专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08448242B2 Systems, methods, and media for outputting data based upon anomaly detection 有权
标题翻译：基于异常检测输出数据的系统，方法和媒体
公开(公告)号：US08448242B2
公开(公告)日：2013-05-21
申请号：US12280970
申请日：2007-02-28
申请人： Salvatore J Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J Stolfo , Ke Wang , Janak Parekh
IPC分类号： G06F21/00
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting data based on anomaly detection are provided. In some embodiments, methods for outputting data based on anomaly detection include: receiving a known-good dataset; storing distinct n-grams from the known-good dataset to form a binary anomaly detection model; receiving known-good new n-grams; computing a rate of receipt of distinct n-grams in the new n-grams; determining whether further training of the anomaly detection model is necessary based on the rate of receipt on distinct n-grams; using the binary anomaly detection model to determine whether an input dataset contains an anomaly; and outputting the input dataset based on whether the input dataset contains an anomaly.
摘要翻译：提供了基于异常检测输出数据的系统，方法和媒体。在一些实施例中，用于基于异常检测输出数据的方法包括：接收已知的数据集; 从已知的数据集中存储不同的n-gram，形成二进制异常检测模型; 接收已知好的新n克; 计算在新的n克中收到不同n克的比率; 根据不同n-gram的收货率确定是否需要进一步训练异常检测模型; 使用二进制异常检测模型来确定输入数据集是否包含异常; 以及基于输入数据集是否包含异常来输出输入数据集。

2. 发明申请

US20100064368A1 Systems, Methods, and Media for Outputting a Dataset Based Upon Anomaly Detection 有权
标题翻译：基于异常检测输出数据集的系统，方法和媒体
公开(公告)号：US20100064368A1
公开(公告)日：2010-03-11
申请号：US12280969
申请日：2007-02-28
申请人： Salvatore J Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J Stolfo , Ke Wang , Janak Parekh
IPC分类号： G06F12/14
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting a dataset based upon anomaly detection are provided. In some embodiments, methods for outputting a dataset based upon anomaly detection: receive a training dataset having a plurality of n-grams, which plurality includes a first plurality of distinct training n-grams each being a first size; compute a first plurality of appearance frequencies, each for a corresponding one of the first plurality of distinct training n-grams; receive an input dataset including first input n-grams each being the first size; define a first window in the input dataset; identify as being first matching n-grams, the first input n-grams in the first window that correspond to the first plurality of distinct training n-grams; compute a first anomaly detection score for the input dataset using the first matching n-grams and the first plurality of appearance frequencies; and output the input dataset based on the first anomaly detection score.
摘要翻译：提供了基于异常检测输出数据集的系统，方法和媒体。在一些实施例中，用于基于异常检测输出数据集的方法：接收具有多个n克的训练数据集，所述训练数据集多个包括第一组多个不同的训练n克，每个训练数据集是第一大小; 计算第一多个出现频率，每个出现频率分别针对第一组多个不同训练n-gram中的对应的一个; 接收一个输入数据集，其中包括第一个输入的n-gram，每个都是第一个大小; 在输入数据集中定义第一个窗口; 确定为首次匹配n-gram，第一个窗口中的第一个输入n-gram对应于第一个多个不同的训练n-gram; 使用所述第一匹配n克和所述第一多个出现频率来计算所述输入数据集的第一异常检测分数; 并基于第一异常检测分数输出输入数据集。

3. 发明申请

US20150186647A1 SYSTEMS, METHODS, AND MEDIA FOR OUTPUTTING DATA BASED ON ANOMALY DETECTION 审中-公开
标题翻译：基于异常检测的输出数据的系统，方法和媒体
公开(公告)号：US20150186647A1
公开(公告)日：2015-07-02
申请号：US14634101
申请日：2015-02-27
申请人： Salvatore J. Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J. Stolfo , Ke Wang , Janak Parekh
IPC分类号： G06F21/56
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting data based on anomaly detection are provided. In some embodiments, a method for outputting data based on anomaly detection is provided, the method comprising: receiving, using a hardware processor, an input dataset; identifying grams in the input dataset that substantially include distinct byte values; creating an input subset by removing the identified grams from the input dataset; determining whether the input dataset is likely to be anomalous based on the identified grams, and determining whether the input dataset is likely to be anomalous by applying the input subset to a binary anomaly detection model to check for an n-gram in the input subset; and outputting the input dataset based on the likelihood that the input dataset is anomalous.
摘要翻译：提供了基于异常检测输出数据的系统，方法和媒体。在一些实施例中，提供了一种用于基于异常检测输出数据的方法，所述方法包括：使用硬件处理器接收输入数据集; 识别基本上包含不同字节值的输入数据集中的克数; 通过从输入数据集中移除所识别的克来创建输入子集; 基于所识别的克确定输入数据集是否可能是异常的，并且通过将输入子集应用于二进制异常检测模型来确定输入数据集是否可能是异常的，以检查输入子集中的n-gram; 并且基于输入数据集是异常的可能性来输出输入数据集。

4. 发明授权

US08381299B2 Systems, methods, and media for outputting a dataset based upon anomaly detection 有权
标题翻译：基于异常检测输出数据集的系统，方法和媒体
公开(公告)号：US08381299B2
公开(公告)日：2013-02-19
申请号：US12280969
申请日：2007-02-28
申请人： Salvatore J Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J Stolfo , Ke Wang , Janak Parekh
IPC分类号： H04L29/06
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting a dataset based upon anomaly detection are provided. In some embodiments, methods for outputting a dataset based upon anomaly detection: receive a training dataset having a plurality of n-grams, which plurality includes a first plurality of distinct training n-grams each being a first size; compute a first plurality of appearance frequencies, each for a corresponding one of the first plurality of distinct training n-grams; receive an input dataset including first input n-grams each being the first size; define a first window in the input dataset; identify as being first matching n-grams, the first input n-grams in the first window that correspond to the first plurality of distinct training n-grams; compute a first anomaly detection score for the input dataset using the first matching n-grams and the first plurality of appearance frequencies; and output the input dataset based on the first anomaly detection score.
摘要翻译：提供了基于异常检测输出数据集的系统，方法和媒体。在一些实施例中，用于基于异常检测输出数据集的方法：接收具有多个n克的训练数据集，所述训练数据集多个包括第一组多个不同的训练n克，每个训练数据集是第一大小; 计算第一多个出现频率，每个出现频率分别针对第一组多个不同训练n-gram中的对应的一个; 接收一个输入数据集，其中包括第一个输入的n-gram，每个都是第一个大小; 在输入数据集中定义第一个窗口; 确定为首次匹配n-gram，第一个窗口中的第一个输入n-gram对应于第一个多个不同的训练n-gram; 使用所述第一匹配n克和所述第一多个出现频率来计算所述输入数据集的第一异常检测分数; 并基于第一异常检测分数输出输入数据集。

5. 发明申请

US20090193293A1 Systems, Methods, and Media for Outputting Data Based Upon Anomaly Detection 有权
标题翻译：基于异常检测输出数据的系统，方法和媒体
公开(公告)号：US20090193293A1
公开(公告)日：2009-07-30
申请号：US12280970
申请日：2007-02-28
申请人： Salvatore J. Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J. Stolfo , Ke Wang , Janak Parekh
IPC分类号： G06F11/00
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting data based on anomaly detection are provided. In some embodiments, methods for outputting data based on anomaly detection include: receiving a known-good dataset; storing distinct n-grams from the known-good dataset to form a binary anomaly detection model; receiving known-good new n-grams; computing a rate of receipt of distinct n-grams in the new n-grams; determining whether further training of the anomaly detection model is necessary based on the rate of receipt on distinct n-grams; using the binary anomaly detection model to determine whether an input dataset contains an anomaly; and outputting the input dataset based on whether the input dataset contains an anomaly.
摘要翻译：提供了基于异常检测输出数据的系统，方法和媒体。在一些实施例中，用于基于异常检测输出数据的方法包括：接收已知的数据集; 从已知的数据集中存储不同的n-gram，形成二进制异常检测模型; 接收已知好的新n克; 计算在新的n克中收到不同n克的比率; 根据不同n-gram的收货率确定是否需要进一步训练异常检测模型; 使用二进制异常检测模型来确定输入数据集是否包含异常; 以及基于输入数据集是否包含异常来输出输入数据集。

6. 发明授权

US09003523B2 Systems, methods, and media for outputting data based upon anomaly detection 有权
标题翻译：基于异常检测输出数据的系统，方法和媒体
公开(公告)号：US09003523B2
公开(公告)日：2015-04-07
申请号：US13891031
申请日：2013-05-09
申请人： Salvatore J Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J Stolfo , Ke Wang , Janak Parekh
IPC分类号： G06F21/00 , H04L29/06
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting data based on anomaly detection are provided. In some embodiments, a method for outputting data based on anomaly detection is provided, the method comprising: receiving, using a hardware processor, an input dataset; identifying grams in the input dataset that substantially include distinct byte values; creating an input subset by removing the identified grams from the input dataset; determining whether the input dataset is likely to be anomalous based on the identified grams, and determining whether the input dataset is likely to be anomalous by applying the input subset to a binary anomaly detection model to check for an n-gram in the input subset; and outputting the input dataset based on the likelihood that the input dataset is anomalous.
摘要翻译：提供了基于异常检测输出数据的系统，方法和媒体。在一些实施例中，提供了一种用于基于异常检测输出数据的方法，所述方法包括：使用硬件处理器接收输入数据集; 识别基本上包含不同字节值的输入数据集中的克数; 通过从输入数据集中移除所识别的克来创建输入子集; 基于所识别的克确定输入数据集是否可能是异常的，并且通过将输入子集应用于二进制异常检测模型来确定输入数据集是否可能是异常的，以检查输入子集中的n-gram; 并且基于输入数据集是异常的可能性来输出输入数据集。

7. 发明申请

US20150058981A1 SYSTEMS, METHODS, AND MEDIA FOR OUTPUTTING DATA BASED UPON ANOMALY DETECTION 审中-公开
标题翻译：基于异常检测的输出数据的系统，方法和媒体
公开(公告)号：US20150058981A1
公开(公告)日：2015-02-26
申请号：US13891031
申请日：2013-05-09
申请人： Salvatore J. Stolfo , Ke Wang , Janak Parekh
发明人： Salvatore J. Stolfo , Ke Wang , Janak Parekh
IPC分类号： H04L29/06
CPC分类号： G06F21/56 , G06F21/564 , G06F2221/034 , H04L63/1416 , H04L63/1425
摘要： Systems, methods, and media for outputting data based on anomaly detection are provided. In some embodiments, a method for outputting data based on anomaly detection is provided, the method comprising: receiving, using a hardware processor, an input dataset; identifying grams in the input dataset that substantially include distinct byte values; creating an input subset by removing the identified grams from the input dataset; determining whether the input dataset is likely to be anomalous based on the identified grams, and determining whether the input dataset is likely to be anomalous by applying the input subset to a binary anomaly detection model to check for an n-gram in the input subset; and outputting the input dataset based on the likelihood that the input dataset is anomalous.
摘要翻译：提供了基于异常检测输出数据的系统，方法和媒体。在一些实施例中，提供了一种用于基于异常检测输出数据的方法，所述方法包括：使用硬件处理器接收输入数据集; 识别基本上包含不同字节值的输入数据集中的克数; 通过从输入数据集中移除所识别的克来创建输入子集; 基于所识别的克确定输入数据集是否可能是异常的，并且通过将输入子集应用于二进制异常检测模型来确定输入数据集是否可能是异常的，以检查输入子集中的n-gram; 并且基于输入数据集是异常的可能性来输出输入数据集。

8. 发明授权

US08763103B2 Systems and methods for inhibiting attacks on applications 有权
标题翻译：抑制应用攻击的系统和方法
公开(公告)号：US08763103B2
公开(公告)日：2014-06-24
申请号：US12297730
申请日：2006-04-21
申请人： Michael E. Locasto , Salvatore J. Stolfo , Angelos D. Keromytis , Ke Wang
发明人： Michael E. Locasto , Salvatore J. Stolfo , Angelos D. Keromytis , Ke Wang
IPC分类号： H04L29/06 , G06F21/41
CPC分类号： H04L63/1416 , G06F21/41 , H04L63/0815 , H04L63/1408 , H04L63/1441
摘要： In accordance with some embodiments of the present invention, systems and methods that protect an application from attacks are provided. In some embodiments of the present invention, input from an input source, such as traffic from a communication network, can be routed through a filtering proxy that includes one or more filters, classifiers, and/or detectors. In response to the input passing through the filtering proxy to the application, a supervision framework monitors the input for attacks (e.g., code injection attacks). The supervision framework can provide feedback to tune the components of the filtering proxy.
摘要翻译：根据本发明的一些实施例，提供了保护应用免受攻击的系统和方法。在本发明的一些实施例中，可以通过包括一个或多个过滤器，分类器和/或检测器的过滤代理来路由来自诸如来自通信网络的业务的输入源的输入。响应于通过过滤代理的输入到应用程序，监督框架监视输入的攻击（例如代码注入攻击）。监督框架可以提供反馈来调整过滤代理的组件。

9. 发明申请

US20100146615A1 Systems and Methods for Inhibiting Attacks on Applications 有权
标题翻译：用于抑制应用攻击的系统和方法
公开(公告)号：US20100146615A1
公开(公告)日：2010-06-10
申请号：US12297730
申请日：2006-04-21
申请人： Michael E. Locasto , Salvatore J. Stolfo , Angelos D. Keromytis , Ke Wang
发明人： Michael E. Locasto , Salvatore J. Stolfo , Angelos D. Keromytis , Ke Wang
IPC分类号： H04L9/00 , H04K1/00
CPC分类号： H04L63/1416 , G06F21/41 , H04L63/0815 , H04L63/1408 , H04L63/1441
摘要： In accordance with some embodiments of the present invention, systems and methods that protect an application from attacks are provided. In some embodiments of the present invention, input from an input source, such as traffic from a communication network, can be routed through a filtering proxy that includes one or more filters, classifiers, and/or detectors. In response to the input passing through the filtering proxy to the application, a supervision framework monitors the input for attacks (e.g., code injection attacks). The supervision framework can provide feedback to tune the components of the filtering proxy.
摘要翻译：根据本发明的一些实施例，提供了保护应用免受攻击的系统和方法。在本发明的一些实施例中，可以通过包括一个或多个过滤器，分类器和/或检测器的过滤代理来路由来自诸如来自通信网络的业务的输入源的输入。响应于通过过滤代理的输入到应用程序，监督框架监视输入的攻击（例如代码注入攻击）。监督框架可以提供反馈来调整过滤代理的组件。

10. 发明申请

US20100054278A1 APPARATUS METHOD AND MEDIUM FOR DETECTING PAYLOAD ANOMALY USING N-GRAM DISTRIBUTION OF NORMAL DATA 有权
标题翻译：使用正常数据的N-GRAM分布检测负载异常的装置方法和介质
公开(公告)号：US20100054278A1
公开(公告)日：2010-03-04
申请号：US12615917
申请日：2009-11-10
申请人： Salvatore J. Stolfo , Ke Wang
发明人： Salvatore J. Stolfo , Ke Wang
IPC分类号： H04J3/24
CPC分类号： H04L63/1425 , G06F21/55 , G06F21/552 , G06F21/554 , G06F21/56 , G06F21/562 , G06F21/563 , G06F21/564 , H04L43/00 , H04L43/0876 , H04L63/0218 , H04L63/0245 , H04L63/0263 , H04L63/029 , H04L63/145
摘要： A method, apparatus and medium are provided for detecting anomalous payloads transmitted through a network. The system receives payloads within the network and determines a length for data contained in each payload. A statistical distribution is generated for data contained in each payload received within the network, and compared to a selected model distribution representative of normal payloads transmitted through the network. The model payload can be selected such that it has a predetermined length range that encompasses the length for data contained in the received payload. Anomalous payloads are then identified based on differences detected between the statistical distribution of received payloads and the model distribution. The system can also provide for automatic training and incremental updating of models.
摘要翻译：提供了一种用于检测通过网络发送的异常有效载荷的方法，装置和介质。系统在网络内接收有效载荷并确定每个载荷中包含的数据的长度。为包含在网络中接收的每个有效载荷中的数据生成统计分布，并与代表通过网络传输的正常有效载荷的所选模型分布进行比较。可以选择模型有效载荷，使得其具有预定的长度范围，其包含包含在接收到的有效载荷中的数据的长度。然后根据接收到的有效载荷的统计分布和模型分布之间检测到的差异来识别异常有效载荷。该系统还可以提供模型的自动训练和增量更新。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式