专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US07150043B2 Intrusion detection method and signature table 有权
公开(公告)号：US07150043B2
公开(公告)日：2006-12-12
申请号：US10015377
申请日：2001-12-12
申请人： Ashley Anderson Brock , Nathaniel Wook Kim , Kevin Thomas McClain
发明人： Ashley Anderson Brock , Nathaniel Wook Kim , Kevin Thomas McClain
IPC分类号： G06F11/00 , G06F11/22 , G06F11/30 , G06F11/32 , G06F11/34 , G06F11/36 , G06F12/14 , H04L9/00 , H04L9/32 , G06F7/04 , G06F7/58 , G06F15/16 , G06F15/167 , G06K19/00
CPC分类号： H04L63/1408 , G06F21/554 , H04L63/1458
摘要： Performance of a pattern-matching intrusion detection system (IDS) is improved by ranking signatures in its signature table by likelihood of occurrence, so that the table may be searched efficiently. Occurrence data associated with signatures is kept, and the ranking adaptively revised according to updates of the data. When the IDS detects a system event, the signature table is searched. If the search does not find a signature matching the event, thereby suggesting that the event poses no threat, a null signature is added to the signature table in a strategic location to terminate future searches early. In one embodiment, null signatures may be stored in a cache. When a system event is detected, the cache is searched. If a match is not found, the signature table is searched. If a match is not found in the signature table, a null signature is cached.

2. 发明授权

US07308714B2 Limiting the output of alerts generated by an intrusion detection sensor during a denial of service attack 有权
标题翻译：在拒绝服务攻击期间限制入侵检测传感器产生的警报输出
公开(公告)号：US07308714B2
公开(公告)日：2007-12-11
申请号：US09966227
申请日：2001-09-27
申请人： Jeffrey Scott Bardsley , Ashley Anderson Brock , Nathaniel Wook Kim , Charles Steven Lingafelt
发明人： Jeffrey Scott Bardsley , Ashley Anderson Brock , Nathaniel Wook Kim , Charles Steven Lingafelt
IPC分类号： G06F21/00 , G06F7/04 , G06F15/173 , G06F11/00
CPC分类号： H04L63/1408 , G06F21/55 , G06F2221/2101 , H04L63/1458
摘要： An intrusion detection system is improved by altering its signatures and thresholds during a denial of service attack, in order to decrease the rate at which an intrusion detection sensor sends alerts to an intrusion detection server. A governor within the sensor is associated with each signature. The governor may include an alert log, a timer, an alert-generation-rate threshold, and rules that prescribe actions to be taken when the alert-generation-rate threshold is exceeded. The governor records the generation time of each alert by the sensor, and determines the rate at which the sensor is presently generating alerts. When the present alert-generation rate exceeds the alert-generation-rate threshold, the governor alters the associated signature threshold to decrease the alert generation rate of the intrusion detection sensor.
摘要翻译：通过在拒绝服务攻击期间改变其签名和阈值来改进入侵检测系统，以便降低入侵检测传感器向入侵检测服务器发送警报的速率。传感器内的调速器与每个签名相关联。调速器可以包括警报日志，定时器，警报生成速率阈值以及规定当超过警报生成速率阈值时采取的动作的规则。调速器记录传感器每个警报的生成时间，并确定传感器当前正在生成警报的速率。当当前警报生成速率超过警报生成速率阈值时，调速器改变相关联的签名阈值，以降低入侵检测传感器的警报生成速率。

3. 发明授权

US06928549B2 Dynamic intrusion detection for computer systems 有权
标题翻译：计算机系统的动态入侵检测
公开(公告)号：US06928549B2
公开(公告)日：2005-08-09
申请号：US09901443
申请日：2001-07-09
申请人： Ashley Anderson Brock , Nathaniel Wook Kim , Charles Steven Lingafelt
发明人： Ashley Anderson Brock , Nathaniel Wook Kim , Charles Steven Lingafelt
IPC分类号： G06F21/00 , G06F1/24
CPC分类号： G06F21/554
摘要： An intrusion detection system monitors for signature events, which are part of base intrusion sets that include signature event counters, signature thresholds, and base actions. Associated with each base intrusion set is an action set including an action counter, an action threshold, and an action variable. The associated action counter is updated when the base action of the base intrusion set is invoked responsive to the count of associated signature events meeting the associated signature threshold. The action counter is compared with an action threshold. If the action counter meets the threshold, the associated action variable is updated. The action variable is then passed to an analysis engine comprising a set of rules, which analyses the action variable either in isolation or together with other action variables associated with other base intrusion sets. According to the analysis, an element of a base intrusion set or an action set may be changed.
摘要翻译：入侵检测系统监视签名事件，这是基于入侵集的一部分，包括签名事件计数器，签名阈值和基本操作。与每个基本入侵集相关联的是包括动作计数器，动作阈值和动作变量的动作集合。响应于满足关联签名阈值的关联签名事件的计数来调用基本入侵集合的基本操作时，相关联的动作计数器被更新。动作计数器与动作阈值进行比较。如果动作计数器满足阈值，则更新关联的动作变量。然后将该操作变量传递给包含一组规则的分析引擎，该规则分离操作变量或与其他基础入侵集相关的其他操作变量一起分析。根据分析，可以改变基本入侵组或动作集的元素。

4. 发明授权

US07845004B2 Correlating network information and intrusion information to find the entry point of an attack upon a protected computer 有权
标题翻译：关联网络信息和入侵信息，以查找受保护计算机上攻击的入口点
公开(公告)号：US07845004B2
公开(公告)日：2010-11-30
申请号：US09917368
申请日：2001-07-27
申请人： Jeffrey Scott Bardsley , Ashley Anderson Brock , Nathaniel Wook Kim , Charles Steven Lingafelt
发明人： Jeffrey Scott Bardsley , Ashley Anderson Brock , Nathaniel Wook Kim , Charles Steven Lingafelt
IPC分类号： G08B23/00
CPC分类号： H04L63/1458 , G06F21/55 , H04L63/1408
摘要： A method for determining the entry point of an attack by a vandal such as a hacker upon a device such as a computer or a server such as a web server that operates under the protection of an intrusion detection system. Intrusion detection information regarding the attack and network information regarding the attack are correlated, and the entry point of the attack thereby deduced. In one embodiment, a source address of a message representative of the attack is found in a router table of a router that provides a connection supporting the attack. Logical ports of the connection are determined, and the corresponding physical ports found, thereby identifying the attack's entry point into the protected device.
摘要翻译：一种用于在诸如计算机或服务器（诸如在入侵检测系统的保护下操作的web服务器）的设备上确定诸如黑客之类的破坏者的攻击的入口点的方法。关于攻击的入侵检测信息和有关攻击的网络信息相关，从而推断攻击的入口点。在一个实施例中，代表攻击的消息的源地址在提供支持攻击的连接的路由器的路由器表中找到。确定连接的逻辑端口，并找到相应的物理端口，从而将攻击入口点识别到受保护的设备。

5. 发明授权

US07730537B2 Method of operating an intrusion detection system 有权
标题翻译：操作入侵检测系统的方法
公开(公告)号：US07730537B2
公开(公告)日：2010-06-01
申请号：US11841214
申请日：2007-08-20
申请人： Jeffrey Scott Bardsley , Ashley Anderson Brock , Nathaniel Wook Kim , Charles Steven Lingafelt
发明人： Jeffrey Scott Bardsley , Ashley Anderson Brock , Nathaniel Wook Kim , Charles Steven Lingafelt
IPC分类号： G06F21/00 , G06F7/04 , G06F15/173 , G06F11/00
CPC分类号： H04L63/1408 , G06F21/55 , G06F2221/2101 , H04L63/1458
摘要： A method of operating an intrusion detection system. The system determines occurrence of a signature event indicative of a denial of service intrusion on a protected device. A value of a signature event counter is increased. The value of the signature event counter is adjusted to not include a count of signature events past a sliding window. The value of the signature event counter is determined to exceed a signature threshold quantity, followed by generation of an alert at a time subsequently recorded in a log. The log is cleared of entries past a permissible age. A present alert generation rate is determined as a ratio of the total number of timestamps in the log to the permissible age. The present alert generation rate is ascertained to exceed an alert generation rate threshold. A selected element of the signature set is altered to decrease the alert generation rate.
摘要翻译：一种操作入侵检测系统的方法。该系统确定在被保护设备上指示拒绝服务入侵的签名事件的发生。签名事件计数器的值增加。签名事件计数器的值被调整为不包括通过滑动窗口的签名事件的计数。签名事件计数器的值被确定为超过签名阈值量，随后在随后记录在日志中的时间生成警报。日志清除超过许可年龄的条目。当前的警报生成速率被确定为日志中的时间戳的总数与允许的年龄之间的比率。确定当前警报生成速率超过警报生成速率阈值。更改签名集的选定元素以降低警报生成速率。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式