Seon Gyoung Sohn , Beom Hwan Chang , Chi Yoon Jeong , Jong Ho Ryu , Jung Chan Na , Jong Soo Jang , Sung Won Sohn
IPC分类号： G06F11/34
CPC分类号： H04L45/00 , H04L45/12 , H04L63/1416 , H04L63/1425 , H04L63/1441 , H04L2463/146
摘要： There are provided a system and method for tracing back an attacker by using centroid decomposition technique, the system including: a log data input module collecting log data of an intrusion alarm from an intrusion detection system; a centroid node detection module generating a shortest path tree by applying a shortest path algorithm to network router connection information collected by a network administration server, detecting a centroid node by applying centroid decomposition technique removing a leaf-node to the shortest path tree, and generating a centroid tree whose node of each level is the detected centroid node; and a traceback processing module requesting log data of a router matched with the node of each level of the centroid tree, and tracing back a router identical to the log data of the collected intrusion alarm as a router connected to a source of an attacker by comparing the log data of the router with the log data of the collected intrusion alarm. According to the system and method, an attacker causing a security intrusion event may be quickly detected, a load on the system is reduced, and a passage host exposed to a danger or having weaknesses may be easily recognized, thereby easily coping with an attack.
摘要翻译：提供了一种通过使用质心分解技术跟踪攻击者的系统和方法，该系统包括：日志数据输入模块，从入侵检测系统收集入侵警报的日志数据; 质心节点检测模块，通过对网络管理服务器收集的网络路由器连接信息应用最短路径算法，生成最短路径树，通过应用质心分解技术检测质心节点，去除叶节点到最短路径树，并生成每个级别的节点是检测到的质心节点的质心树; 以及回溯处理模块，请求与质心树的每个级别的节点匹配的路由器的日志数据，并且通过比较来跟踪与收集的入侵警报器的日志数据相同的路由器作为连接到攻击者的源的路由器路由器的日志数据与收集的入侵报警的日志数据。根据系统和方法，可以快速地检测到导致安全入侵事件的攻击者，系统上的负载减少，并且易于识别暴露于危险或具有弱点的通道主机，从而容易地应对攻击。

5. 发明授权

US08014310B2 Apparatus and method for visualizing network situation using security cube 有权
标题翻译：使用安全立方体可视化网络情况的装置和方法
公开(公告)号：US08014310B2
公开(公告)日：2011-09-06
申请号：US12516494
申请日：2007-08-23
申请人： Beom-Hwan Chang , Chi-Yoon Jeong , Seon-Gyoung Sohn , Soo-Hyung Lee , Hyo-Chan Bang , Geon-Lyang Kim , Hyun-Joo Kim , Won-Joo Park , Jong-Ho Ryu , Jong-Hyun Kim , Jong-Soo Jang , Sung-Won Sohn , Jung-Chan Na
发明人： Beom-Hwan Chang , Chi-Yoon Jeong , Seon-Gyoung Sohn , Soo-Hyung Lee , Hyo-Chan Bang , Geon-Lyang Kim , Hyun-Joo Kim , Won-Joo Park , Jong-Ho Ryu , Jong-Hyun Kim , Jong-Soo Jang , Sung-Won Sohn , Jung-Chan Na
IPC分类号： H04L12/26
CPC分类号： H04L63/1441 , H04L63/20
摘要： An apparatus and method for visualizing a network condition related to a network security are provided. The apparatus includes a traffic feature extracting unit, a network condition displaying unit, and a traffic abnormal condition determining unit. The traffic feature extracting unit extracts information including source address, source port, destination address, and destination port from network traffics, selects two of the extracted information, and calculates unique dispersion degrees of two unselected information. The network condition displaying unit displays a two-dimensional cube expressed using the calculated unique dispersion degrees for the classified traffics. The traffic abnormal condition determining unit determines whether the traffics are in an abnormal condition or not based on the two-dimensional security cube.
摘要翻译：提供了一种用于可视化与网络安全相关的网络条件的装置和方法。该装置包括交通特征提取单元，网络状态显示单元和交通异常状况判定单元。流量特征提取单元从网络流量提取包括源地址，源端口，目的地址和目的地端口的信息，选择两个提取的信息，并计算两个未选择信息的唯一色散度。网络条件显示单元显示使用所计算的分类业务的唯一色散度表示的二维立方体。交通异常判定单元基于二维安全立方体来判定是否处于异常状态。

6. 发明申请

US20110122132A1 APPARATUS AND METHOD OF MANAGING OBJECTS AND EVENTS WITH VECTOR-BASED GEOGRAPHIC INFORMATION SYSTEM 审中-公开
标题翻译：使用基于矢量的地理信息系统管理物体和事件的装置和方法
公开(公告)号：US20110122132A1
公开(公告)日：2011-05-26
申请号：US12782891
申请日：2010-05-19
申请人： Geon Lyang KIM , Beom Hwan Chang , Chi Yoon Jeong
发明人： Geon Lyang KIM , Beom Hwan Chang , Chi Yoon Jeong
IPC分类号： G08B5/22 , G06T17/00
CPC分类号： G06T17/05
摘要： Provided are an apparatus and method of managing objects and events for easily enabling intuitive management and the recognition of cases in linkage with geographic information. The apparatus links objects and events to geographic information with a vector-based GIS to display them on a vector-based digital map, thereby providing an intuitive and realistic interface to a manager. Accordingly, the apparatus can display a more accurate location than an image-based map, and can select a kind of map information that is desired by a user to configure a map screen.
摘要翻译：提供了一种管理对象和事件的装置和方法，用于容易地实现与地理信息相关联的直观管理和识别。该装置使用基于矢量的GIS将对象和事件链接到地理信息，以在基于矢量的数字地图上显示它们，从而为管理者提供直观和逼真的界面。因此，该装置可以显示比基于图像的地图更准确的位置，并且可以选择用户期望配置地图画面的一种地图信息。

7. 发明申请

US20110016525A1 APPARATUS AND METHOD FOR DETECTING NETWORK ATTACK BASED ON VISUAL DATA ANALYSIS 审中-公开
标题翻译：基于视觉数据分析检测网络攻击的装置和方法
公开(公告)号：US20110016525A1
公开(公告)日：2011-01-20
申请号：US12630672
申请日：2009-12-03
申请人： Chi Yoon Jeong , Beom-Hwan Chang , Seon-Gyoung Sohn , Johg Ho Ryu , Geon Lyang Kim , Jonghyun Kim , Jung-Chan Na , Hyun sook Cho
发明人： Chi Yoon Jeong , Beom-Hwan Chang , Seon-Gyoung Sohn , Johg Ho Ryu , Geon Lyang Kim , Jonghyun Kim , Jung-Chan Na , Hyun sook Cho
IPC分类号： G06F21/00 , G06K9/68
CPC分类号： H04L63/1425
摘要： An apparatus for detecting a network attack includes a traffic image generator for generating a traffic image using traffic information and additional IP information extracted from the traffic information; a network attack detector for comparing similarities between the traffic image and a previously generated traffic image based on a predetermined similarity threshold to detect the presence of the network attack; and a network attack analyzer for analyzing the traffic image at a time when the network attack is detected to detect network attack information and pattern information of the network attack. A representation unit for visualizing the network attack information and the pattern information of the network attack.
摘要翻译：用于检测网络攻击的装置包括业务图像生成器，用于使用从业务信息提取的业务信息和附加IP信息来生成业务图像; 网络攻击检测器，用于基于预定的相似性阈值来比较业务图像和先前生成的业务图像之间的相似性，以检测网络攻击的存在; 以及网络攻击分析器，用于在检测到网络攻击时分析流量图像，以检测网络攻击信息和网络攻击的模式信息。用于可视化网络攻击信息和网络攻击的模式信息的表示单元。

8. 发明申请

US20100212013A1 LOG-BASED TRACEBACK SYSTEM AND METHOD USING CENTROID DECOMPOSITION TECHNIQUE 有权
标题翻译：基于LOG的跟踪系统和使用中心分解技术的方法
公开(公告)号：US20100212013A1
公开(公告)日：2010-08-19
申请号：US12669633
申请日：2007-11-21
申请人： Jong Hyun Kim , Geon Lyang Kim , Seon Gyoung Sohn , Beom Hwan Chang , Chi Yoon Jeong , Jong Ho Ryu , Jung Chan Na , Jong Soo Jang , Sung Won Sohn
发明人： Jong Hyun Kim , Geon Lyang Kim , Seon Gyoung Sohn , Beom Hwan Chang , Chi Yoon Jeong , Jong Ho Ryu , Jung Chan Na , Jong Soo Jang , Sung Won Sohn
IPC分类号： G06F11/34
CPC分类号： H04L45/00 , H04L45/12 , H04L63/1416 , H04L63/1425 , H04L63/1441 , H04L2463/146
摘要： There are provided a system and method for tracing back an attacker by using centroid decomposition technique, the system including: a log data input module collecting log data of an intrusion alarm from an intrusion detection system; a centroid node detection module generating a shortest path tree by applying a shortest path algorithm to network router connection information collected by a network administration server, detecting a centroid node by applying centroid decomposition technique removing a leaf-node to the shortest path tree, and generating a centroid tree whose node of each level is the detected centroid node; and a traceback processing module requesting log data of a router matched with the node of each level of the centroid tree, and tracing back a router identical to the log data of the collected intrusion alarm as a router connected to a source of an attacker by comparing the log data of the router with the log data of the collected intrusion alarm. According to the system and method, an attacker causing a security intrusion event may be quickly detected, a load on the system is reduced, and a passage host exposed to a danger or having weaknesses may be easily recognized, thereby easily coping with an attack.
摘要翻译：提供了一种通过使用质心分解技术跟踪攻击者的系统和方法，该系统包括：日志数据输入模块，从入侵检测系统收集入侵警报的日志数据; 质心节点检测模块，通过对网络管理服务器收集的网络路由器连接信息应用最短路径算法，生成最短路径树，通过应用质心分解技术检测质心节点，去除叶节点到最短路径树，并生成每个级别的节点是检测到的质心节点的质心树; 以及回溯处理模块，请求与质心树的每个级别的节点匹配的路由器的日志数据，并且通过比较来跟踪与收集的入侵警报器的日志数据相同的路由器作为连接到攻击者的源的路由器路由器的日志数据与收集的入侵报警的日志数据。根据系统和方法，可以快速地检测到导致安全入侵事件的攻击者，系统上的负载减少，并且易于识别暴露于危险或具有弱点的通道主机，从而容易地应对攻击。

9. 发明申请

US20100067391A1 APPARATUS AND METHOD FOR VISUALIZING NETWORK SITUATION USING SECURITY CUBE 有权
标题翻译：使用安全库可视化网络状况的装置和方法
公开(公告)号：US20100067391A1
公开(公告)日：2010-03-18
申请号：US12516494
申请日：2007-08-23
申请人： Beom-Hwan Chang , Chi-Yoon Jeong , Seon-Gyoung Sohn , Soo-Hyung Lee , Hyo-Chan Bang , Geon-Lyang Kim , Hyun-Joo Kim , Won-Joo Park , Jong-Ho Ryu , Jong-Hyun Kim , Jong-Soo Jang , Sung-Won Sohn , Jung-Chan Na
发明人： Beom-Hwan Chang , Chi-Yoon Jeong , Seon-Gyoung Sohn , Soo-Hyung Lee , Hyo-Chan Bang , Geon-Lyang Kim , Hyun-Joo Kim , Won-Joo Park , Jong-Ho Ryu , Jong-Hyun Kim , Jong-Soo Jang , Sung-Won Sohn , Jung-Chan Na
IPC分类号： H04L12/26
CPC分类号： H04L63/1441 , H04L63/20
摘要： An apparatus and method for visualizing a network condition related to a network security are provided. The apparatus includes a traffic feature extracting unit, a network condition displaying unit, and a traffic abnormal condition determining unit. The traffic feature extracting unit extracts information including source address, source port, destination address, and destination port from network traffics, selects two of the extracted information, and calculates unique dispersion degrees of two unselected information. The network condition displaying unit displays a two-dimensional cube expressed using the calculated unique dispersion degrees for the classified traffics. The traffic abnormal condition determining unit determines whether the traffics are in an abnormal condition or not based on the two-dimensional security cube.
摘要翻译：提供了一种用于可视化与网络安全相关的网络状况的装置和方法。该装置包括交通特征提取单元，网络状态显示单元和交通异常状况判定单元。流量特征提取单元从网络流量提取包括源地址，源端口，目的地址和目的地端口的信息，选择两个提取的信息，并计算两个未选择信息的唯一色散度。网络条件显示单元显示使用所计算的分类业务的唯一色散度表示的二维立方体。交通异常判定单元基于二维安全立方体来判定是否处于异常状态。

10. 发明申请

US20100036781A1 APPARATUS AND METHOD PROVIDING RETRIEVAL OF ILLEGAL MOTION PICTURE DATA 审中-公开
标题翻译：提供非法运动图像数据检索的装置和方法
公开(公告)号：US20100036781A1
公开(公告)日：2010-02-11
申请号：US12465900
申请日：2009-05-14
申请人： Byeong Cheol CHOI , Seung Wan HAN , Chi Yoon JEONG , Jae Deok LIM , So Hee PARK , Jeong Nyeo KIM
发明人： Byeong Cheol CHOI , Seung Wan HAN , Chi Yoon JEONG , Jae Deok LIM , So Hee PARK , Jeong Nyeo KIM
IPC分类号： G06F15/18 , G06N5/02
CPC分类号： H04N21/23418 , G06F21/105 , G06F2221/074 , H04N21/266 , H04N21/8453
摘要： Provided are an apparatus and method for detecting illegal motion picture data. The apparatus includes a key frame extractor for extracting a plurality of key frames from motion picture data, a characteristic value file generator for detecting characteristic values of the extracted key frames and generating a characteristic value file, and an illegality determiner for measuring degree of similarity between a previously stored learning model file and the characteristic value file and determining whether or not the motion picture data is legal according to the degree of similarity.
摘要翻译：提供了一种用于检测非法运动图像数据的装置和方法。该装置包括用于从运动图像数据中提取多个关键帧的关键帧提取器，用于检测所提取的关键帧的特征值并生成特征值文件的特征值文件生成器，以及用于测量各个关键帧之间的相似度的非法确定器先前存储的学习模型文件和特征值文件，并且根据相似度确定运动图像数据是否合法。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式