会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 3. 发明授权
    • Apparatus and method of detecting network attack situation
    • 检测网络攻击情况的方法及装置
    • US07596810B2
    • 2009-09-29
    • US11081682
    • 2005-03-17
    • Jin Oh KimSeon Gyoung SohnHyochan BangSoo Hyung LeeDongyoung KimBeom Hwan ChangGeon Lyang KimHyun Joo KimJung Chan NaJong Soo JangSung Won Sohn
    • Jin Oh KimSeon Gyoung SohnHyochan BangSoo Hyung LeeDongyoung KimBeom Hwan ChangGeon Lyang KimHyun Joo KimJung Chan NaJong Soo JangSung Won Sohn
    • G08B23/00G06F15/173
    • H04L63/1416G06F21/552G06F21/85H04L63/1441
    • Provided is an apparatus for detecting a network attack situation. The apparatus includes an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data; an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated; a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory. Equal numbers of hash engines and detection engines for processing the alarms in the network to the number of data groups classified as network attack situations are formed in a line. Therefore, a network attack situation can be detected in real time based on a great number of alarms indicating intrusion detection.
    • 提供了一种用于检测网络攻击情况的装置。 该装置包括接收在连接有报警接收器的网络中升起的多个报警的报警接收机,将报警转换成预定报警数据,并输出报警数据; 报警处理器根据报警数据的属性和产生报警数据的次数分析网络中的攻击情况; 存储器,用于存储分析网络状态并将基本数据提供给报警处理器所需的基本数据; 以及将所述报警处理器的分析结果发送到外部设备的接口,从外部设备接收预定的临界值,所述临时值是用于确定所述攻击情况的发生的基础,并且将所述临界值输出到所述报警处理器 使得报警处理器可以将临界值存储在存储器中。 在网络中形成等同数量的散列引擎和检测引擎,用于将网络中的警报处理为分类为网络攻击情况的数据组的数量。 因此,可以基于大量表示入侵检测的告警来实时检测网络攻击情况。
    • 4. 发明授权
    • Real-time network attack pattern detection system for unknown network attack and method thereof
    • 用于未知网络攻击的实时网络攻击模式检测系统及其方法
    • US07571477B2
    • 2009-08-04
    • US11088975
    • 2005-03-24
    • Jintae OhSeung Won ShinKi Young KimJong Soo JangSung Won Sohn
    • Jintae OhSeung Won ShinKi Young KimJong Soo JangSung Won Sohn
    • G06F21/00
    • H04L63/1408
    • In a real-time network attack pattern detection system and method, a common pattern is detected in real time from packets, which are suspected to be a network attack such as Worm, to effectively block the attack. The system includes: a suspicious packet detector for classifying a suspicious attack packet from all input packets; a first data delaying unit for receiving the input packet from the suspicious packet detector to output an one-clock delayed data; a second data delaying unit for receiving an output signal from the first data delaying unit to output an one-clock delayed data; a hash key generator for receiving an output data of the suspicious packet detector, an output data of the first data delaying unit and an output data of the second data delaying unit to generate a hash key; a hash table for storing a lookup result obtained by the hash key generated from the hash key generator; and an existence & hit checker for checking the lookup result of the hash table.
    • 在实时网络攻击模式检测系统和方法中,从被怀疑是网络攻击(如蠕虫)的数据包实时检测到一个共同的模式,以有效地阻止攻击。 该系统包括:可疑包检测器,用于从所有输入分组中分类可疑攻击包; 第一数据延迟单元,用于从可疑分组检测器接收输入分组以输出一个时钟延迟的数据; 第二数据延迟单元,用于从第一数据延迟单元接收输出信号以输出一个时钟延迟的数据; 散列密钥发生器,用于接收可疑包检测器的输出数据,第一数据延迟单元的输出数据和第二数据延迟单元的输出数据以产生散列密钥; 哈希表,用于存储通过从所述散列密钥发生器生成的散列密钥获得的查找结果; 以及用于检查哈希表的查找结果的存在和命中检查器。
    • 7. 发明申请
    • APPARATUS AND METHOD OF DETECTING NETWORK ATTACK SITUATION
    • 检测网络攻击状况的装置和方法
    • US20090094699A1
    • 2009-04-09
    • US12275906
    • 2008-11-21
    • Jin Oh KIMSeon Gyoung SohnHyochan BangSoo Hyung LeeDongyoung KimBeom Hwan ChangGeon Lyang KimHyun Joo KimJung Chan NaJong Soo JangSung Won Sohn
    • Jin Oh KIMSeon Gyoung SohnHyochan BangSoo Hyung LeeDongyoung KimBeom Hwan ChangGeon Lyang KimHyun Joo KimJung Chan NaJong Soo JangSung Won Sohn
    • G06F15/18G08B23/00
    • H04L63/1416G06F21/552G06F21/85H04L63/1441
    • Provided is an apparatus for detecting a network attack situation. The apparatus includes an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data; an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated; a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory. Equal numbers of hash engines and detection engines for processing the alarms in the network to the number of data groups classified as network attack situations are formed in a line. Therefore, a network attack situation can be detected in real time based on a great number of alarms indicating intrusion detection.
    • 提供了一种用于检测网络攻击情况的装置。 该装置包括接收在连接有报警接收器的网络中升起的多个报警的报警接收机,将报警转换成预定报警数据,并输出报警数据; 报警处理器根据报警数据的属性和产生报警数据的次数分析网络中的攻击情况; 存储器,用于存储分析网络状态并将基本数据提供给报警处理器所需的基本数据; 以及将所述报警处理器的分析结果发送到外部设备的接口,从外部设备接收预定的临界值,所述临时值是用于确定所述攻击情况的发生的基础,并且将所述临界值输出到所述报警处理器 使得报警处理器可以将临界值存储在存储器中。 在网络中形成等同数量的散列引擎和检测引擎,用于将网络中的警报处理为分类为网络攻击情况的数据组的数量。 因此,可以基于大量表示入侵检测的告警来实时检测网络攻击情况。
    • 8. 发明授权
    • Apparatus and method for performing header lookup based on sequential lookup
    • 基于顺序查找执行标题查找的装置和方法
    • US07433357B2
    • 2008-10-07
    • US10993606
    • 2004-11-19
    • Jintae OhSeung Won ShinKi Young KimJong Soo JangSung Won Sohn
    • Jintae OhSeung Won ShinKi Young KimJong Soo JangSung Won Sohn
    • H04L12/50
    • H04L45/00H04L45/54H04L45/62
    • An apparatus and method for performing packet header lookup based on sequential lookup is provided. A header analyzer separates a header from a packet received via a network and outputs a lookup sequence. A unit lookup unit looks up matching the header combination rules with each field to be analyzed and input from the header analyzer based on the lookup sequence input from the header analyzer and outputs a match signal and a match address. A rule combination memory stores identification information for the header combination rules. A sequence combination memory stores lookup sequence information and sequence combination information. A rule combination unit generates match results based on the match signal input from the unit lookup unit and data read from the rule combination memory and the sequence combination memory.
    • 提供了一种用于基于顺序查找来执行分组报头查找的装置和方法。 报头分析器将报头与经由网络接收的分组分离,并输出查找序列。 单元查找单元根据从标题分析器输入的查找序列查找与标题组合规则与要分析的每个字段和从标题分析器输入的匹配,并输出匹配信号和匹配地址。 规则组合存储器存储标题组合规则的标识信息。 序列组合存储器存储查找序列信息和序列组合信息。 规则组合单元基于从单元查找单元输入的匹配信号和从规则组合存储器和序列组合存储器读取的数据产生匹配结果。