专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20100146621A1 METHOD OF EXTRACTING WINDOWS EXECUTABLE FILE USING HARDWARE BASED ON SESSION MATCHING AND PATTERN MATCHING AND APPRATUS USING THE SAME 有权
标题翻译：使用基于会话匹配和图案匹配的硬件提取WINDOWS可执行文件的方法和使用该方法的方法
公开(公告)号：US20100146621A1
公开(公告)日：2010-06-10
申请号：US12503288
申请日：2009-08-17
申请人： Byoung Koo Kim , Seung Yong Yoon , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang , Hyun Sook Cho
发明人： Byoung Koo Kim , Seung Yong Yoon , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang , Hyun Sook Cho
IPC分类号： G06F17/30 , G06F12/14 , G06F11/00 , G06F12/16 , G08B23/00
CPC分类号： H04L63/145 , G06F21/564
摘要： A method and apparatus for extracting a windows executable file that can search for a pattern related to windows executable files among a large quantity of network packets using a hardware-based session tracking and pattern matching technology and that can extract all packets included in the corresponding session are provided. The method of extracting a windows executable file includes: collecting incoming packets having a payload according to a session of a reference packet having an MZ pattern; performing a portable executable (PE) pattern matching for the collected incoming packets; and forming a PE file based on at least one incoming packet satisfying the PE pattern matching.
摘要翻译：一种用于提取Windows可执行文件的方法和装置，其可以使用基于硬件的会话跟踪和模式匹配技术在大量网络分组中搜索与Windows可执行文件相关的模式，并且可以提取包括在相应会话中的所有分组被提供。提取Windows可执行文件的方法包括：根据具有MZ模式的参考分组的会话收集具有有效载荷的传入分组; 对所收集的传入分组执行匹配的便携式可执行（PE）模式; 以及基于满足PE模式匹配的至少一个输入分组形成PE文件。

2. 发明授权

US5894470A Floating cell removing device using generic flow control and a method thereof 失效
标题翻译：使用通用流量控制的浮动电池去除装置及其方法
公开(公告)号：US5894470A
公开(公告)日：1999-04-13
申请号：US771269
申请日：1996-12-20
申请人： Jong-Oh Kim , Young-Wook Cha , Kyou-Ho Lee , Jong-Arm Jun , Ik-Kyun Kim
发明人： Jong-Oh Kim , Young-Wook Cha , Kyou-Ho Lee , Jong-Arm Jun , Ik-Kyun Kim
IPC分类号： H04L29/14 , H04L12/70 , H04Q11/04 , H04L12/56 , G06F11/00 , H04L12/28
CPC分类号： H04Q11/0478 , H04L2012/5612 , H04L2012/5627 , H04L2012/5648
摘要： A floating cell removing device using a generic flow control includes a processor having a generic flow control processing logic for transmitting/receiving a signal cell, checking a generic flow control field of an operation and maintenance cell and removing a floating cell; a pair of cell relay and add/drop function units respectively connected to a subscriber and a network of the processor, for supporting an internal communication between subscriber terminals, temporarily storing the signal cell and transmitting it to a network device; a pair of asynchronous transfer mode hierarchical function processors for converting a cell header, inserting and extracting an operation and maintenance cell, and transmitting it to the processor and the cell relay and add/drop function units; and a plurality of buffers formed between the processor and the cell relay and add/drop function units and between the cell relay and add/drop function units, for temporarily storing data inputted therefrom.
摘要翻译：使用通用流量控制的浮动单元去除装置包括具有用于发送/接收信号单元的通用流控制处理逻辑的处理器，检查操作和维护单元的通用流控制字段并移除浮动单元; 分别连接到用户和处理器的网络的一对小区中继和分插功能单元，用于支持用户终端之间的内部通信，临时存储信号小区并将其发送到网络设备; 一对异步传输模式分级功能处理器，用于转换单元头，插入和提取操作和维护单元，并将其发送到处理器和单元继电器和加/放功能单元; 以及在处理器和单元继电器之间形成的多个缓冲器以及加/减功能单元之间以及在单元继电器和加/放功能单元之间，用于临时存储从其输入的数据。

3. 发明授权

US08095973B2 Apparatus and method for detecting network attack 有权
标题翻译：网络攻击检测装置及方法
公开(公告)号：US08095973B2
公开(公告)日：2012-01-10
申请号：US11926132
申请日：2007-10-29
申请人： Ik Kyun Kim , Yang Seo Choi , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
发明人： Ik Kyun Kim , Yang Seo Choi , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
IPC分类号： G06F9/00 , G06F15/16 , G06F17/00 , G06F11/00 , G06F12/14 , G06F12/16 , G08B23/00
CPC分类号： H04L63/1408
摘要： There are provided a network attack detection apparatus and method capable of determining even unknown network attack, the apparatus connected between two networks or connected by port mirroring of an Ethernet switch to real-time monitor all packets flowing through the networks. The apparatus decodes a payload portion of an inputted network packet into a machine code instruction, determines whether an executable code is included in the decoded machine code by analyzing relationship between instructions, and determines whether the packet is harmful based on statistics with respect to a possibility that an executable code exists in a service and a certain transaction of the service when the executable code is included.
摘要翻译：提供了能够确定甚至未知网络攻击的网络攻击检测装置和方法，连接在两个网络之间的装置或通过以太网交换机的端口镜像连接的实时监视通过网络流动的所有分组的网络攻击检测装置和方法。该装置将输入的网络分组的有效载荷部分解码为机器码指令，通过分析指令之间的关系来确定解码的机器码中是否包括可执行代码，并且基于关于可能性的统计来确定分组是否有害当包括可执行代码时，可执行代码存在于服务和服务的某个事务中。

4. 发明申请

US20090133125A1 METHOD AND APPARATUS FOR MALWARE DETECTION 审中-公开
标题翻译：用于恶意软件检测的方法和装置
公开(公告)号：US20090133125A1
公开(公告)日：2009-05-21
申请号：US12209249
申请日：2008-09-12
申请人： Yang Seo Choi , Ik Kyun Kim , Byoung Koo Kim , Seung Yong Yoon , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
发明人： Yang Seo Choi , Ik Kyun Kim , Byoung Koo Kim , Seung Yong Yoon , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
IPC分类号： G06F21/00
CPC分类号： G06F21/562 , G06F21/56
摘要： The present invention relates to an apparatus and method for detecting malware. The malware detection apparatus and method of the present invention determines whether a file is malware or not by analyzing the header of an executable file. Since the malware detection apparatus and method can quickly detect presence of malware, it can shorten detection time considerably. The malware detection apparatus and method can also detect even unknown malware as well as known malware to thereby estimate and determine presence of malware. Therefore, it is possible to cope with malware in advance, protect a system with a program, and increase security level remarkably.
摘要翻译：本发明涉及一种用于检测恶意软件的装置和方法。本发明的恶意软件检测装置和方法通过分析可执行文件的标题来确定文件是否是恶意软件。由于恶意软件检测装置和方法可以快速检测恶意软件的存在，因此可以大大缩短检测时间。恶意软件检测装置和方法还可以检测甚至未知的恶意软件以及已知的恶意软件，从而估计和确定恶意软件的存在。因此，可以提前应对恶意软件，用程序保护系统，显着提高安全等级。

5. 发明申请

US20080134334A1 APPARATUS AND METHOD FOR DETECTING NETWORK ATTACK 有权
标题翻译：用于检测网络攻击的装置和方法
公开(公告)号：US20080134334A1
公开(公告)日：2008-06-05
申请号：US11926132
申请日：2007-10-29
申请人： Ik Kyun Kim , Yang Seo Choi , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
发明人： Ik Kyun Kim , Yang Seo Choi , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
IPC分类号： G06F11/00
CPC分类号： H04L63/1408
摘要： There are provided a network attack detection apparatus and method capable of determining even unknown network attack, the apparatus connected between two networks or connected by port mirroring of an Ethernet switch to real-time monitor all packets flowing through the networks. The apparatus decodes a payload portion of an inputted network packet into a machine code instruction, determines whether an executable code is included in the decoded machine code by analyzing relationship between instructions, and determines whether the packet is harmful based on statistics with respect to a possibility that an executable code exists in a service and a certain transaction of the service when the executable code is included.
摘要翻译：提供了能够确定甚至未知网络攻击的网络攻击检测装置和方法，连接在两个网络之间的装置或通过以太网交换机的端口镜像连接的实时监视通过网络流动的所有分组的网络攻击检测装置和方法。该装置将输入的网络分组的有效载荷部分解码为机器码指令，通过分析指令之间的关系来确定解码的机器码中是否包括可执行代码，并且基于关于可能性的统计来确定分组是否有害当包括可执行代码时，可执行代码存在于服务和服务的某个事务中。

6. 发明授权

US08965823B2 Insider threat detection device and method 有权
标题翻译：内部威胁检测装置及方法
公开(公告)号：US08965823B2
公开(公告)日：2015-02-24
申请号：US13475880
申请日：2012-05-18
申请人： Seon Gyoung Sohn , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
发明人： Seon Gyoung Sohn , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
IPC分类号： G06F17/00 , G06N5/02 , G08B31/00
CPC分类号： G08B31/00
摘要： The present invention relates to an insider threat detection device and method which collects and analyzes a variety of information generated by insiders working for an organization, such as behaviors, events, and states of the insider, and detects an abnormal insider who may become a potential threat. According to the present invention, the insider threat detection method and apparatus analyzes information related to insiders using the correlation analysis method, and previously detects an abnormal sign of an insider who may become a potential threat to an organization, which makes it possible to protect the organization from attacks on systems inside the organization or seizure of important information inside the organization.
摘要翻译：本发明涉及一种内部威胁检测装置和方法，其收集和分析由内部人员为内部人员行为，事件和状态等内部人员所产生的各种信息，并检测可能成为潜在的异常内部人员威胁。根据本发明，内部威胁检测方法和装置使用相关分析方法分析与内部人相关的信息，并且先前检测到可能成为对组织的潜在威胁的内部人员的异常标志，这使得可以保护组织对组织内的系统的攻击或组织内重要信息的检取。

7. 发明申请

US20130091085A1 INSIDER THREAT DETECTION DEVICE AND METHOD 有权
标题翻译：内部检测装置及方法
公开(公告)号：US20130091085A1
公开(公告)日：2013-04-11
申请号：US13475880
申请日：2012-05-18
申请人： Seon Gyoung SOHN , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
发明人： Seon Gyoung SOHN , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
IPC分类号： G06N5/02
CPC分类号： G08B31/00
摘要： The present invention relates to an insider threat detection device and method which collects and analyzes a variety of information generated by insiders working for an organization, such as behaviors, events, and states of the insider, and detects an abnormal insider who may become a potential threat. According to the present invention, the insider threat detection method and apparatus analyzes information related to insiders using the correlation analysis method, and previously detects an abnormal sign of an insider who may become a potential threat to an organization, which makes it possible to protect the organization from attacks on systems inside the organization or seizure of important information inside the organization.
摘要翻译：本发明涉及一种内部威胁检测装置和方法，其收集和分析由内部人员为内部人员行为，事件和状态等内部人员所产生的各种信息，并检测可能成为潜在的异常内部人员威胁。根据本发明，内部威胁检测方法和装置使用相关分析方法分析与内部人相关的信息，并且先前检测到可能成为对组织的潜在威胁的内部人员的异常标志，这使得可以保护组织对组织内的系统的攻击或组织内重要信息的检取。

8. 发明申请

US20120324573A1 METHOD FOR DETERMINING WHETHER OR NOT SPECIFIC NETWORK SESSION IS UNDER DENIAL-OF-SERVICE ATTACK AND METHOD FOR THE SAME 审中-公开
标题翻译：用于确定无论是否具体网络会话是否属于服务质量攻击的方法及其相关方法
公开(公告)号：US20120324573A1
公开(公告)日：2012-12-20
申请号：US13453968
申请日：2012-04-23
申请人： Dae Won KIM , Yang Seo Choi , Ik Kyun Kim
发明人： Dae Won KIM , Yang Seo Choi , Ik Kyun Kim
IPC分类号： G06F21/00 , G06F11/00
CPC分类号： H04L63/1458
摘要： Provided is an apparatus and method for determining whether or not a specific network session is under a denial-of-service (DoS) attack. The method includes detecting a packet transmitted in the session, initializing the number of attack-suspicion continuation packets, increasing the number of attack-suspicion continuation packets by a predetermined number, and determining that the session is under the DoS attack.
摘要翻译：提供了一种用于确定特定网络会话是否处于拒绝服务（DoS）攻击的装置和方法。该方法包括检测在会话中发送的分组，初始化攻击怀疑继续分组的数量，将攻击怀疑继续分组的数量增加预定数量，并确定该会话处于DoS攻击状态。

9. 发明授权

US08230503B2 Method of extracting windows executable file using hardware based on session matching and pattern matching and apparatus using the same 有权
标题翻译：基于会话匹配和模式匹配的硬件提取Windows可执行文件的方法及使用该可执行文件的方法
公开(公告)号：US08230503B2
公开(公告)日：2012-07-24
申请号：US12503288
申请日：2009-08-17
申请人： Byoung Koo Kim , Seung Yong Yoon , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang , Hyun Sook Cho
发明人： Byoung Koo Kim , Seung Yong Yoon , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang , Hyun Sook Cho
IPC分类号： H04L29/06
CPC分类号： H04L63/145 , G06F21/564
摘要： A method and apparatus for extracting a windows executable file that can search for a pattern related to windows executable files among a large quantity of network packets using a hardware-based session tracking and pattern matching technology and that can extract all packets included in the corresponding session are provided. The method of extracting a windows executable file includes: collecting incoming packets having a payload according to a session of a reference packet having an MZ pattern; performing a portable executable (PE) pattern matching for the collected incoming packets; and forming a PE file based on at least one incoming packet satisfying the PE pattern matching.
摘要翻译：一种用于提取Windows可执行文件的方法和装置，其可以使用基于硬件的会话跟踪和模式匹配技术在大量网络分组中搜索与Windows可执行文件相关的模式，并且可以提取包括在相应会话中的所有分组被提供。提取Windows可执行文件的方法包括：根据具有MZ模式的参考分组的会话收集具有有效载荷的传入分组; 对所收集的传入分组执行匹配的便携式可执行（PE）模式; 以及基于满足PE模式匹配的至少一个输入分组形成PE文件。

10. 发明申请

US20120167222A1 METHOD AND APPARATUS FOR DIAGNOSING MALICOUS FILE, AND METHOD AND APPARATUS FOR MONITORING MALICOUS FILE 审中-公开
标题翻译：用于诊断恶性病毒文件的方法和装置，以及用于监测恶性病毒文件的方法和装置
公开(公告)号：US20120167222A1
公开(公告)日：2012-06-28
申请号：US13335811
申请日：2011-12-22
申请人： Ik Kyun KIM , Yang-Seo CHOI , Byoung-Koo KIM , Seung Yong YOON , Youngjun HEO , Dae Won KIM , Il AHN CHEONG , Jintae OH , Jong Soo JANG
发明人： Ik Kyun KIM , Yang-Seo CHOI , Byoung-Koo KIM , Seung Yong YOON , Youngjun HEO , Dae Won KIM , Il AHN CHEONG , Jintae OH , Jong Soo JANG
IPC分类号： G06F21/00
CPC分类号： G06F21/563
摘要： An apparatus for diagnosing malicious files includes a information transferring unit configured to receive information regarding a malicious file distributed in a management network and an execution file generated by assembling packets collected from the management network; an anti-virus engine configured to determine whether or not the execution file is malicious to generate information regarding a new malicious file; and a management unit configured to transfer the information regarding the malicious file and the information regarding the new malicious file to a terminal device on the management network through the information transferring unit.
摘要翻译：用于诊断恶意文件的装置包括：信息传送单元，被配置为接收关于分发在管理网络中的恶意文件的信息和通过组合从管理网络收集的分组而生成的执行文件; 配置为确定所述执行文件是否是恶意的以产生关于新的恶意文件的信息的反病毒引擎; 以及管理单元，被配置为通过信息传送单元将关于恶意文件的信息和关于新的恶意文件的信息传送到管理网络上的终端设备。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式